Only in August of last year, more than 300 apps that allowed DDoS attacks against other devices around the world swarmed the shelves of the Google Play Store.

For this, the attacker has to enter the victim’s phone or, at least, gain access to the speaker and microphone. From here they have developed and trained sonarSnoop (the name they have given to the software), getting in just four attempts to guess one of those 12 combinations.

Researchers from both universities have relied on a previous study that ensured that only by entering 12 combinations, 20% of the Android devices that currently present on the market are hackable. In an unlock pattern there are 400,000 possible combinations. Then send the data to an external server, train them with machine learning (automatic learning) and in a few minutes, the system returns the password to enter in the Android device. Hence, to solve this “problem”, researchers send sounds (inaudible to humans) through the speakers and collect (through the microphone) the echo that occurs when someone draws their unlock pattern on the screen.

Android unlock pattern software