Credit card PINs can be guessed even when covering the ATM pad

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/credit-card-pins-can-be-guessed-even-when-covering-the-atm-pad/

Researchers have proven it’s possible to train a special-purpose deep-learning algorithm that can guess 4-digit card PINs 41% of the time, even if the victim is covering the pad with their hands.

The attack requires the setting up of a replica of the target ATM because training the algorithm for the specific dimensions and key spacing of the different PIN pads is crucially important.

Next, the machine-learning model is trained to recognize pad presses and assign specific probabilities on a set of guesses, using video of people typing PINs on the ATM pad.

The entire chain of the attack
Source: Arxiv.org​

Countermeasures​

This experiment proves that covering the PIN pad with the other hand is not sufficient to defend against deep learning-based attacks, but thankfully, there are some countermeasures you can deploy.

• First, if your bank gives you the option to choose a 5-digit PIN instead of a 4-digit one, pick the longer one. It may be harder to remember, but it is a lot safer against attacks of this kind.
• Secondly, the percentage of the hand coverage is significantly lowering the prediction accuracy. A coverage percentage of 75% gives an accuracy of 0.55 for each try, while a total coverage (100%) takes the accuracy down to 0.33.
• A third countermeasure would be to serve users with a virtual and randomized keypad instead of the standardized mechanical one. This inevitably comes with usability drawbacks, but it’s an excellent security measure.

Interestingly, the researchers used the experiment's video clips on a survey with 78 participants to determine if humans could also guess the concealed PINs and up to what point. On average, the survey participants answered with an accuracy of only 7.92%, which is inefficient for carrying out attacks of this type.

Credit card PINs can be guessed even when covering the ATM pad

Researchers have proven it's possible to train a special-purpose deep-learning algorithm that can guess 4-digit card PINs 41% of the time, even if the victim is covering the pad with their hands.

www.bleepingcomputer.com

Full report by researchers from Arxiv.org: [2110.08113] Hand Me Your PIN! Inferring ATM PINs of Users Typing with a Covered Hand [PDF]