Scribd Logo
Upload

Welcome to Scribd!

  • US 22 Shan Invisible Finger

    Uploaded by

    Emmanuel MOMBO (yayaemma)
    21 views52 pages
    The document describes a remote electromagnetic interference attack called "Invisible Finger" that can inject precise touch events onto capacitive touchscreens from up to 3cm away. It analyzes how electromagnetic signals can induce changes in a touchscreen's capacitance similar to a physical touch. The attack was tested on different devices and scanning methods, and can generate taps, long presses, and swipes without requiring line of sight to the screen. Practical attacks were developed using an out-of-sight screen locator and touch event detector.

    Original Description:

    Original Title

    US-22-Shan-Invisible-Finger

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document describes a remote electromagnetic interference attack called "Invisible Finger" that can inject precise touch events onto capacitive touchscreens from up to 3cm away. It analyzes how electromagnetic signals can induce changes in a touchscreen's capacitance similar to a physical touch. The attack was tested on different devices and scanning methods, and can generate taps, long presses, and swipes without requiring line of sight to the screen. Practical attacks were developed using an out-of-sight screen locator and touch event detector.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    21 views52 pages

    US 22 Shan Invisible Finger

    Uploaded by

    Emmanuel MOMBO (yayaemma)
    The document describes a remote electromagnetic interference attack called "Invisible Finger" that can inject precise touch events onto capacitive touchscreens from up to 3cm away. It analyzes how electromagnetic signals can induce changes in a touchscreen's capacitance similar to a physical touch. The attack was tested on different devices and scanning methods, and can generate taps, long presses, and swipes without requiring line of sight to the screen. Practical attacks were developed using an out-of-sight screen locator and touch event detector.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 52

    Invisible Finger:

    Practical Electromagnetic Interference Attack on


    Touchscreen-based Electronic Devices
    Haoqi Shan1, Boyi Zhang1, Zihao Zhan1,
    Dean Sullivan2, Shuo Wang1, Yier Jin1
    1: University of Florida
    2. University of New Hampshire

    #BHUSA @BlackHatEvents
    Invisible Finger

    Remote precise touch events injection


    attack against capacitive touchscreens
    using IEMI signal

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    TL;DR
    § Invisible Finger
    § Remote precise touch events injection attack against capacitive touchscreens
    using IEMI signals.
    § Effective attack distance ~3cm
    § Can induce short-tap, long-press, omnidirectional swipe gesture
    § Works on different touchscreen devices, different scanning methods
    § A practical attack with out-of-sight screen locator and touch event detectors

    https://invisiblefinger.click

    Information Classification: General #BHUSA @BlackHatEvents


    TL;DR
    § Invisible Finger
    § Remote precise touch events injection attack against capacitive touchscreens
    using IEMI signals.
    § Effective attack distance ~3cm
    § Can induce short-tap, long-press, omnidirectional swipe gesture
    § Works on different touchscreen devices, different scanning methods
    § A practical attack with out-of-sight screen locator and touch event detectors

    https://invisiblefinger.click

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    TL;DR
    § Invisible Finger
    § Remote precise touch events injection attack against capacitive touchscreens
    using IEMI signals.
    § Effective attack distance ~3cm
    § Can induce short-tap, long-press, omnidirectional swipe gesture
    § Works on different touchscreen devices, different scanning/driving methods
    § A practical attack with out-of-sight screen locator and touch event detectors

    https://invisiblefinger.click

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    TL;DR
    § Invisible Finger
    § Remote precise touch events injection attack against capacitive touchscreens
    using IEMI signals.
    § Effective attack distance ~3cm
    § Can induce short-tap, long-press, omnidirectional swipe gesture
    § Works on different touchscreen devices, different scanning methods
    § A practical attack with out-of-sight screen locator and touch event detector

    https://invisiblefinger.click

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents
    Table of Contents
    § Background
    § Theoretical Analysis
    § Precise Touch Events Generation
    § Road to Practical Attacks
    § Q&A

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Table of Contents
    § Background
    § Theoretical Analysis
    § Precise Touch Events Generation
    § Road to Practical Attacks
    § Q&A

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Touchscreen
    § Capacitive Touchscreen
    § Self capacitance touchscreen
    § Mutual capacitance touchscreen

