Tomi Engdahl’s ePanorama blog

Researchers have studied keystroke inference based on side channels, such as sound, electromagnetic wave, and timing. Since these attacks exploit characteristics of physical keyboards, they become ineffective on smartphones with soft keyboards.

Attacks using sensors on smartphone raises the awareness of privacy attacks on smartphone sensors. Besides the obvious privacy concern over the GPS sensor, researchers have shown attacks using the camera and microphone.

TouchLogger: Inferring Keystrokes On Touch Screen From Smartphone Motion is the first paper to show the privacy risks of motion sensors. Since typing on different locations on the screen causes different vibrations, motion data can be used to infer the keys being typed.

Both Android and iOS provide three accuracy levels based on event frequencies. For example, at the highest accuracy level, the average interval of device orientation events on an HTC Evo 4G phone is about 30ms, while that on a Motorola Droid phone is about 110ms. TouchLogger using motion sensor achieved an accuracy rate of over 70% on tests performed by researchers.

Many modern cellular phone use USB plug for charging and many places offer nowadays charging possibility. But plugging your phone into an untrusted USB cable is, indeed, a security risk according to Juicejacking – an emergency phone charge can be a security risk article. The article fortunately tells that it’s easy to avoid the risk in both directions: Always carry and use the charging adapter which came with your device and use it instead of charging station. It’s a lot safer than trusting an unknown cable hanging out of an unknown cabinet in a public place