On the Practicality of Motion Based Keystroke Inference Attack

Liang Cai and Hao Chen

Recent researches have shown that motion sensors may be used as a side
channel to infer keystrokes on the touchscreen of
smartphones. However, the practicality of this attack is unclear. For
example, does this attack work on different devices, screen
dimensions, keyboard layouts, or keyboard types? Does this attack
depend on specific users or is it user independent? To answer these
questions, we conducted a user study where 21 participants typed a
total of 47,814 keystrokes on four different mobile devices in six
settings. Our results show that this attack remains effective even
though the accuracy is affected by user habits, device dimension,
screen orientation, and keyboard layout. On a number-only keyboard,
after the attacker tries 81 4-digit PINs, the probability that she has
guessed the correct PIN is 65%, which improves the accuracy rate of
random guessing by 81 times. Our study also indicates that inference
based on the gyroscope is more accurate than that based on the
accelerometer. We evaluated two classification techniques in our
prototype and found that they are similarly effective.