    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents


    Touchscreen
    § Capacitive Touchscreen
    § Self capacitance touchscreen
    § Mutual capacitance touchscreen

    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents


    Touchscreen
    § Capacitive Touchscreen
    § Self capacitance touchscreen
    § Mutual capacitance touchscreen

    CM

    Mutual capacitance touchscreen (no finger)


    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents
    Touchscreen
    § Capacitive Touchscreen
    § Self capacitance touchscreen
    § Mutual capacitance touchscreen

    CM

    Mutual capacitance touchscreen (with finger)


    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents
    Simplified Touchscreen Design
    § Charge transfer

    Charge transfer circuit topology


    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents
    Simplified Touchscreen Design
    § Charge transfer

    charge
    Charge transfer circuit topology

    Information Classification: General #BHUSA @BlackHatEvents


    Simplified Touchscreen Design
    § Charge transfer

    charge measure
    Charge transfer circuit topology
    Information Classification: General #BHUSA @BlackHatEvents
    Simplified Touchscreen Design
    § Charge transfer

    time/s
    Charge transfer circuit topology Control signal of charge transfer
    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents
    Simplified Touchscreen Design

    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents


    Simplified Touchscreen Design

    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents


    Touchscreen under Interference
    § EMI Noise caused equivalent capacitance change

    Information Classification: General INVISIBLE FINGER / Background #BHUSA @BlackHatEvents


    Table of Contents
    § Background
    § Theoretical Analysis
    § Precise Touch Events Generation
    § Road to Practical Attacks
    § Q&A

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Coupling theoretical analysis with actual attack vectors

    Information Classification: General INVISIBLE FINGER / Contributions #BHUSA @BlackHatEvents


    QT Sensor under Attack
    § What makes QT (charge transfer) sensor recognize a touch?
    § Threshold detection voltage value

    QT Sensor Simplified Circuit QT Sensor Output Voltage (Touched vs IEMI caused)


    Information Classification: General INVISIBLE FINGER / Theoretical Analysis #BHUSA @BlackHatEvents
    IEMI Signal
    § What is the most effective interference signal?
    § Amplitude and Frequency

    Information Classification: General INVISIBLE FINGER / Theoretical Analysis #BHUSA @BlackHatEvents


    IEMI Signal
    § Validation (Chromebook)

    Preliminary experiment setup using copper plates (simulation and actual hardware)

    Information Classification: General #BHUSA @BlackHatEvents


    When, Where, How
    § Result collection
    § Induced touch events or not?
    § Excitation signal amplitude, frequency?

    20V, 140Khz, 1 touch 25V, 140Khz, 2 touch

    Minimum E field to generate touch events


    Information Classification: General INVISIBLE FINGER / Theoretical Analysis #BHUSA @BlackHatEvents
    Table of Contents
    § Background
    § Theoretical Analysis
    § Precise Touch Events Generation
    § Road to Practical Attacks
    § Q&A

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Precise touch events generation and thorough experiments

    Information Classification: General INVISIBLE FINGER / Contributions #BHUSA @BlackHatEvents


    Precise Touch Events
    § Challenges?
    § Scanning/Driving Methods
    § Sequential scanning
    § Parallel scanning
    § Previous approaches

    Information Classification: General #BHUSA @BlackHatEvents


    Precise Touch Events
    § Challenges?
    § Scanning/Driving Methods
    § Sequential scanning
    § Parallel scanning
    § Previous approaches

    Information Classification: General #BHUSA @BlackHatEvents


    Precise Touch Events
    § Challenges from different driving mechanism (measured on different
    row/column)

    Parallel Driving iPhone 11 Pro Sequential Driving Pixel 2


    Information Classification: General INVISIBLE FINGER / Precise Touch Events Generation #BHUSA @BlackHatEvents
    Precise Touch Events
    § Precise injection time or precise injected location?
    IEMI Start

    Precise Injection Location


    Precise Injection Time
    Information Classification: General #BHUSA @BlackHatEvents
    Precise Touch Events
    § Challenges from different scanning mechanism (measured on
    different target devices)

    Pixel 2 Touchscreen Driving Signal

    iPhone 11 Pro Touchscreen Driving Signal

    Nexus 5X Touchscreen Driving Signal


    Information Classification: General #BHUSA @BlackHatEvents
    Precise Touch Events
    § Antenna design

