Are you safe working at cafes, offices, and co-working spaces?
Well, the answer is No. It’s laughably low-tech, but shoulder surfing, or snooping over people’s shoulders to pry at the information displayed, is increasing – and there’s a good chance it’s happening to you.
Shoulder surfing is one of the most undervalued threats that is rapidly advancing. It is a type of social engineering that is aimed at obtaining personal information through interpersonal connection. There are two types of shoulder surfing.
The first type of attack is when direct observation is used to obtain access to data. For example, a person looks directly over the victim’s shoulder to observe when they enter data, such as their PIN, at a checkout terminal.
In the second type, the victim’s actions are first recorded on video. Criminals can then analyze these videos in detail and obtain the desired information later. Nowadays, it is possible to use video recordings to determine the PIN for unlocking mobile devices, even if the display cannot be seen in the video. The movements of a user’s fingers are enough to determine the access code.
Shoulder surfing can happen anywhere at any given point in time. So one must be aware of their surroundings while working on mobiles/desktops/laptops/ATMs/Filling necessary forms at banks, offices, etc.
The person can be a little far away, e.g., sitting some rows behind you on a train and using their mobile phone to video or take pictures of what they can see on your screen. Which they later use to retrieve information or access your account.
While using an ATM, someone positioned themselves in such a way that allowed them to watch you enter your PIN. In a rush, you leave the ATM with your card and money without ensuring it exited entirely out of your account. If the ATM doesn’t require the card to be inserted for the entire transaction, other transactions are permitted if you don’t confirm that you have any other trades to make as long as the attacker knows the PIN.
Crowded public transit makes it easy for attackers to see the device screens of others or hear the conversations of others. In these cases, they’re looking over the victim’s shoulder.
The victim accidentally leaves their device unattended in a public place. Having watched the victim enter his password into their computer moments before, the attacker can unlock the device with this information, putting any sensitive data on the computer at risk.
Some quick tips to avoid shoulder surfing
- Eliminate passwords: The ONLY way to prevent password-based attacks is by eliminating passwords. Learn more about passwordless authentication today and keep your most critical applications secure.
- Add a privacy screen to your devices: Using attached privacy screens dramatically lessens the risk of data disclosure. Some glass protector manufacturers have versions with a privacy screen, which protects your phone’s glass and the information on your phone, too.
- Always be aware of your surroundings: Don’t let your guard down in public places. Attackers gravitate to those that they see as the easiest. If you’re distracted, you may not notice someone is watching you and what you’re entering into the device or the ATM.
- Use biometric authentication instead: Biometric authentication, either using your fingerprint or face, can offer additional security that a PIN cannot. Since the attacker never sees you enter a physical PIN, they can’t log into the device.
Related Tags: cyberattack, hacking, security, cyberrisk, financesecurity, data, authentication, cybersecurity
