TAPS: Assessing, Mitigating and Raising Awareness of the Security and Privacy Risks of Thermal Imaging

TAPS：评估、减轻和提高对热成像安全和隐私风险的认识

• 批准号: EP/V008870/1
• 负责人: Mohamed Khamis
• 金额: $ 33.4万
• 依托单位: University of Glasgow
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2021
• 资助国家: 英国
• 起止时间: 2021 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FV008870%2F1
• 关键词: TAPS; Assessing; Mitigating; Raising; Awareness

Thermal imaging technologies are continuously becoming more affordable and accessible to everyone. Today, a thermal camera can be bought for less than £150. Thermal imaging can be used maliciously to infer the user input on keyboards and touchscreens. For example, taking a thermal image of a keyboard after a user has interacted with it reveals recent input such as passwords, or sensitive messages. This project aims to 1) assess the viability of thermal attacks in everyday computer and mobile usage scenarios, 2) develop and evaluate methods for resisting them on desktop and mobile settings, and 3) raise awareness about this threat and possible countermeasures through impact activities that engage with Logitech, a major manufacturer of input peripherals, and local partners such as CENSIS. This project will produce 1) a dataset of thermal images for research on thermal attacks, 2) empirical findings that explain which factors impact the effectiveness of thermal attacks in realistic everyday scenarios in desktop and mobile settings, 3) recommendations for users and manufacturers for resisting thermal attacks on touchscreens and keyboards, 4) a novel machine learning model to be used by researchers and practitioners to analyse the effectiveness of thermal attacks and evaluate countermeasures, 5) a novel machine learning model that predicts vulnerability to thermal attacks and tools that use it to mitigate the risk, and 6) material to raise awareness about thermal attacks and possible countermeasures.

热成像技术正变得越来越便宜，每个人都可以使用。如今，一台热成像相机的价格不到150英镑。热成像可以被恶意地用来推断键盘和触摸屏上的用户输入。例如，在用户与键盘交互后拍摄键盘的热图像，可以显示最近的输入，如密码或敏感消息。该项目旨在1）评估日常计算机和移动的使用场景中热攻击的可行性，2）开发和评估在桌面和移动的设置上抵抗它们的方法，以及3）通过与输入外设的主要制造商Logitech和CENSIS等当地合作伙伴进行影响活动，提高对这种威胁和可能对策的认识。该项目将产生1）用于热攻击研究的热图像数据集，2）解释在桌面和移动的设置中的现实日常场景中哪些因素影响热攻击有效性的实证研究结果，3）为用户和制造商提供抵抗触摸屏和键盘上的热攻击的建议，4）一种新的机器学习模型，供研究人员和从业人员使用，以分析热攻击的有效性并评估对策，5）一种新的机器学习模型，预测热攻击的脆弱性和使用它来减轻风险的工具，以及6）提高对热攻击和可能对策的认识的材料。

项目成果

Human-Computer Interaction - INTERACT 2021 - 18th IFIP TC 13 International Conference, Bari, Italy, August 30 - September 3, 2021, Proceedings, Part IV

人机交互 - INTERACT 2021 - 第 18 届 IFIP TC 13 国际会议，意大利巴里，2021 年 8 月 30 日至 9 月 3 日，会议记录，第四部分

• DOI: 10.1007/978-3-030-85610-6_41
• 发表时间: 2021
• 作者: Abdrabou Y

Understanding Shoulder Surfer Behavior and Attack Patterns Using Virtual Reality

使用虚拟现实了解肩冲浪者行为和攻击模式

• DOI: 10.1145/3531073.3531106
• 发表时间: 2022
• 作者: Abdrabou Y

"Your Eyes Tell You Have Used This Password Before": Identifying Password Reuse from Gaze and Keystroke Dynamics

“你的眼睛告诉你以前用过这个密码”：从注视和击键动态识别密码重用

• DOI: 10.1145/3491102.3517531
• 发表时间: 2022
• 作者: Abdrabou Y

CueVR: Studying the Usability of Cue-based Authentication for Virtual Reality

CueVR：研究基于提示的虚拟现实身份验证的可用性

• DOI: 10.1145/3531073.3531092
• 发表时间: 2022
• 作者: Abdelrahman Y

Advanced Techniques for Preventing Thermal Imaging Attacks

• DOI: 10.1145/3490100.3516472
• 发表时间: 2022-03
• 期刊: Companion Proceedings of the 27th International Conference on Intelligent User Interfaces
• 作者: N. Alotaibi;M. Islam;Karola Marky;Mohamed Khamis-