Haroon Meer launches app that automates over-the-shoulder spying
Shoulder surfing, the simple act of leering over a computer users’ shoulder to spy on passwords and other sensitive info, may not seem like the most advanced hacker trick. But when it comes to shoulder surfing Apple’s iPad, Haroon Meer has it down to a science.
Earlier this week, the South African security researcher announced that he’d built shoulderPad, an app for Mac OS, jailbroken iPhones and iPads that’s designed to auto-snoop on iPad users’ passwords by watching their touchscreen keyboards. Simply pretend to be fiddling with your phone or tablet a few meters away from an iPad user while he or she enters their PIN or password, and shoulderPad can uses your device’s camera to read and interpret the target’s keystrokes.
The app’s secret? When a user types on an iPad’s touchscreen, each key glows blue for a fraction of a second after it’s struck, a helpful bit of feedback for any virtual keyboard. ShoulderPad’s image recognition algorithms, based on Open CV’s open source image recognition software, look for that flash of blue. “At any distance, if the blue is distinguishable, shoulderPad can detect that keystroke,” says Meer.
