Hundreds of millions of people have embraced the digital age by connecting their homes to devices that use the Internet.
Along with virtual helpers like Google Home and Amazon Alexa, a common household item is the smart TV, which allows users to browse the Web, stream videos and purchase products. Unfortunately, the more access we give these devices, the more vulnerable our personal data becomes to hackers. Researchers from the University of Chicago’s Department of Computer Science have recently been recognized by Samsung for their work identifying unknown vulnerabilities in smart TVs–earning them a spot in the Samsung Hall of Fame.
Led by Ph.D. student Tejas Kannan, Department Chair Hank Hoffmann, Neubauer Prof. Nick Feamster, Ph.D. student Synthia Wang, alum Max Sunog, and high school student Abe Bueno de Mesquita all contributed to work that develops and demonstrates how the audio on Samsung and Apple TVs would allow an attacker to guess when a user is typing, the length of the entered information and the number of cursor movements between selections. Kannan came up with the idea while attending a research talk on how attackers can discover user keystrokes by exploiting GPU performance counters on mobile devices.
“I was already familiar with keystroke side-channel attacks on standard mechanical keyboards,” said Kannan. “Once I realized that these side-channels also existed on mobile phones, I figured that newer devices, such as smart TVs, would have similar vulnerabilities. After interacting with the smart TVs in the lab, we realized that the TV’s audio can provide valuable information to someone with ill intent. We constructed a simple prototype attack and then slowly relaxed the prototype’s many assumptions to create the final practical result that works against TVs on the market today.”
Bug Bounty Program
The team submitted the work to Samsung’s Bug Bounty Program, which asks participants to identify bugs in their audio and visual displays in exchange for a monetary prize. The claims are then reviewed and tested by Samsung’s security experts, with the biggest contributions being recognized in their Hall of Fame. The UChicago group is one of three who recently received the honor.
Samsung is the most popular platform for smart TVs on the market. Certain smart TVs, like the Samsung Tizen, have distinct sounds for different actions, like selecting a key or deleting a character. If an attacker gained access to the smart TV through an external device, they could potentially gain access to a user’s passwords or credit card numbers by listening to the audio. To show how easily this could be done, the team presented a side-channel attack that was tested in both an emulated and realistic environment.
When typing behaviors were optimal, the controlled attack was able to recover 99.95% of credit card numbers, 97.65% of full credit card details, and up to 99.10% of common passwords within 100 guesses. In a realistic scenario, they were able to find 33.33% of credit card details and 60.19% of passwords within 100 guesses.
“When Tejas first proposed the idea, I wasn’t sure it would work,” recalled Hoffmann. “Credit card numbers (and the additional info, like zip codes) are essentially random, so the idea that we could reliably guess them from just a few sounds seemed unlikely. But being able to recover all details in a third of the cases (even with user errors) was shocking. I will definitely mute my TV when I type sensitive information from now on.”
The work was also disclosed to Apple. Samsung is discussing a long-term fix.
Thrill for high school student
Receiving the honor is especially exciting for Bueno de Mesquita. The high school student worked in Hoffmann’s lab the past two summers.
“It’s awesome to be inducted into the hall of fame, but mostly I’m thankful for the opportunity to work on this project,” said Bueno de Mesquita. “Being able to see what real academic research looks like and take part in it was super eye-opening and fun, even though seeing just how effective our attack was is a bit scary.”
The full paper detailing their work will be presented at the upcoming 2024 Network and Distributed System Security Symposium– one of the top security conferences.
This story was adapted from the UChicago Department of Computer Science website.
—Prof. Chuan He
