Editor's note

This partly comes down to the action involved, as the
drawing of the secret gives an observer a continuous
action to watch rather than a series of taps (which are
more difficult to keep track of if you’re trying to watch
what someone else is doing). Also, if a would-be
impostor actually has sight of the user’s screen, then
they may be a glimpse of the overall pattern itself, as
depicted in Figure 2. Although Android offers an option
to make the entry of the pattern invisible, this actually
becomes quite difficult for the authorized user to follow
(i.e. to keep track of their position in a long pattern) and
to tell if they are doing it right. The option to enable
tactile feedback (by means of small vibrations) does
provide some help here to an extent, but it’s still easy to
make a mistake.
Once an impostor gets hold of a device, then it’s
sometimes possible to determine the unlock pattern from
the smudges and smears that the owner’s fingers have
left on the screen. In fact, my first practical encounter
with the pattern unlock technique was when a one of my
students had popped out of the room and left his phone on
the table. One of his ‘friends’ then picked it up, looked at
the screen, determined the unlock pattern … and quickly
changed it to something else. Although it was all done in
fun on this occasion, it was a fairly clear illustration of the
vulnerability. The feasibility of such attacks has also been
recognized in the research community, with academics
from the University of Pennsylvania having published a
detailed paper on the topic (Aviv, A.J., Gibson, K., Mossop,
E., Blaze, M. and Smith, J.M. 2010. Smudge Attacks on
Smartphone Touch Screens, in 4th USENIX Workshop
on Offensive Technologies (WOOT’10), Washington DC,
9 August 2010. http://www.usenix.org/events/woot10/
tech/full_papers/Aviv.pdf).
In the same way that they can choose guessable
PINs, there is a risk of users having a tendency towards
predictable patterns (indeed,
users already do this with
PINs, with Amitay’s study
revealing ‘2580’ to be the third
most popular choice – not an
obviously memorable number
until you look at the pattern it
traces out on the keypad). In
addition, there’s a reduced
set of permutations compared
to an equivalent length PIN,
because each elements of
the pattern are more likely to
adjacent to each other (they
don’t have to be, but it’s more
likely to happen as a result of
the way that many users will
starterkit 02/2011(2)
MOBILE PENTESTING
draw them), and unlike the digits in PIN, the positions
in the pattern cannot be repeated. Having said this, the
range of valid permutations is still sufficient to ensure
that users have the chance to select patterns that are
far from trivial to break or predictable to guess.
On the positive side, the use of a pattern helps to
guard against sharing – it’s hard to describe your
pattern to someone when compared to a passing on a
password or PIN, and so a user would have to spend
time showing someone. However, users may also find
long patterns potentially more difficult to remember
than a numerical sequence of equivalent length,
because they don’t have the opportunity to remember
the information as a meaningful string in its own right.
However, it is arguable that users with better visual/task
memory will find the action of recalling and recreating
the pattern to be an easier proposition.
In addition to the pattern lock, the latest version of
Android, Ice Cream Sandwich (ICS), has taken things
further with introduction of face recognition. This
leverages the handset’s front-facing camera to enable
the phone to unlock when it sees its owner. However, no
sooner had this appeared than coverage and commentary
started to suggest potential problems, such as the risk of
being able to fool the mechanism by showing it a photo
of the legitimate user, or difficulty of using it in low light
conditions (Kaelin, L. 2011. Android’s face unlock feature
could be fooled by photo, TechSpot, 21 October 2011.
http://www.techspot.com/news/45953-androids-faceunlock-feature-could-be-fooled-by-photo.html).
Given the
right lighting, however, it operates very effectively and
can certainly be accomplished more quickly and with
less effort than entering a PIN or a pattern.
Although faults might be leveled at each of the
techniques in isolation, a key thing is that Android offers
a range of options. So, from a usability perspective, the
Figure 3. Variations of the iOS passcode (a) Simple (b) numeric-only and (c) full character set
Page 20 http://pentestmag.com