I Can See Your Secrets, A Way to Recognize User Pin Codes by Surveillance Camera

Surveillance cameras are currently widely used in public and private places to enhance area security and reduce crime rates. However, the extensive use of surveillance cameras also poses significant threats, particularly concerning the leakage of users’ private information. Surveillance cameras are often installed in the corners of areas such as hotel front desks, supermarket checkout areas, or ticket offices to observe user behavior, which can lead to shoulder-surfing attacks. In these public or private settings, when users input their personal identification number (PIN) for unlocking or payment, this process may be intentionally or unintentionally exposed and recorded. If the PIN is compromised, it can result in severe privacy breaches and financial losses for users. Existing work primarily focuses on dedicated handheld recording devices such as cameras and smartphones, lacking discussion on public surveillance cameras. In this paper, we first present an attack model for such scenarios. Based on this model, we design and implement an automated attack system for PIN recognition. Experimental results demonstrate that our proposed attack model is both feasible and effective, achieving $90 \%$ accuracy with our system. Finally, we urge users, smartphone manufacturers, and surveillance camera manufacturers to be aware of this attack vector to prevent further harm.