  Touchscreen-based electronic devices such as smart phones and smart tablets
are widely used in our daily life. While the security of electronic devices
have been heavily investigated recently, the resilience of touchscreens against
various attacks has yet to be thoroughly investigated. In this paper, for the
first time, we show that touchscreen-based electronic devices are vulnerable to
intentional electromagnetic interference (IEMI) attacks in a systematic way and
how to conduct this attack in a practical way. Our contribution lies in not
just demonstrating the attack, but also analyzing and quantifying the
underlying mechanism allowing the novel IEMI attack on touchscreens in detail.
We show how to calculate both the minimum amount of electric field and signal
frequency required to induce touchscreen ghost touches. We further analyze our
IEMI attack on real touchscreens with different magnitudes, frequencies,
duration, and multitouch patterns. The mechanism of controlling the
touchscreen-enabled electronic devices with IEMI signals is also elaborated. We
design and evaluate an out-of-sight touchscreen locator and touch injection
feedback mechanism to assist a practical IEMI attack. Our attack works directly
on the touchscreen circuit regardless of the touchscreen scanning mechanism or
operating system. Our attack can inject short-tap, long-press, and
omni-directional gestures on touchscreens from a distance larger than the
average thickness of common tabletops. Compared with the state-of-the-art
touchscreen attack, ours can accurately inject different types of touch events
without the need for sensing signal synchronization, which makes our attack
more robust and practical. In addition, rather than showing a simple
proof-of-concept attack, we present and demonstrate the first ready-to-use IEMI
based touchscreen attack vector with end-to-end attack scenarios.
