Touchscreen Attacks: A New Type of Security Threat

With the widespread use of consumer electronic devices equipped with touchscreens in daily life and work, the issue of their security has gradually attracted attention. To better protect users’ information security and privacy rights, in-depth research on touchscreen attacks is crucial.

The causes of touchscreen attacks can be summarized as follows:

1. Technical Defects: There are some technical defects in the design and manufacturing processes of touchscreen devices, leading to vulnerabilities, malware, and other types of attacks.

2. User Behavior: Users have some bad habits when using devices, such as using weak passwords, which increase the risk of information theft.

3. Attacker Attacks: Attackers deceive or induce users to perform improper operations, or use special technical means to extract users’ input information in real-time, thereby obtaining sensitive information from the device.

This article focuses on the last type of touchscreen attack, which can be divided into two types: one based on electromagnetic signals and the other based on acoustic signals. This article will conduct an in-depth study of these two types of attacks, systematically summarize relevant literature, clarify future research directions, and provide corresponding suggestions.

Currently, research on electromagnetic signal-based touchscreen attacks mainly focuses on active attacks. This article organizes relevant knowledge about touchscreens and analyzes the related research on command injection and command cancellation attacks.

1. Capacitive Touchscreen Related Knowledge

Among existing touchscreen sensing technologies, capacitive touchscreens are widely used due to their good experience and cost-effectiveness. Research on electromagnetic signal-based touchscreen attacks is based on the working principle of capacitive touchscreens.

Capacitive touchscreens are input devices. When a finger touches the screen, a coupling capacitance is formed between the finger and the touchscreen surface, detecting the occurrence of touch events based on the change in capacitance ΔC. Currently, there are two widely used types of capacitive touchscreens: self-capacitance touchscreens and mutual capacitance touchscreens, as shown in Figure 1, where the touch sensor consists of a network of mutually perpendicular transmitting (TX) and receiving (RX) electrodes.

Figure 1 Capacitive Touchscreen

Self-capacitance touchscreens utilize the capacitance of a single electrode, one end connected to the excitation signal and the other end grounded. When a finger touches, it increases the finger-to-ground capacitance, which is in parallel with the electrode’s capacitance. In single-point touch, the TX is scanned first to find the location of capacitance change, determining the horizontal coordinate of the touch position; then the RX is scanned to determine the vertical coordinate of the touch point, thus obtaining the detailed coordinates of the touch position. In multi-point touch, multiple different horizontal and vertical coordinates can be obtained, resulting in multiple points that meet the coordinate conditions, making it impossible to determine the true touch point, resulting in a ‘ghost touch.’ The structural principle of self-capacitance touchscreens is simple, and the scanning speed is fast, but it measures the capacitance of a single electrode rather than the capacitance at the intersection of electrodes, leading to its inability to correctly detect multi-point touch.

Mutual capacitance touchscreens utilize the coupling capacitance formed at the intersection of TX and RX electrodes, where the horizontal electrodes serve as the upper plate of the coupling capacitance and the vertical electrodes serve as the lower plate. During scanning, after activating a row of TX electrodes, each column of RX electrodes is scanned sequentially, detecting the coupling capacitance formed between all RX electrodes and that row of TX electrodes. When a finger touches, the capacitance changes, and the controller processes the change in capacitance to extract and calculate the coordinates of the touch point. Only points with a change greater than a certain value (called the threshold) are considered valid touches. Mutual capacitance touchscreens can detect multi-point touches, but their structure is more complex, power consumption is higher, scanning time is longer, and their noise immunity is not as good as self-capacitance.

2. Literature on Electromagnetic Signal-Based Touchscreen Attacks

Research on attacks against capacitive touchscreens can be divided into two main categories: passive touchscreen attacks and active touchscreen attacks. Among them, passive attacks usually extract private information from the victim’s touchscreen through electromagnetic leakage, while active attacks mainly involve malicious control of the victim’s device. This section selects three recent papers focusing on active touchscreen attacks for analysis.

Reference [1] describes an IEMI touchscreen injection attack based on synchronization and scanning. The mutual capacitance scanning drive method used in this study has been described earlier. It first conducts experiments on 12 different brands and models of smartphones to study the possibility of EMI injection, using the Android Debug Bridge (ADB) application to record the distribution of contact points and capacitance changes on different phones, achieving visualization of results. Then, through numerous experiments, it explores conditions to effectively inject false touch points and create touch events. Finally, it evaluates the attack system through a series of evaluation metrics.

Reference [2] introduces an IEMI touchscreen injection attack that does not rely on synchronization and scanning. This paper analyzes the working principle of charge transfer (QT) sensors in mutual capacitance touchscreens and derives the conditions to overcome synchronization limitations, namely that the output voltage change must exceed the threshold voltage, as well as the corresponding circuit model of the touchscreen under IEMI attacks, validating the factors affecting touchscreen attacks, such as the electric field strength and the frequency of IEMI signals, followed by an ideal experimental demonstration and experimental analysis of characteristics affecting IEMI attack performance.

Reference [3] proposes a new attack that completely controls the victim’s device by hijacking the user’s operations. By generating reverse current using designed IEMI signals, it neutralizes the user’s touch commands, effectively canceling the genuine touch commands. In addition to this basic denial-of-service attack, it also implements a target cancellation attack, which can cancel target commands without interfering with unrelated operations. Meanwhile, it establishes an electromagnetic model to analyze the impact of IEMI on touchscreens, deriving the reverse current value that can cancel user commands, designing the attack from four aspects: effective cancellation, screen positioning, controllable cancellation, and diversity impact suppression, and evaluates attack performance through device prototype experiments.

Figure 2 KeyListener System Architecture

The specific implementation process for inferring keystroke information is shown in Figure 3. When the victim types, the attacker can obtain two propagation distances based on the acoustic signal attenuation equation. These signals propagate from the speaker, are reflected by the victim’s keystroke finger, and finally propagate to two microphones. Given the relative positions of the speaker and the two microphones on the smartphone, we can determine the distance between the keystroke finger and the two microphones. By calculating, we can obtain a unique effective intersection, which is the keystroke position, but it can only locate an area of the keystroke, not an exact point.

Figure 3 Specific Implementation Process for Inferring Keystroke Information

2. Gesture Input Attacks

In the use of touchscreens, users not only input via keyboard keystrokes but also through gesture inputs, where users place their fingers on the first letter of a word and then drag their fingers to each subsequent letter in the word until reaching the last letter, at which point the finger is removed, and the gesture is processed as word data. Reference [6] captures audio signals from the haptic feedback mechanism emitted during gesture keyboard input and performs classification to recognize the text entered on the device, thus utilizing haptic feedback from gesture input to implement touchscreen attacks. This feedback is usually realized as motor vibrations.

China Confidential Association

Science and Technology Branch

Long press the QR code to follow us

Cross-Network Attacks: An Introduction to Techniques for Breaking Physical Isolation Networks