Touch screens could be compromised by a clever criminal to help figure out your password. That's the word coming out of a Usenix conference this week after researchers from the University of Pennsylvania presented their paper, "Smudge Attacks on Smartphone Touch Screens" [PDF].   

The researchers concluded that touch screens may pose a security risk.  They argue that  residual oil from the body leave behind smudges that offer would-be-attackers unauthorized access to a user's information.  

The research suggests that ATMS, smartphones, voting machines, PIN entry devices and other devices can be susceptible but that the Android graphical password pattern is particularly vulnerable according to PC Pro. 

"We believe smudge attacks based on reflective properties of oily residues are but one possible attack vector on touch screens," the report added. “In future work, we intend to investigate other devices that may be susceptible, and varied smudge attack styles, such as heat trails caused by the heat transfer of a finger touching a screen."

"The practice of entering sensitive information via touch screens needs careful analysis in light of our results."

The Android phone was the main focus of their research.  They analyzed the swipe-style unlock system on the Android phone HTC G1 and the HTC Nexus One models.  They were able to recreate access codes for the phone by using a camera, computer and photo-editing software.  

They photographed the screen using various camera angles and lighting positions.  They increased the contrast and studied the directional patterns of the smudges and figured out the sequences of patterns.  

They were successful in unlocking the Android phones over 90 percent of the time.