1 / 42

Shoulder Surfing 2.0

Shoulder Surfing 2.0. Old school techniques made easy. Who’s the guy?. Prof. InfoSec & Cryptography at National Tech . Univ. CISSP Security Researcher TEDx Speaker Book Author  Ok , all in spanish. Federico Pacheco @FedeQuark. In the beginning. Then. Nowadays.

loriew
Download Presentation

Shoulder Surfing 2.0

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ShoulderSurfing 2.0 Old schooltechniquesmadeeasy

  2. Who’s the guy? • Prof. InfoSec & Cryptography at NationalTech. Univ. • CISSP • Security Researcher • TEDx Speaker • Book Author Ok, all in spanish Federico Pacheco @FedeQuark

  3. In thebeginning

  4. Then

  5. Nowadays

  6. Passwords, passwords everywhere • Main authentication factor • Repeated between services • Not so often changed • Usually weak

  7. PasswordGuessing • Network Sniffing • SW/HW Keylogging • LoginBruteforcing • RainbowTables • FakeLogin • Social Engineering • ShoulderSurfing

  8. Eye EyeEye • Reading angle • 90° +/- 30° Vertical • 90° +/- 40° Horizontal • Reading focal distance • 38 - 63 cm • Max: 1 m (Arial 12)

  9. YoumaysayI’mawfulontyping • But I’m not the onlye one… • Professional: 50-80 wpm • 2-fingered: 27-37 wpm

  10. Time goesby, but… • Peopletypetheirpwds in front of others • Ifnobodyiswatching, no onesuspect

  11. ShoulderSurfing 2.0

  12. SS2.0 in a nutshell • Stand nearthetypist • Point hiskeyboardwiththemirror • Record video whiletyping • Process & Analysis Wherethemagichappens • Getthepwd

  13. Friend’s iPhone Camera Mirror Bitednail

  14. Thecoolway (DealeXtremestuff)

  15. You see… Anything? Whataboutthis? Themirror, bitch!

  16. 3approaches 3 • Independentimageprocessing • Direct video processing • Automatedprocessing

  17. 1: Independentimageprocessing • Frameextraction • ffmpeg • BatchProcessing • IrfanView • Analysis • Eyework

  18. Frameextraction

  19. Rotate & Mirroring  Original Rotated Mirrored

  20. Batch Processing

  21. Basic Analysis

  22. Case Study • iPhone 5 (HD 1080) • Normal typing • Indoor light

  23. Q Z A W X S E C D R V F G T B H Y N J U M K I , . L O P Ñ -

  24. Q Z A W X S E C D R V F G T B H Y N J U M K I , . L O P Ñ -

  25. Tips • Transparentkeyboard • Watch at theprevious & nextmovement • ConsiderShifted/Altedkeys

  26. Didn’tgetenoughkeys? No Prob! Yourbrainneedsjust 70% _OU CA_ R__D T_ _S SH_U_DE_ S_RFI_G _.0 R_ LE _ I N_ _D T_ SL_ _P

  27. 2: Direct video processing • Video analysis software • Kinovea (Open Source)

  28. Handson

  29. 3: Automatedprocessing • 3D Modeling • Hand • Keyboard • Motionestimation • 3D over 2D • PhysicsEngine • Motion tracking • Collisiondetection • Python script thatsolveseverything…

  30. All in all… • Old Techniques + New Technologies = Cool • PracticeClassicShouldersurfing & 2.0 twist • More applications • Mobile, electroniclocks, etc.

  31. ¡Thanks!

More Related