Thermal Cameras' Downside

A new paper from three UC San Diego researchers shows how someone with a thermal camera can easily determine a bank customer's ATM PIN code by using the camera soon after that code is typed in. "Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks," written by Keaton Mowery, Sarah Meiklejohn, and Stefan Savage, explains that this method is, unfortunately for ATM users, superior to simply observing the transaction and hoping to memorize the code as the keypad is used or by filming it and watching the video later.

"This attack has the advantage over using a conventional camera that the codes do not need to be captured while they are being typed and can instead be recovered for a short period afterwards," their abstract states. "To get the broadest sense of how effective such an attack might be, we consider a number of variables: the material of the keypad, the user entering the code, the distance from the camera to the keypad, and the possible methods used to analyze the data....

"As we will see, both human and automated attacks are by and large successful in recovering the keys present in the code, even a full minute after they have been pressed; both methods are also able to determine the exact code (i.e., including the order in which the keys were pressed) for a smaller fraction of codes. Even without ordering, however, the search space of possible keys is still vastly reduced by knowing the keys pressed; for example, the search space is reduced from 10,000 possible codes to approximately 24 for a 4-digit code."

Metal ATM keypads are the best defense because they retain heat from a customer's fingers only briefly, the authors reported.

Posted by Jerry Laws on Aug 18, 2011

Product Showcase

  • Make selection & use of SRLs simpler with the new V-SHOCK line

    Make selection & use of SRLs simpler with the new V-SHOCK line

    The new MSA V-SHOCK EDGE Cable SRLs and Web PFLs for Leading Edge use are designed for simplicity and hassle-free safety. V-SHOCK EDGE solutions help make PPE selection on the jobsite quick and easy with color-coded housings, clear icons on labels, and clearance charts in the label pack. 3

  • The MGC Simple Plus

    The MGC Simple Plus is a simple-to-use, portable multi-gas detector that runs continuously for three years without needing to be recharged or routinely calibrated after its initial charge and calibration during manufacturing. The detector reliably tests a worksite’s atmosphere for hydrogen sulfide, carbon monoxide, oxygen and combustible gases (LEL). Additionally, it is durable enough to withstand the harshest treatment and environments, which is why it has an IP 68 rating. The MGC Simple Plus is also compatible with a variety of accessories, such as Gas Clip Technologies’ new GCT External Pump. Visit for more information. 3