{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,20]],"date-time":"2026-09-20T03:10:45Z","timestamp":1789873845665,"version":"4.0.1"},"reference-count":34,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2023,3,13]],"date-time":"2023-03-13T00:00:00Z","timestamp":1678665600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000332","name":"Royal Society of Edinburgh","doi-asserted-by":"crossref","award":["65040"],"award-info":[{"award-number":["65040"]}],"id":[{"id":"10.13039\/501100000332","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100000266","name":"EPSRC","doi-asserted-by":"crossref","award":["EP\/V008870\/1"],"award-info":[{"award-number":["EP\/V008870\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"crossref"}]},{"name":"PETRAS National Centre of Excellence for IoT Systems Cybersecurity"},{"DOI":"10.13039\/501100000266","name":"EPSRC","doi-asserted-by":"crossref","award":["EP\/S035362\/1"],"award-info":[{"award-number":["EP\/S035362\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2023,5,31]]},"abstract":"<jats:p>Thermal cameras can reveal heat traces on user interfaces, such as keyboards. This can be exploited maliciously to infer sensitive input, such as passwords. While previous work considered thermal attacks that rely on visual inspection of simple image processing techniques, we show that attackers can perform more effective artificial intelligence (AI)\u2013driven attacks. We demonstrate this by presenting the development of ThermoSecure and its evaluation in two user studies (N = 21, N = 16), which reveal novel insights about thermal attacks. We detail the implementation of ThermoSecure and make a dataset of 1,500 thermal images of keyboards with heat traces resulting from input publicly available. Our first study shows that ThermoSecure successfully attacks 6-symbol, 8-symbol, 12-symbol, and 16-symbol passwords with an average accuracy of 92%, 80%, 71%, and 55% respectively, and even higher accuracy when thermal images are taken within 30 seconds. We found that typing behavior significantly impacts vulnerability to thermal attacks: hunt-and-peck typists are more vulnerable than fast typists (92% vs. 83% thermal attack success. respectively, if performed within 30 seconds). The second study showed that keycap material has a statistically significant effect on the effectiveness of thermal attacks: ABS keycaps retain the thermal trace of user presses for a longer period of time, making them more vulnerable to thermal attacks, with a 52% average attack accuracy compared with 14% for keyboards with PBT keycaps. Finally, we discuss how systems can leverage our results to protect from thermal attacks and present 7 mitigation approaches that are based on our results and previous work.<\/jats:p>","DOI":"10.1145\/3563693","type":"journal-article","created":{"date-parts":[[2022,9,15]],"date-time":"2022-09-15T09:54:32Z","timestamp":1663235672000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["ThermoSecure: Investigating the Effectiveness of AI-Driven Thermal Attacks on Commonly Used Computer Keyboards"],"prefix":"10.1145","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2056-202X","authenticated-orcid":false,"given":"Norah","family":"Alotaibi","sequence":"first","affiliation":[{"name":"University of Glasgow, United Kingdom and Taif University, Airport Road, Al Hawiyah, At Taif, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8085-7853","authenticated-orcid":false,"given":"John","family":"Williamson","sequence":"additional","affiliation":[{"name":"University of Glasgow, Glasgow, Scotland, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7051-5200","authenticated-orcid":false,"given":"Mohamed","family":"Khamis","sequence":"additional","affiliation":[{"name":"University of Glasgow, Glasgow, Scotland, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,3,13]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3025453.3025461"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702290"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3399715.3399819"},{"key":"e_1_3_2_5_2","doi-asserted-by":"crossref","first-page":"712","DOI":"10.1007\/978-3-030-85610-6_41","volume-title":"Human-Computer Interaction \u2013 INTERACT 2021","author":"Abdrabou Yasmeen","year":"2021","unstructured":"Yasmeen Abdrabou, Reem Hatem, Yomna Abdelrahman, Amr Elmougy, and Mohamed Khamis. 2021. Passphrases beat thermal attacks: Evaluating text input characteristics against thermal attacks on laptops and smartphones. In Human-Computer Interaction \u2013 INTERACT 2021, Carmelo Ardito, Rosa Lanzilotti, Alessio Malizia, Helen Petrie, Antonio Piccinno, Giuseppe Desolda, and Kori Inkpen (Eds.). Springer International Publishing, Cham, 712\u2013721."},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/322796.322806"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3490100.3516472"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.5555\/1925004.1925009"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3546155.3546706"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.44"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/2207676.2208544"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/2757710.2757713"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.322"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329846"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376840"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2006.08.005"},{"issue":"9114","key":"e_1_3_2_17_2","doi-asserted-by":"crossref","first-page":"1492","DOI":"10.1016\/S0140-6736(05)78875-9","article-title":"Cold hands, warm heart","volume":"351","author":"Kim Han","year":"1998","unstructured":"Han Kim, Clark Richardson, Jeanette Roberts, Lisa Gren, and Joseph L. Lyon. 1998. Cold hands, warm heart. The Lancet 351, 9114 (1998), 1492.","journal-title":"The Lancet"},{"key":"e_1_3_2_18_2","unstructured":"Daniel Kurz. 2020. Method and device for detecting a touch between a first object and a second object. US Patent 10 877 605."},{"key":"e_1_3_2_19_2","unstructured":"Vladimir I. Levenshtein et al. 1966. Binary codes capable of correcting deletions insertions and reversals. In Soviet Physics Doklady Vol. 10. Soviet Union 707\u2013710."},{"issue":"5","key":"e_1_3_2_20_2","first-page":"1142","article-title":"Physical password breaking via thermal sequence analysis","volume":"14","author":"Li Duo","year":"2018","unstructured":"Duo Li, Xiao-Ping Zhang, Menghan Hu, Guangtao Zhai, and Xiaokang Yang. 2018. Physical password breaking via thermal sequence analysis. IEEE Transactions on Information Forensics and Security 14, 5 (2018), 1142\u20131154.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3411764.3445478"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3428121"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/266420.266434"},{"key":"e_1_3_2_24_2","first-page":"6","volume-title":"Proceedings of the 5th USENIX Conference on Offensive Technologies","author":"Mowery Keaton","year":"2011","unstructured":"Keaton Mowery, Sarah Meiklejohn, and Stefan Savage. 2011. Heat of the moment: Characterizing the efficacy of thermal camera-based attacks. In Proceedings of the 5th USENIX Conference on Offensive Technologies. 6\u20136."},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/2556288.2557208"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/2501604.2501615"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/2632048.2636090"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/2891411"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702212"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/2449396.2449432"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1093\/gerona\/glr001"},{"key":"e_1_3_2_32_2","first-page":"458","volume-title":"SECRYPT","author":"Wodo Wojciech","year":"2016","unstructured":"Wojciech Wodo and Lucjan Hanzlik. 2016. Thermal imaging attacks on keypad security systems. In SECRYPT. 458\u2013464."},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCI.2014.6968381"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-69002-5_10"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3230740"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3563693","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3563693","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:38:09Z","timestamp":1750178289000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3563693"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,13]]},"references-count":34,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2023,5,31]]}},"alternative-id":["10.1145\/3563693"],"URL":"https:\/\/doi.org\/10.1145\/3563693","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,3,13]]},"assertion":[{"value":"2021-09-03","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-09-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-03-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}