  Demand for smartwatches has taken off in recent years with new models which
can run independently from smartphones and provide more useful features,
becoming first-class mobile platforms. One can access online banking or even
make payments on a smartwatch without a paired phone. This makes smartwatches
more attractive and vulnerable to malicious attacks, which to date have been
largely overlooked. In this paper, we demonstrate Snoopy, a password extraction
and inference system which is able to accurately infer passwords entered on
Android/Apple watches within 20 attempts, just by eavesdropping on motion
sensors. Snoopy uses a uniform framework to extract the segments of motion data
when passwords are entered, and uses novel deep neural networks to infer the
actual passwords. We evaluate the proposed Snoopy system in the real-world with
data from 362 participants and show that our system offers a 3-fold improvement
in the accuracy of inferring passwords compared to the state-of-the-art,
without consuming excessive energy or computational resources. We also show
that Snoopy is very resilient to user and device heterogeneity: it can be
trained on crowd-sourced motion data (e.g. via Amazon Mechanical Turk), and
then used to attack passwords from a new user, even if they are wearing a
different model. This paper shows that, in the wrong hands, Snoopy can
potentially cause serious leaks of sensitive information. By raising awareness,
we invite the community and manufacturers to revisit the risks of continuous
motion sensing on smart wearable devices.
