Your phone's motion sensors may reveal your PIN, passwords

April 11, 2017

London, Apr 11: Hackers can steal your PINs and passwords just from the motion of your phone when you type in the information, warn experts who have unveiled how easy it is for malicious websites and installed apps to spy on you. Cyber experts at Newcastle University in the UK have shown it is possible to crack four-digit PINs with a 70 per cent accuracy on the first guess - 100 per cent by the fifth guess - using just the data collected via the phone's numerous internal sensors.

phoneDespite the threat, the research shows that people are unaware of the risks and most of us have little idea what the majority of the twenty five different sensors available on current smart phones do. While all the major players in the industry are aware of the problem, no-one has yet been able to find a solution.

"Most smart phones, tablets, and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera and microphone to instruments such as the gyroscope, proximity, NFC, and rotation sensors and accelerometer," said Maryam Mehrnezhad, research fellow at Newcastle University. "But because mobile apps and websites don't need to ask permission to access most of them, malicious programmes can covertly 'listen in' on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords," said Mehrnezhad.

"More worrying, on some browsers, we found that if you open a page on your phone or tablet which hosts one of these malicious code and then open, for example, your online banking account without closing the previous tab, then they can spy on every personal detail you enter," she said. "And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked," she added.

"Despite the very real risks, when we asked people which sensors they were most concerned about we found a direct correlation between perceived risk and understanding," said Mehrnezhad. "So people were far more concerned about the camera and GPS than they were about the silent sensors," she said.

Sensors are now commonplace in smart devices and are largely responsible for the boom in mobile gaming and health and fitness apps, and soon in all devices in the Internet of Things (IoT), researchers said. The data provided by them combined with the growing computational ability of mobile phones and tablets has transformed the way we use them.

In total, the team identified 25 different sensors which now come as standard on most smart devices and are used to give different information about the device and its user. Only a small number of these - such as the camera and GPS - ask the user's permission to access the device. The research was published in the International Journal of Information Security.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 16,2020

Claiming that e-commerce giants like Amazon import as much as 80 per cent of the items sold on their platforms, small manufacturers' body has said that their business models do not benefit local industry and are creating jobs of delivery boys only.

"Neither manufacturers nor traders are getting any benefit from the business models of Amazon and Flipkart because they largely import their products from China and Korea and sell here. Nearly 80 per cent of their products are imported," said Anil Bhardwaj, Secretary General, Federation of Indian Micro and Small & Medium Enterprises (FISME).

Bhardwaj said that the global e-commerce players generally source and sell products through their own preferred suppliers and as a result a large number of local manufacturers and traders get crowded out.

He listed out deep discounting and buying products from preferred companies as unfair practices.

"Even if they buy products from local suppliers the commission charged is very high," Bhardwaj said adding that the issues related to unfair practices have been raised with Commerce Ministry on multiple occasions.

FISME maintains that the technology-driven retail is way forward and one cannot be oblivious of the benefits it brings to consumers but at the same time the local industry can also not be ignored given its role in job creation.

"If both traders and local manufacturers are crowded out then how would the local industry survive and employment be generated?" asked Bhardwaj.

As Amazon Founder and CEO Jeff Bezos is currently on his three-day visit to India, the local traders are up in arms against the "unfair" trade practices of the tech giant. Delhi-based Confederation of All India Traders (CAIT) has launched a countrywide protest against the company and has organised protests across 300 cities.

In a setback to Amazon and Walmart-backed Flipkart, the fair market watchdog Competition Commission of India (CCI) has ordered probe into the business operations of both the companies on multiple counts including deep-discounts and exclusive tie-up with preferred sellers.

"For the first time some concrete step has been taken against Amazon and Flipkart who are continuously violating the FDI policy in indulging in a vicious racket of controlling and monopolising not only the e-commerce but even the retail trade as well," CAIT National Secretary General Praveen Khandelwal said after the CCI order.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 15,2020

New Delhi, Jul 15: The employees union of state-run telecom operator BSNL will stage protests across the country on Thursday on a host of issues including the cancellation of its 4G tender and non-payment of salaries.

All major unions are organising ‘lunch-hour black-flag' demonstrations throughout the country under the banner of All Unions and Association of BSNL (AUAB), said a statement by AUAB. These demonstrations will be organised, by maintaining social distancing and by taking other precautions, like wearing of masks. The BSNL employees will also wear black-badges the whole day on July 16.

The employees body would demand that BSNL should immediately be allowed to roll out its 4G services and the tender should be issued immediately. Further, they want that in the matter of procuring new equipment and upgradation, there should not be any discrimination between BSNL and other private telecom service providers.

Recently, the Centre cancelled the 4G upgradation tender for BSNL as it had decided to come up with fresh specifications for the upgrade process, in a move to keep Chinese technology companies at bay as the border tussle escalated with the northern neighbour.

The Department of Telecommunications (DoT) would issue a fresh tender for the same, and people in the know said that Chinese companies may not be allowed to participate.

"The agitational programme is being organised to express the deep anguish and resentment of the employees against cancellation of BSNL's 4G tender, cancellation of BSNL's proposal for upgradation of its 49,300 BTSs to 4G, abnormal delay in issuing ‘Add on Order' for 4G equipments, inordinate delay in the implementation of BSNL's Revival Package and against the non-settlement of the burning problems of the employees," said the statement.

The umbrella body of BSNL's employees' unions noted that rolling out of 4G services is the backbone for the revival of this telecom PSU, but the recent cancellation of the tender floated by BSNL for procuring 4G equipment at a cost of Rs 9,300 crore, has brought the company back to square one.

It said that BSNL is already having 49,300 base transceiver stations (BTS), which are 4G compatible and through minor upgradation, all these equipment can be converted into 4G BTSs with an investment of about Rs 1,500 crore.

In addition to this, BSNL could have added another 15,000 BTSs, by placing an Add on Order to the existing mobile tender, it added.

Noting that in October 2019, the PSU could have rolled out pan-India 4G services, AUAB said: "Being the sole owner of the company, the Government of India also cannot shirk its responsibility in this matter."

"Adding insult to injury, the tender floated by BSNL to procure 4G equipment, has been cancelled by the government, based on a complaint from the Telecom Equipments and Services Promotional Council (TEPC)," it said.

AUAB said that BSNL is already lagging four years behind the private operators, in terms of 4G and the cancellation of the tender is going to inordinately delay the company's 4G launch.

Saying that TEPC's contention has been to bar foreign companies from participating in BSNL's tender, AUAB statement pointed out that when private operators are procuring equipment from multinationals, "why BSNL alone should be compelled to procure 4G equipments from domestic vendors, whose 4G technology is not tested or proven so far."

It alleged a conspiracy to destabilise BSNL by disrupting its rolling out of 4G services.

AUAB further said that even after the lapse of nine months, the implementation of the much publicised BSNL's Revival Package is moving at a snail's pace.

"Except the swift retrenchment of 79,000 BSNL employees under VRS, all other assurances given in BSNL's Revival Package have been put in cold storage."

The management should ensure that the salary payment of the employees is made on the last working day of every month. Deductions made from employees' salary, on account of "society dues", should immediately be remitted, it said.

Regarding the monetisation of the company's assets under the revival package, the organisation said that the land asset should not be handed over to corporates, at "throwaway" prices.

"These lands should be sold in a transparent manner and at the prevailing market rates. They should not be sold at book value or at circle rates. The AUAB will strictly monitor these dealings," it said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.