Shoulder surfing (computer security)
Encyclopedia
In computer security
, shoulder surfing refers to using direct observation techniques
, such as looking over someone's shoulder, to get information. Shoulder surfing is particularly effective in crowded places because it is relatively easy to observe someone as they:
Shoulder surfing can also be done at a distance using binoculars
or other vision-enhancing devices. Inexpensive, miniature closed-circuit television camera
s can be concealed in ceilings, walls or fixtures to observe data entry. To prevent shoulder surfing, it is advised to shield paperwork or the keypad from view by using one's body or cupping one's hand.
Recent automated teller machines now have a sophisticated display which discourages shoulder surfers from obtaining displayed information. It grows darker beyond a certain viewing angle, and the only way to tell what is displayed on the screen is to stand directly in front of it. Although this prevents an observer obtaining some information, eg account balance, it is generally not required to protect the PIN, because the PIN is typically not displayed during entry.
Certain models of credit card readers have the keypad recessed, and employ a rubber shield that surrounds a significant part of the opening towards the keypad. This makes shoulder-surfing significantly harder, as seeing the keypad is limited to a much more direct angle than previous models. ISO 9564
, the international standard
for PIN management, mandates such measures thus:
Also some keypads alter the physical location of the keys after each keypress. For example the digit 1 may be the upper left on the first press, then moves to the bottom right for the second. Also, security cameras are not allowed to be placed directly above an ATM
.
POS terminals often available in shops, supermarket
s, and fuel outlet
s are more difficult to use in a way that prevents shoulder surfing as they are often located in exposed view on counters. It is good practice to shield the keypad with one hand while entering digits with your other hand.
Computer security
Computer security is a branch of computer technology known as information security as applied to computers and networks. The objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to...
, shoulder surfing refers to using direct observation techniques
Eavesdropping
Eavesdropping is the act of secretly listening to the private conversation of others without their consent, as defined by Black's Law Dictionary...
, such as looking over someone's shoulder, to get information. Shoulder surfing is particularly effective in crowded places because it is relatively easy to observe someone as they:
- fill out a form
- enter their PINPersonal identification numberA personal identification number is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. Typically, the user is required to provide a non-confidential user identifier or token and a confidential PIN to gain access to the system...
at an automated teller machineAutomated teller machineAn automated teller machine or automatic teller machine, also known as a Cashpoint , cash machine or sometimes a hole in the wall in British English, is a computerised telecommunications device that provides the clients of a financial institution with access to financial transactions in a public...
or a POS terminal - use a telephone cardTelephone cardA telephone card, calling card or phone card for short, is a small plastic card, sized and shaped like a credit card, used to pay for telephone services. It is not necessary to have the physical card except with a stored-value system; knowledge of the access telephone number to dial and the PIN is...
at a public payphonePayphoneA payphone or pay phone is a public telephone, often located in a phone booth or a privacy hood, with pre-payment by inserting money , a credit or debit card, or a telephone card.... - enter a passwordPasswordA password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource . The password should be kept secret from those not allowed access....
at a cybercafe, public and university libraries, or airport kiosks - enter a code for a rented lockerLocker (cabinet)A locker is a small, usually narrow storage compartment. They are commonly found in dedicated cabinets, very often in large numbers, in various public places such as locker rooms, work places, schools, transport centres, and the like...
in a public place such as a swimming pool or airport
Shoulder surfing can also be done at a distance using binoculars
Binoculars
Binoculars, field glasses or binocular telescopes are a pair of identical or mirror-symmetrical telescopes mounted side-by-side and aligned to point accurately in the same direction, allowing the viewer to use both eyes when viewing distant objects...
or other vision-enhancing devices. Inexpensive, miniature closed-circuit television camera
Closed-circuit television camera
Closed-circuit television cameras can produce images or recordings for surveillance purposes, and can be either video cameras, or digital stills cameras...
s can be concealed in ceilings, walls or fixtures to observe data entry. To prevent shoulder surfing, it is advised to shield paperwork or the keypad from view by using one's body or cupping one's hand.
Recent automated teller machines now have a sophisticated display which discourages shoulder surfers from obtaining displayed information. It grows darker beyond a certain viewing angle, and the only way to tell what is displayed on the screen is to stand directly in front of it. Although this prevents an observer obtaining some information, eg account balance, it is generally not required to protect the PIN, because the PIN is typically not displayed during entry.
Certain models of credit card readers have the keypad recessed, and employ a rubber shield that surrounds a significant part of the opening towards the keypad. This makes shoulder-surfing significantly harder, as seeing the keypad is limited to a much more direct angle than previous models. ISO 9564
ISO 9564
ISO 9564 is an international standard for personal identification number management and security in retail banking.The PIN is used to verify the identity of a customer within an electronic funds transfer system, and to authorise the transfer of funds, so it is important to protect it against...
, the international standard
International standard
International standards are standards developed by international standards organizations. International standards are available for consideration and use, worldwide...
for PIN management, mandates such measures thus:
Also some keypads alter the physical location of the keys after each keypress. For example the digit 1 may be the upper left on the first press, then moves to the bottom right for the second. Also, security cameras are not allowed to be placed directly above an ATM
Automated teller machine
An automated teller machine or automatic teller machine, also known as a Cashpoint , cash machine or sometimes a hole in the wall in British English, is a computerised telecommunications device that provides the clients of a financial institution with access to financial transactions in a public...
.
POS terminals often available in shops, supermarket
Supermarket
A supermarket, a form of grocery store, is a self-service store offering a wide variety of food and household merchandise, organized into departments...
s, and fuel outlet
Filling station
A filling station, also known as a fueling station, garage, gasbar , gas station , petrol bunk , petrol pump , petrol garage, petrol kiosk , petrol station "'servo"' in Australia or service station, is a facility which sells fuel and lubricants...
s are more difficult to use in a way that prevents shoulder surfing as they are often located in exposed view on counters. It is good practice to shield the keypad with one hand while entering digits with your other hand.