TouchSignatures：通过JavaScript基于移动传感器数据识别用户触摸动作和PIN
TouchSignatures: Identification of User Touch Actions and PINs Based on Mobile Sensor Data via JavaScript
摘要：
符合W3C规范，移动Web浏览器允许网页中的JavaScript代码在未经用户许可的情况下访问运动和方向传感器数据。然而，W3C规范中没有考虑用户安全和隐私的相关风险。在这项工作中，第一次，我们展示了如何通过浏览器使用这些传感器数据的用户安全性可能会受到损害，尽管数据率是3至5倍慢于什么是可用的应用程序。我们研究了Android和iOS平台上的多个流行的浏览器，并研究他们的政策，在授予权限的JavaScript代码访问运动和方向传感器数据。根据我们的观察，我们确定了多个漏洞，并提出了触摸签名，它实现了一个攻击，恶意的JavaScript代码的攻击选项卡上监听这样的传感器数据测量。基于这些流，TouchSignatures能够区分用户的触摸动作（即，点击、滚动、按住和缩放）和她的PIN，允许远程网站了解客户端用户活动。我们通过收集真实用户的数据并使用我们的概念验证实现报告高成功率来证明这种攻击的实用性。我们还提出了一套潜在的解决方案来解决这些漏洞。W3C社区和包括Mozilla、Google、Apple和Opera在内的主要移动浏览器供应商已经认可了我们的工作，并正在实施我们提出的一些对策。
英文摘要：
Conforming to W3C specifications, mobile web browsers allow JavaScript code in a web page to access motion and orientation sensor data without the user's permission. The associated risks to user security and privacy are however not considered in W3C specifications. In this work, for the first time, we show how user security can be compromised using these sensor data via browser, despite that the data rate is 3 to 5 times slower than what is available in app. We examine multiple popular browsers on Android and iOS platforms and study their policies in granting permissions to JavaScript code with respect to access to motion and orientation sensor data. Based on our observations, we identify multiple vulnerabilities, and propose TouchSignatures which implements an attack where malicious JavaScript code on an attack tab listens to such sensor data measurements. Based on these streams, TouchSignatures is able to distinguish the user's touch actions (i.e., tap, scroll, hold, and zoom) and her PINs, allowing a remote website to learn the client-side user activities. We demonstrate the practicality of this attack by collecting data from real users and reporting high success rates using our proof-of-concept implementations. We also present a set of potential solutions to address the vulnerabilities. The W3C community and major mobile browser vendors including Mozilla, Google, Apple and Opera have acknowledge our work and are implementing some of our proposed countermeasures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
