Shoulder surfing (computer security)

From Wikipedia, the free encyclopedia

 This article does not cite any references or sources. (December 2007)
Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed.

In computer security, shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is particularly effective in crowded places because it's relatively easy to observe someone as they:

  • fill out a form
  • enter their PIN at an automated teller machine or a POS Terminal
  • use a calling card at a public pay phone
  • enter passwords at a cybercafe, public and university libraries, or airport kiosks.
  • enter a digit code for a rented locker in a public place such as a swimming pool or airport.

Shoulder surfing can also be done at a distance using binoculars or other vision-enhancing devices. Inexpensive, miniature closed-circuit television cameras can be concealed in ceilings, walls or fixtures to observe data entry. To prevent shoulder surfing, it is advised to shield paperwork or the keypad from view by using one's body or cupping one's hand.

Recent automated teller machines now have a sophisticated display which discourages shoulder surfers. It grows darker beyond a certain viewing angle, and the only way to tell what is displayed on the screen is to stand directly in front of it.

Certain models of credit card readers have the keypad recessed, and employ a rubber shield that surrounds a significant part of the opening towards the keypad. This makes shoulder-surfing significantly harder, as seeing the keypad is limited to a much more direct angle than previous models. Taken further, some keypads alter the physical location of the keys after each keypress. For example the digit 1 may be the upper left on the first press, then moves to the bottom right for the second. Also, security cameras are not allowed to be placed directly above an ATM.

POS Terminals often available in shops, supermarkets and petrol stations are more difficult to use in a way that prevents shoulder surfing as they are often located in plain view on counters. It is good practice to shield the keypad with one hand while entering digits with your other hand.

An example of shoulder surfing is when renting a public locker, some people may choose a four digit PIN code which is the same as that for their credit or bank access card. A thief who obtains the locker code by shoulder surfing could then access the locker and take and use the credit or bank access card until the card account is blocked.