News

Researchers find that thermal camera can capture PINs at the ATM

August 17, 2011

Researchers from the University of California, San Diego presented a paper at last week's USENIX Security Symposium in San Francisco that revealed the relative ease of capturing PIN numbers at the ATM using a thermal camera.

Researchers Keaton Mowery, Sarah Meiklejohn and Stefan Savage performed a series of tests using a thermal camera mounted above a traditional ATM PIN pad. The camera read and captured the residual heat left on the keys and the researchers were able to detect the numbers that were pressed.

According to an MSNBC.com article, in some cases, depending on the size of the thermal imprint, the researchers could even detect in which order the keys were pressed.

The tests, using 27 randomly selected four-digit codes on both plastic and brushed metal PIN pads, revealed that the plastic PIN pads with rubber keys retained heat for much longer.

The researchers were able to detect PINs with approximately 80 percent accuracy 10 seconds after the person entered their PIN. Forty-five seconds after being pressed, the thermal cameras were still able to determine PINs with 60 percent accuracy.

"Using a thermal camera instead provides an attacker the ability to recover the code even in the cases where, for example, a user's body is blocking the keypad throughout the transaction, or he just covers the keypad with his hand as he types in the PIN," the researchers wrote in the paper.

At this time, there are no reports of thermal camera attacks on ATMs.

For more information on this topic, visit our security research center.