Practical Mobile Forensics - Fourth Edition

Smudge attack

In rare cases, a smudge attack may be used to deduce the password of a touchscreen mobile device. This attack relies on identifying the smudges left behind by the user's fingers. While this may present a bypass method, it must be said that a smudge attack is unlikely to work since most Android devices are touchscreen and smudges will also be present from using the device; however, it has been demonstrated that, under proper lighting, the smudges that are left behind can be easily detected, as shown in the following screenshot.

By analyzing the smudge marks, we can discern the pattern that is used to unlock the screen. This attack is more likely to work while discerning the pattern lock on the Android device. In some cases, PIN ...