Tap ’n Ghost

A Compilation of Novel Attack Techniques
against Smartphone Touchscreens
Seita Maruyama 1, Satohiro Wakabayashi 1, Tatsuya Mori 1, 2
1 Waseda University, Japan

2 RIKEN AIP, Japan

Tap ’n Ghost➤ An attack against smartphones➤ The attack connects a Bluetooth device or a Wi-Fi
access point to the victim's smartphone.
➤ It consists of two techniques:▶

Attack against NFC-enabled smartphones▶

Attack against Capacitive Touchscreens2How Our Attack Works
Victim’s Smartphone
Table

NFC CardEmulator

External
Metal Sheet3How Our Attack Works

4

Demo: Overview

5Demo: Overview
Connected to […]6Two Attack Techniques
Tag-based Adaptive Ploy:
Attack technique against
NFC-enabled smartphones

Ghost Touch Generator:
Attack technique against
Capacitive Touchscreens7

Two Attack Techniques
Tag-based Adaptive Ploy:
Attack technique against
NFC-enabled smartphones

Ghost Touch Generator:
Attack technique against
Capacitive Touchscreens8How Touchscreens Work➤ Capacitive touchscreens are widely used insmartphones.

TX electrodes(driving)

Smartphone

FingerRX electrodes(sensing)9How Touchscreens Work➤ Bringing a finger close to the intersection will
decrease electrical current flowing into the RXelectrode.

TXCf
C0RX
10

Ghost Touch Generator➤ The attacker can cause false touch events byinjecting intentional noisefrom an external source.
Cf

TX

C0

External Metal Sheet

RXCex
11

Demo: Ghost Touch Generator

12

6.2

Conditions of the successful Ghost To

We now
empiricallystudy the conditions for the successful attac
GhostTouchGenerator*2

Android smartphones/tablets listed in Table 6.1 . As our amplifier➤ It causes “false touches” on the 5/7 models.

Table 6.1 The conditions of the successful Ghost Touch Generator a➤ Thescatteringcharacteristicfrequencies
varyisby
patterns is definedwhen a screen
set model.
in portrait mode.
DeviceManufacture

Success
false touches

Nexus 7
ARROWS NX F-05F
Nexus 9Galaxy S6 edge
Galaxy S4
AQUOS ZETA SH-04F
Xperia Z4

ASUS
FUJITSUHTC
SAMSUNGSAMSUNG
SHARP
SONY!
!
!
!
!

Frequency[kHz]

Voltag
[Vpp]

128.2
—
280.9
—
384.5
202.0
218.0

40.0
—
490.0
—
70.4
700.013340.0

Summary of Ghost Touch Generator
1. This attack technique scatters false touches ontouchscreens.
2. The attacker needs to identify the smartphonemodel in advance.
14

Two Attack Techniques
Tag-based Adaptive Ploy:
Attack technique against
NFC-enabled smartphones

Ghost Touch Generator:
Attack technique against
Capacitive Touchscreens

15

NFC
➤ NFC is a short-range (~10 cm)
wireless communication technology

Credit Card

Smartphones

pocketnow, https://pocketnow.com/android-nfc-app-reveals-contactless-credit-card-details-should-you-be-worriedandroidcentral, https://www.androidcentral.com/samsung-pay-uk-everything-you-need-know
nfc Direct, https://nfcdirect.co.uk/44-social-media-nfc-smart-posters

Smart Posters

16

NFC and Android➤ Android smartphones always look for nearby
NFC tags and read it.
➤ The following operations are launcheddepending on the NFC tag record:▶

Opening a website▶

Connecting a Wi-Fi access point (with confirmation)▶

Pairing a Bluetooth device (with confirmation)17

Tag-based Adaptive Ploy
➤ NFC emulation enables to emulate an NFC tag,and dynamically change its content.
1. Request to open an attacker’s website &identify the smartphone model
2. Request to pair an attacker’s Bluetooth device
18Summary of Two Attack Techniques
Tag-based Adaptive Ploy:
Attack technique against
NFC-enabled smartphones

Gets info & Shows dialog box

Ghost Touch Generator:
Attack technique against
Capacitive Touchscreens

Generates false touches

19

Feasibility of the Threat➤ The attack succeeds only if the victim uses theirsmartphone within the NFC communication range.
（NFC communication range < Ghost Touch Generator attack range）➤ We conducted a deceptive study to investigate
how often the victim’s smartphone came within theattack range of the Malicious Table.
➡ 15 out of the 16 participants were attackable.

20

User Study

21

Overall Attack Success Rate
➤ Overall attack success rate is 71%,
if 30 people take a seat at the Table andthe attacker can retry attack 3 times for each person.
# of attack trials# of people who take a seat at the table

Attack Success Probability

22

Countermeasures➤ Add the user approval processes before Android OS
launches every operations recorded in a NFC tag (cf.
iPhone XS, XS Max, and XR)➤ Detect the malfunction on touchscreens▶ Add idle time to TX electrodes, and check noise
on RX electrodes▶ Identify the characteristic patterns of false
touches23

Responsible Disclosure➤ With the aid of JPCERT/CC,
we have contacted several
smartphone manufacturers.
➤ We demonstrated the attack to them andconfirmed that the attack is applicable theirlatest model.

24

Conclusion➤ We presented the new attack “Tap ’n Ghost,”
which exploits the NFC and the touchscreen of
the victim’s smartphone.
➤ We demonstrated the attack is feasible.
➤ We provide possible countermeasures.
25