Our smartphones and tablets now contain information that is every bit as sensitive as that stored on our personal computers. And, if the device itself doesn’t hold the information, it almost certainly acts as an access point to your sensitive data online.
Amongst those of us who study cyber security, therefore, mobile devices attract a lot of attention with respect to how easily they can be cracked. There is a remarkable amount of information on how to circumvent the various controls on mobile devices. Just take a look at sites like http://forensics.spreitzenbarth.de/ for extensive details on the Android platform, or http://www.msab.com/xry/current-version-release-information for forensics toolkits that enable mobile device access (although such tools are increasingly being restricted to law enforcement agencies).
Being a computer scientist I find this fascinating, but in addition to being a computer scientist who studies cyber security, I am also a statistician, and I have long suspected that a PIN is not the random number that many assume it is. With so many devices still reliant upon PINs for their security I find myself asking if this more detailed, technical research is perhaps tackling a molehill when there is a mountain of a problem inherent in the use of PINs.
The majority of PINs are four digits only. Some bank ATMs had six digits when originally introduced, but even those appear to have now adopted the standard four digit format. This four digit PIN has been carried over onto the mobile devices, on which we all now store our treasured secrets. The simplistic view is that if I pick up a device and attempt to guess then PIN then it is just as likely to be 0000 as it is 9999 ie a chance of 1 in 10000. Most systems lock access after three incorrect guesses so the probability of an attacker guessing your PIN is actually 0.03%, or so the designers hope.
via How Safe Is Your Mobile? | Guest Blog, Scientific American Blog Network.
