Remotely Controlling Touchscreens

This is more of a demonstration than a real-world vulnerability, but researchers can use electromagnetic interference to remotely control touchscreens.

From a news article:

It’s important to note that the attack has a few key limitations. Firstly, the hackers need to know the target’s phone passcode, or launch the attack while the phone is unlocked. Secondly, the victim needs to put the phone face down, otherwise the battery and motherboard will block the electromagnetic signal. Thirdly, the antenna array has to be no more than four centimeters (around 1.5 inches) away. For all these reasons the researchers themselves admit that the “invisible finger” technique is a proof of concept that at this point is far from being a threat outside of a university lab.

EDITED TO ADD (9/12): The project has a website.

Tags: control, cybersecurity

Posted on August 16, 2022 at 6:59 AM • 11 Comments

Comments

Dio Gratia • August 16, 2022 8:23 AM

The paper as submitted is also available from the authors.

Clive Robinson • August 16, 2022 11:35 AM

@ Bruce, ALL,

With regards the admission of,

“For all these reasons the researchers themselves admit that the “invisible finger” technique is a proof of concept that at this point is far from being a threat outside of a university lab.”

As any parent knows, “litte fingers” invisable or not, have two prroperties,

1, They try to get into everywhere.
2, They grow.

So can become part of the “hidden hand” that one day may “run the market”…

I predict a range extension will be not just investigated but probably found. At around three feet it could work from above a table hidden in the lights…

Ted • August 16, 2022 12:34 PM

@Dio Gratia, thanks for posting the paper. It included a project website:

https://invisiblefinger.click/

Just curious, does anyone use an EMF blocking phone case?

Clive Robinson • August 16, 2022 6:28 PM

@ Ted, All,

Re : EMF is EM is RF

“Just curious, does anyone use an EMF blocking phone case?”

Any case that would “block all EMF” would also “block the RF” used for the mobile phone / Smart Phone / etc to communicate, thus function as a “phone”.

If you want the physics behind this, it would take more than a couple of posts, depending on how up you are on field equations behind forces, or how deep you want to dive.

If you want to know more look up the E field and H field and how they relate to the movment of charge out into the universe at large (you also need to know a bit about photons below the usual “light” frequencies.

Ted • August 16, 2022 10:43 PM

@Clive

Any case that would “block all EMF” would also “block the RF” used for the mobile phone / Smart Phone / etc to communicate, thus function as a “phone”.

I see.

Yes, I think the paper better defines the “EMF blocking phone case” as a countermeasure that impedes EMR to (or from) specifically the screen.

I guess one could use Faraday Fabric for this, or even an existing screen-shielding phone case.

https://www.defendershield.com/universal-wallet-case

However, if you get a chance to look at the practical attacks against iOS or Android devices (page 12), I don’t think you’ll panic just yet.

But the paper does reference prior work… do you remember our Host’s previous post on GhostTouch? This current attack – Invisible Finger – does seem to be slightly more sophisticated. So it will be interesting how future r&d evolves on both sides.

https://www.schneier.com/blog/archives/2022/06/remotely-controlling-touchscreens.html

Max • August 17, 2022 5:59 PM

“Any case that would “block all EMF” would also “block the RF” used for the mobile phone / Smart Phone / etc to communicate, thus function as a “phone”.”

But we do not ask to “block all EMF”, only stuff that comes at the screen. Which will be easy since the primary cellular antenna is almost universally located at the bottom back of the phone.

lurker • August 18, 2022 12:32 AM

@Max, ” …the primary cellular antenna is almost universally located at the bottom back of the phone.”

But the radiation goes in and out through all directions it can. Any effective screening of the display could lead us to the iPhone4 situation where the user is “holding it wrong.”

anon • August 20, 2022 9:52 AM

Does the attack extend to touchscreens in vehicles?

Clive Robinson • August 20, 2022 9:11 PM

@ anon,

Re : Range

“Does the attack extend to touchscreens in vehicles?”

You are asking a question so ambiguous that the answer is both “yes” and “no”.

The attack demonstration as it currently works has a very short range just an inch or two. It uses a low frequency source of EM radiation from a transmitting transducer or antenna.

To be non obvious to an attacker the transmitting transducer has to be covered by something that is transparent to the lower frequency fields that make an EM signal used, but not to be transparent to the visable light range used by the eyes of the holder of the phone.

Which is why a wooden or plastic topped table is used.

The phone it’s self is not transparent to the fields that make the EM signal used so the phone has to be display side to the surface covering the transducer.

All of this is “highly local” thus could be done from under a “dash board” shelf in many modern small cars.

But would the person holding the phone put it face down on such a surface?

Unlikely as it would be asking to have either the screen scratched or the phone come off the shelf and get broken when going around a corner etc (it’s why you get cup holders, and phone holders for mounting in cars).

So whilst you could build a system into a car or other vehicle, it is unlikely that the holder of the phone will put their phone in a position where it would work.

The way the system works with radiant EM fields the larger the transducer would have to be with range. So whilst only slightly bigger than the phone when an inch away each doubling of distance would require at least the same doubling in not just the size of the transducer but the precision with which it is made or effectively tuned.

This limits the range to probably a maximum of a just a few feet, with the phone having to be in a very small point of focus. So as I said above, it might be possible to put it in a light fitting three feet above a table or work surface, but not much more than that.

Whilst there are tricks using the edges of multiple beams to create a “cone of silence” effect, and modern phased array antennas can provide what appear to be “pencil thin stearable beams” for the likes of 5G and probably 6G this relys on the EM frequencies being used to be in the centrimetric or millimetric wave bands. At such EM frequencies various glass types have higher absorbtion and other effects as do many plastics. So the vehicle body would probably block any such EM signal or cause such drastic “multipath” distortion that the fields would not function.

So being able to “beam” a signal into a vehicle even from an adjacent vehicle is highly improbable with our current state of technology.

Gino Lucrezi • October 6, 2022 5:51 AM

So I just need to build a special desk and come up with a plausible excuse to tell people: “please unlock your phone and place it face down on this desk while I do something for you” (or pretend to do something for you).

Clive Robinson • October 6, 2022 9:16 AM

@ Gino Lucrezi, ALL,

“So I just need to build a special desk and come up with a plausible excuse to tell people…”

In short yes, or you need to put the phone face down for them after they’ve unlocked it…

This happens everyday nobody knows how many hundreds of millions a time a year…

It’s fairly standard as part of “passanger screening” for aircraft and some rail travel, also but to a lesser extent “securit searches” and “bag searches” as well as by Police etc doing “stop and search” where pockets are turned out.

It’s why this potentially is a massive security vulnerability…

Oh and remember it’s not just mirrors that can be “one way”… That dark looking table top the phone with it’s brightly lit screen is face down on could be such that in a void underneath a high resolution camera is reading the screen as well…

Remotely Controlling Touchscreens

Comments

Leave a comment Cancel reply