    Copper Needle
    Copper Plates

    Information Classification: General Copper Plates Antenna E-Field Simulation #BHUSA @BlackHatEvents
    Precise Touch Events

    Information Classification: General INVISIBLE FINGER / Precise Touch Events Generation #BHUSA @BlackHatEvents
    Precise Touch Events

    Information Classification: General INVISIBLE FINGER / Precise Touch Events Generation #BHUSA @BlackHatEvents
    Precise Touch Events

    Information Classification: General INVISIBLE FINGER / Precise Touch Events Generation #BHUSA @BlackHatEvents
    Table of Contents
    § Background
    § Theoretical Analysis
    § Precise Touch Events Generation
    § Road to Practical Attacks
    § Q&A

    Information Classification: General INVISIBLE FINGER #BHUSA @BlackHatEvents


    Complete practical attack vectors

    Information Classification: General INVISIBLE FINGER / Contributions #BHUSA @BlackHatEvents


    Now what?
    § Established the theoretical background knowledge and actual setup
    needed for inducing precious touch events.
    § Missing?
    § Attacking device is under the table
    § Phone is randomly located
    § Phone locator
    § Attack scenarios
    § Multiple touches at multiple locations
    § Even swipe (gesture unlocking)
    § Touch event detector
    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents
    Phone Locator
    § Locate the phone and know the orientation by placing multiple antennas
    under the table
    § The excitation signal from touchscreen leaks info (which row/column pointed at)

    Parallel Scanning iPhone 11 Pro Sequential Scanning Pixel 2


    Information Classification: General #BHUSA @BlackHatEvents
    Phone Locator
    § A quick but reliable KNN classifier

    Antenna location/screen location transformation matrix

    Evaluation using iPad Pro 2020

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Phone Locator
    § A quick but reliable KNN classifier

    Antenna location/screen location transformation matrix

    Evaluation using iPad Pro 2020

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Phone Locator
    § A quick but reliable KNN classifier

    Antenna location/screen location transformation matrix

    Evaluation using iPad Pro 2020

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Touch Event Detector
    § Scanning signal behaves different if a successful touch event is
    recognized by touchscreen controller

    reduced scan without IEMI

    failed IEMI attack

    successful IEMI attack

    Extra active scanning


    IEMI Signal iPad Pro 2020

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Attack Scenarios
    § Click based attack
    § Malicious application installation (Android)
    § Malicious Bluetooth peripheral connection (iOS)
    § Gesture based attack
    § Send messages (bank fraud message)
    § Send money (press-and-hold on PayPal icon)
    § Unlock phone (omnidirectional gesture unlocking)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Attack Scenarios
    § Click based attack
    § Malicious application installation (Android)
    § Malicious Bluetooth peripheral connection (iOS)
    § Gesture based attack
    § Send messages (bank fraud message)
    § Send money (press-and-hold on PayPal icon)
    § Unlock phone (omnidirectional gesture unlocking)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Attack Scenarios
    § Click based attack
    § Malicious application installation (Android)
    § Malicious Bluetooth peripheral connection (iOS)
    § Gesture based attack
    § Send messages (bank fraud message)
    § Send money (press-and-hold on PayPal icon)
    § Unlock phone (omnidirectional gesture unlocking)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Attack Scenarios
    § Click based attack
    § Malicious application installation (Android)
    § Malicious Bluetooth peripheral connection (iOS)
    § Gesture based attack
    § Send messages (bank fraud message)
    § Send money (press-and-hold on PayPal icon)
    § Unlock phone (omnidirectional gesture unlocking)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Attack Scenarios
    § Click based attack
    § Malicious application installation (Android)
    § Malicious Bluetooth peripheral connection (iOS)
    § Gesture based attack
    § Send messages (bank fraud message)
    § Send money (press-and-hold on PayPal icon)
    § Unlock phone (omnidirectional gesture unlocking)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Mitigations
    § Pressure detection (Vendors)
    § Faraday Fabric (Customers)

    Information Classification: General INVISIBLE FINGER / Practical Attack #BHUSA @BlackHatEvents


    Q&A

    Questions?
    https://invisiblefinger.click

    Information Classification: General INVISIBLE FINGER / QA #BHUSA @BlackHatEvents

    You might also like