Password Extraction via Reconstructed Wireless Mouse Trajectory
Password Extraction via Reconstructed Wireless Mouse Trajectory
复制标题
DOI：
10.1109/tdsc.2015.2413410
复制
发表时间：
2016-07
影响因子：
7.3
通讯作者：
Xian Pan;Zhen Ling;Aniket Pingley;Wei Yu;Nan Zhang;K. Ren;Xinwen Fu
中科院分区：
文献类型：
--
作者：
Xian Pan;Zhen Ling;Aniket Pingley;Wei Yu;Nan Zhang;K. Ren;Xinwen Fu
罗技在2009年发表了以下声明：“由于鼠标的移动不会给黑客提供任何有用的信息，因此鼠标报告没有加密。”在本文中，我们证明了恰恰相反的情况是正确的。在美国，通过更换蓝牙鼠标，密码等敏感信息确实有可能泄露。我们的结果可以很容易地扩展到使用不同无线电链路的其他无线鼠标。我们首先介绍嗅探包含原始鼠标移动数据的未加密蓝牙数据包的多种方法。然后我们表明，这些数据可能会泄露通过点击软件键盘输入的基于文本的密码。我们提出了两种攻击，预测攻击和重放攻击，这两种攻击可以从嗅探到的鼠标运动数据中重建屏幕上的光标轨迹。两种推断策略用于从光标轨迹中发现密码。我们对所有流行的操作系统进行了全面的研究，并分析了鼠标加速算法和数据包丢失如何影响重建结果。我们的真实世界实验证明了未加密蓝牙鼠标隐私泄露的严重性。我们还讨论了防止无线鼠标泄露隐私的对策。据我们所知，我们的工作是第一个证明原始鼠标数据泄露隐私的工作。
Logitech made the following statement in 2009: “Since the displacements of a mouse would not give any useful information to a hacker, the mouse reports are not encrypted.” In this paper, we prove the exact opposite is true-i.e., it is indeed possible to leak sensitive information such as passwords through the displacements of a Bluetooth mouse. Our results can be easily extended to other wireless mice using different radio links. We begin by presenting multiple ways to sniff unencrypted Bluetooth packets containing raw mouse movement data. We then show that such data may reveal text-based passwords entered by clicking on software keyboards. We propose two attacks, the prediction attack and replay attack, which can reconstruct the on-screen cursor trajectories from sniffed mouse movement data. Two inference strategies are used to discover passwords from cursor trajectories. We conducted a holistic study over all popular operating systems and analyzed how mouse acceleration algorithms and packet losses may affect the reconstruction results. Our real-world experiments demonstrate the severity of privacy leakage from unencrypted Bluetooth mice. We also discuss countermeasures to prevent privacy leakage from wireless mice. To the best of our knowledge, our work is the first to demonstrate privacy leakage from raw mouse data.