Smudge Attack
Smudge Attack
Schmierspur-Angriff
A smudge attack reads the fingerprint smudges on a touchscreen to guess an unlock pattern or a PIN. The grease residues of the fingers reveal which areas were touched — and thus often the input. It is a simple, physical attack entirely without malware.
History & facts. On the smooth surface of a touchscreen, fingers leave visible traces; with suitable light or contrast, the touched points can be recognised. Graphical unlock patterns are particularly telltale, since their continuous swipe leaves a clear trace. The attack presupposes physical access to the device and yields not a certain but often a sufficiently constraining hypothesis about the secret.
Outlook & recommendation. Countermeasures are unspectacular but effective: clean the screen, use longer and not pattern- but digit- or password-based locks, use biometric methods or an additional obfuscation of the input. Above all, the smudge attack exemplifies that security does not end at the software: where third parties gain physical access to devices, such analogue routes also belong in the consideration.