A team of researchers from the Universities of Padua (Italy) and Delft (Netherlands) have published a method to use machine learning to recreate a PIN entered from a video footage of a hand-covered input area in an ATM. When entering a 4-digit PIN, the probability of predicting the correct code is estimated at 41%, given the possibility of making three attempts before blocking. For PIN-codes of 5 digits, the probability of prediction was 30%. Separately, an experiment was conducted during which 78 volunteers tried to predict the PIN code from similarly recorded videos. In this case, the probability of a successful prediction was 7.92% in the presence of three attempts.
When covering the digital panel of the ATM with the palm of the hand, the part of the hand that is used for input remains uncovered, which is enough to predict pressing by changing the position of the hand and shifting incompletely covered fingers. When analyzing the input of each digit, the system excludes keys that cannot be pressed, taking into account the position of the covering hand, and also calculates the most probable options for pressing based on the position of the pressing hand, relative to the location of the keys. In order to increase the probability of determining the input, the sound of pressing can be additionally recorded, which is slightly different for each key.
The experiment used a machine learning system based on the use of a convolutional neural network (CNN) and a recurrent neural network based on the LSTM (Long Short Term Memory) architecture. The CNN was responsible for extracting the spatial data for each frame, and the LSTM network used this data to extract the time-varying patterns. The model was trained on videos of 58 different people entering a PIN code using input cover methods chosen by the participants (each participant entered 100 different codes, i.e. 5800 input examples were used for training). During the training, it was found that most users use one of the three main methods of covering input.
To train the machine learning model, a server based on a Xeon E5-2670 processor with 128 GB of RAM and three Tesla K20m cards with 5 GB of memory each was used. The software part is written in Python using the Keras library and the Tensorflow platform. Since ATM input panels are different, and the prediction result depends on characteristics such as the size and layout of the keys, a separate training is required for each type of panel.
As measures to protect against the proposed attack method, it is recommended, if possible, to use PIN codes of 5 digits instead of 4, and also try to cover as much input space as possible with your hand (the method remains effective if about 75% of the input area is covered with your hand). ATM manufacturers are recommended to use special protective screens that hide the input, as well as not mechanical, but touch input panels, the position of the numbers on which changes randomly.
Source: opennet.ru