Boosting the Guessing Attack Performance on Android Lock Patterns with Smudge Attacks

다국어 초록 (Multilingual Abstract)

Android allows 20 consecutive fail attempts on unlocking a device. This makes it difficult for pure guessing attacks to crack user patterns on a stolen device before it permanently locks itself. We investigate the effectiveness of combining Markov model-based guessing attacks with smudge attacks on unlocking Android devices within 20 attempts. Detected smudges are used to pre-compute all the possible segments and patterns, significantly reducing the pattern space that needs to be brute-forced. Our Markov-model was trained using 70% of a real-world pattern dataset that consists of 312 patterns. We recruited 12 participants to draw the remaining 30% on Samsung Galaxy S4, and used smudges they left behind to analyze the performance of the combined attack. Our results show that this combined method can significantly improve the performance of pure guessing attacks, cracking 74.17% of patterns compared to just 13.33% when the Markov model-based guessing attack was performed alone---those results were collected from a naive usage scenario where the participants were merely asked to unlock a given device. Even under a more complex scenario that asked the participants to use the Facebook app for a few minutes---obscuring smudges were added as a result---our combined attack, at 31.94%, still outperformed the pure guessing attack at 13.33%. Obscuring smudges can significantly affect the performance of smudge-based attacks. Based on this finding, we recommend that a mitigation technique should be designed to help users add obscurity, e.g., by asking users to draw a second random pattern upon unlocking a device.

목차 (Table of Contents)

• 1. Introduction 1
• 2. Background 4
• 2.1 Android screen lock patterns 4
• 2.2 Attack model and assumptions 5
• 3. Smudge-supported pattern guessing attack 6
• 3.1 Extracting the pattern input area 8
• 3.2 Identifying smudge objects 9
• 3.3 Generating a set of segments forming the target pattern 12
• 3.3 Enumerating pattern candidates 13
• 4. Data collection 15
• 4.1 Collecting real-world patterns through Private Notes 15
• 4.2 Characteristics of real-world patterns 17
• 5. First results: Smug attack optimization 20
• 5.1 Methodology 20
• 5.2 Camera and lighting 21
• 5.3 Threshold values for determining relevant segments 21
• 5.4 Markov model optimization based on smug attack performance 23
• 6. Second results: Smug attack performance 25
• 6.1 Methodology 25
• 6.2 Smug attack performance 26
• 6.3 Effects of smudge obscurity 27
• 6.4 False positive and false negative analysis 29
• 7. Mitigation strategies 32
• 7.1 Adding obscurity 32
• 7.2 Allowing repeated points 35
• 7.3 Changing the pattern grid location 36
• 8. Discussion 37
• 8.1 Effectiveness of smug attacks 37
• 8.2 Limitations of smug attacks 38
• 8.3 Mitigation through adding obscurity 39
• 9. Related work 40
• 10. Conclusion 42
• 11. References 43
• Korean Abstract 47