Using Machine Learning to Guess PINs from Video

Researchers trained a machine-learning system on videos of people typing their PINs into ATMs:

By using three tries, which is typically the maximum allowed number of attempts before the card is withheld, the researchers reconstructed the correct sequence for 5-digit PINs 30% of the time, and reached 41% for 4-digit PINs.

This works even if the person is covering the pad with their hands.

The article doesn’t contain a link to the original research. If someone knows it, please put it in the comments.

Slashdot thread.

EDITED TO ADD (11/11): Here’s the original research.

Posted on October 19, 2021 at 8:07 AM10 Comments

Comments

Sut Vachz October 19, 2021 10:18 AM

This will be countered by the adversarial random strobe wrist flashlight bracelet, and, of course, the patented Prostect-a-thesis Six-fingered-Hand Glove.

Quantry October 19, 2021 12:48 PM

You can always key in extra numbers and “correct” intermittently right?

@ Sut Vachz : about your “…adversarial random strobe wrist flashlight bracelet…”,

Surely LED’s colors not visible to humans can also be incorporated around the keypad, to overdrive the CCD sensitivity to light noise in a random way.

I’ve been keen to hear of any commercial sources for worn devices, especially hats and facemasks, and sunglasses etc…

The authors claim “…only PIN shields that offer full PIN pad coverage can be considered effective countermeasures to our attack…”

How about a convex mirror so you can see anyone behind you? I don’t think there’s enough incentive.

Peter A. October 20, 2021 3:26 AM

@Quantry: re: convex mirrors

Many machines over here have them. The mirrors don’t help for elderly women who hunch behind your back in the queue. I prefer to visit a branch but that’s not always practical. Yeah, I am a lazy chap.

David October 20, 2021 4:12 AM

Petrol station pump card readers are worse, positioned high so that the security cctv in the canopy gets a good view of you typing your PIN number

Jesse Thompson October 20, 2021 3:27 PM

@Quantry

You can always key in extra numbers and “correct” intermittently right?

Possibly, though one frustration I have is that covering the pad with your hand frequently blocks your own visibility of the display, too. So it’s not always clear if the available delete key backspaces one character or clears the whole set.

My MO is to pantomime typing noise characters, sometimes pausing for a fraction of a second to make it look like I’m putting extra pressure on at least one of them due to real key presses looking like they involve more pressure. I’ve got the habit down pat to get 10 key presses, only some of which are real, keyed down in just a few seconds.

The rub is having somebody with you that wonders if you’re only covering up the pad to demonstrate that you don’t trust them personally, lol. I usually eat the insinuation to avoid having to get into a conversation about cameras existing.

David Leppik October 20, 2021 3:33 PM

I’m guessing that if you put fingers on the whole row of numbers before pressing, you can defeat this particular AI. Whether or not it is enough to defeat the general attack, I’m not sure. The fact that the AI outperforms humans suggests that it may be working at the limits of the available data.

One would hope that the bank preserves its security camera footage and is willing to refund you if someone steals your money.

Clive Robinson October 20, 2021 7:41 PM

@ David Leppik, ALL,

I’m guessing that if you put fingers on the whole row of numbers before pressing, you can defeat this particular AI.

What you need is a little sleight of hand. Or press the button with the thumb under hand.

Step 1) Hold your “dominant” hand out in front of you flat with the back of the hand upper most.

Step 2) Bring your thumb under your hand so the thumb-nail is at the base of the little finger. Seen from the top your whole thumb down to the wrist should be “under your hand” and out of sight. If not practice moving the thumb from sticking out straight sideways to touching under the little finger untill your thumb is “limber enough”.

Step 3) Now gently bend the fingers a little like you were starting to make a young childs fist with the thumb in (as adults we should know never to make a fist with the thumb in as that is an easy way to break it even in play sparing).

Step 4) Now put your hand down on the table so all your finger tips touch the table, but your thumb does not.

Step 5) Now use your thumb tip to touch each of the fingers where they touch the table. Do this in turn in each direction several times and randomly as well.

Do this as a practice excercise a few times. With practice you can get all of the thumb down to the wrist to be under the hand and out of sight from above yet be able to still touch individual finger tips on the table.

If you now hold your other hand flat and across your dominant hand at around 90 degrees you will cover the small movment at the side of your dominant hand as you move your thumb.

With practice you will be able to press any one of the buttons under your hand without it being visable.

Now you have to practice moving both hands so you dial say the first and last of your PIN number with your thumb and the other digits with your fingers but with your other hand over them.

With practice you can make it look like you are pressing a button with a finger, when in fact you are pressing an entirely different button with your thumb. Moving the other hand across the top makes it difficult to see what is actually going on even when recorded to a video clip.

Oh and if you master it you will find that you can put your hand over a coin on the table and flip it over with your thumb. It’s a little trick that comes in handy when some one calls heads or tails.

But you are now asking “how do you know which way it’s up?…

That’s easy when you flip a coin from your thumb it goes up and you catch it in your hand and bring it down onto the back of your other hand.

Now if you practice the catch you will discover you can see which way up it is as you bring it down on the back of your other hand…

It used to amaze my son and others when he was quite young. As a party trick / magic for a kids party it’s a fun little thing to do, but don’t do it with adults as they catch on quick and they might not find it either fun or funny… Especially if you go on to learn how to do it the other way up with say the ring finger so you can deal cards off the bottom of the pack etc.

Any way don’t worry I won’t get “Thrown out of the Magic Circle” for having told you… Because I never joined in the first place as most of the tricks are to obvious 😉

SpaceLifeForm October 24, 2021 11:28 PM

Not exactly the same, but close.

hxtps://www.researchgate.net/publication/268279049_Beware_Your_Hands_Reveal_Your_Secrets

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.