Published in News

Android pattern security isn't secure

by on24 January 2017


Can be cracked in five goes


The Pattern Lock system which is used to provide security on millions of Android phones is a doddle to crack.

Researchers apparently can manage it in five goes, and the more complicated patterns are the easiest to crack.

For those who came in late, Pattern Lock is a replacement for PIN codes or text passwords. It is used by 40 percent of Android device owners. Users must first draw a pattern on an on-screen grid of dots. If this matches the pattern set by the owner, then the device can be used.

Users only have five attempts to get the pattern right before the device becomes locked.

New research from Lancaster University, Northwest University in China, and the University of Bath, shows for the first time that attackers can crack Pattern Lock reliably within five attempts by using video and computer vision algorithm software.

You must video the owner drawing their Pattern Lock shape to unlock a device, then use software to quickly track the owner's fingertip movements relative to the position of the device. Within seconds, the algorithm produces a small number of candidate patterns to access the Android phone or tablet.

The attack works without the video footage seeing the on-screen content. Results are accurate on video recorded on a mobile phone from up to two and a half metres away. Footage recorded on a digital SLR camera at distances up to nine metres away work just as well.

While this might seem a bit pointless if you are trying to crack into a workmate’s phone for a laugh, it does mean that spies, police and private eyes could have an effective tool to get into someone’s phone

Researchers evaluated the attack using 120 unique patterns collected from independent users. They could crack more than 95 percent of patterns within five attempts.

Complex patterns, which use more lines between dots were easier to crack because they help the fingertip algorithm to narrow down the possible options.

Dr Zheng Wang, principle investigator and co-author of the paper, and Lecturer at Lancaster University, said: "Pattern Lock is a very popular protection method for Android Devices. As well as for locking their devices, people tend to use complex patterns for important financial transactions such as online banking and shopping because they believe it is a secure system. However, our findings suggest that using Pattern Lock to protect sensitive information could actually be very risky."

"Contrary to many people's perception that more complex patterns give better protection, this attack actually makes more complex patterns easier to crack and so they may be more secure using shorter, simpler patterns," Guixin Ye, the leading student author from Northwest University, added.

There are good work arounds. Researchers suggest fully covering fingers when drawing the pattern but pattern lock designers could mix pattern locking with other activities such as entering a sentence using Swype-like methods which would make it difficult.

Last modified on 24 January 2017
Rate this item
(0 votes)

Read more about: