  Conforming to W3C specifications, mobile web browsers allow JavaScript code
in a web page to access motion and orientation sensor data without the user's
permission. The associated risks to user security and privacy are however not
considered in W3C specifications. In this work, for the first time, we show how
user security can be compromised using these sensor data via browser, despite
that the data rate is 3 to 5 times slower than what is available in app. We
examine multiple popular browsers on Android and iOS platforms and study their
policies in granting permissions to JavaScript code with respect to access to
motion and orientation sensor data. Based on our observations, we identify
multiple vulnerabilities, and propose TouchSignatures which implements an
attack where malicious JavaScript code on an attack tab listens to such sensor
data measurements. Based on these streams, TouchSignatures is able to
distinguish the user's touch actions (i.e., tap, scroll, hold, and zoom) and
her PINs, allowing a remote website to learn the client-side user activities.
We demonstrate the practicality of this attack by collecting data from real
users and reporting high success rates using our proof-of-concept
implementations. We also present a set of potential solutions to address the
vulnerabilities. The W3C community and major mobile browser vendors including
Mozilla, Google, Apple and Opera have acknowledge our work and are implementing
some of our proposed countermeasures.
