Malicious applications can freely access sensor data on modern smartphones and use this highly sensitive data stream to collect vasts amounts of intel on the phone's owner, information that they can later use to guess the user's phone PIN.
This is the conclusion of research published this month by researchers from the Nanyang Technological University (NTU) in Singapore.
The three scientists behind this work are only the most recent group of researchers that have noticed a glaring security hole in the design of modern mobile operating systems such as Android and iOS.
Researchers say that these operating systems do not require apps to ask users for permissions before accessing sensor data.
To prove their point, researchers created an Android app that they installed on test devices that silently collected data from six sensors: accelerometer, gyroscope, magnetometer, proximity sensor, barometer, and ambient light sensor.
The algorithm analyzed the collected sensor data and was able to distinguish between presses on different keys by looking at device tilt (space and angle-related coordinates) and nearby ambient light whenever the user moved his finger over the phone's touchscreen to enter the PIN and unlocked the device.
During their experiment, the research team used sensor data only from 500 random PIN-entry operations supplied by three candidates, meaning the algorithm could become more accurate as it collected more data.
Based on the research team's samples, the algorithm was able to guess a PIN code with a 99.5% accuracy on the first try using PINs from a list of the 50 most common PIN numbers. Previous research had a success rate of 74% using the same list of the 50 most common PIN numbers, the research team said.
The success rate went down from 99.5% to 83.7% when researchers tried to guess all 10,000 possible combinations of four-digit PINs within 20 tries.
"Moreover, with the underlying agile methodology, the technique can be easily scaled up to longer PINs," researchers said.
The real problem, as highlighted by the NTU team, is the ability of apps to access sensor data without asking users beforehand. Both Android and iOS are affected by this issue.
NTU researchers say this OS design flaw could be weaponized in several other ways and could be used to steal more than PINs.
Some of this research has already been carried out before the NTU team published its paper [There Goes Your PIN: Exploiting Smartphone Sensor Fusion Under Single and Cross User Setting] in early December 2017.
For example, in September, Princeton researchers silently collected data from a phone's sensors to successfully infer a user's geographical location without asking the test subject for permission to access his phone's GPS tracking component.
As more research is being released on this topic, public pressure will mount on Google and Apple to add permissions for whenever user-installed apps are trying to access sensor data.