Behavioral Acoustic Emanations: Attack and Verification of PIN Entry Using Keypress Sounds

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Personal Identification Number (PIN) entry devices (PEDs) are widely used for user authentication in various applications.
• PEDs rely on small data strings like PINs for verifying user legitimacy.
• Existing security measures are vulnerable to sophisticated attacks.

Purpose of the Study:

• To explore the security vulnerabilities of PIN entry devices.
• To propose a novel acoustic side-channel attack for PIN recovery.
• To develop a machine learning-based user verification method to enhance security.

Main Methods:

• Acoustic emanations from PIN entry devices were captured.
• Keystroke intervals were extracted as features for machine learning models.
• A PIN recovery attack model and a user verification model were trained.

Main Results:

• The PIN recovery attack model achieved a 60% chance of successfully recovering a 4-6 digit PIN.
• The user verification model demonstrated an 88% accuracy in identifying the correct user.
• The acoustic side-channel attack was shown to be low-cost and effective.

Conclusions:

• Acoustic side-channel attacks pose a significant threat to PIN entry devices.
• The proposed verification method offers a viable countermeasure to improve PED security.
• This research highlights the need for enhanced security protocols in user authentication systems.