Invisible Finger: Practical Electromagnetic Interference Attack on Touchscreen-based Devices

Overview: Haoqi Shan, a PhD candidate from the Security in Silicon Lab at the University of Florida, presents collaborative research with the University of New Hampshire on "Invisible Finger," a practical intentional electromagnetic interference (IEMI) attack targeting capacitive touchscreens. The presentation demonstrates how remote electromagnetic signals can induce precise, unauthorized touch gestures on modern consumer devices without requiring physical contact. Shan breaks down the hardware mechanics of mutual-capacitance touchscreens, explains the attack physics, and establishes how remote fault injection can manipulate commercial touchscreen controllers from a distance.

Key Topics: - Remote intentional electromagnetic interference (IEMI) injection against touchscreens - Comparative mechanics of self-capacitance vs. mutual-capacitance touchscreen architectures - Signal chain operations involving excitation generators, charge transfer sensors, and ADCs - Induction of short taps, long presses, and omnidirectional swipe gestures from 3 to 4 centimeters

Technical Details: The presentation categorizes hardware-level touchscreen security research into two primary domains: content stealing (leveraging electromagnetic or acoustic side-channel emissions to remotely reconstruct displayed screen data) and fault or touch event injection. Shan contextualizes the research alongside prior academic publications such as "GhostTouch" (USENIX Security) and "Tap 'n Ghost" (IEEE S&P), distinguishing Invisible Finger as the first practical system incorporating an out-of-screen locator and touch event detector capable of operating regardless of the controller's underlying scanning or driving algorithms. The research targets capacitive touchscreens, which account for approximately 46% of deployed touch devices worldwide across smartphones, tablets, and laptops.

Shan contrasts the two primary capacitive sensing methods: self-capacitance (which measures capacitance variations between individual electrodes and ground caused by a finger's presence) and mutual-capacitance (which measures the mutual capacitance between intersecting grid pairs of transmitting and receiving electrodes). In mutual-capacitance screens, a physical finger touch introduces a localized mutual capacitance delta, which is detected during drive cycles. The underlying touchscreen hardware consists of an excitation signal generator driving the transmitting electrodes, a charge transfer sensor (QT sensor) capturing charge variations on the receiving lines, and an analog-to-digital converter (ADC) that translates analog voltage changes into digital coordinates for the touchscreen controller.

The Invisible Finger attack bridges theoretical electromagnetic coupling and practical gesture injection by emitting tuned IEMI signals from an antenna placed at a standoff distance of 3 to 4 centimeters. By synchronizing electromagnetic pulses with the touchscreen controller's sensing windows, the attack injects artificial charge onto the electrode grid, causing the ADC and controller firmware to interpret the induced voltage fluctuations as genuine touch inputs. The attack successfully synthesizes short taps, sustained long presses, and omnidirectional swipe gestures across diverse consumer devices.

Key Takeaways: Hardware manufacturers and touchscreen controller designers must incorporate electromagnetic shielding and hardware-level signal filtering to protect charge-transfer and ADC circuits from high-frequency radiated interference. Firmware algorithms should implement anomaly detection to identify unnatural electrical characteristics, such as impossible multi-electrode charge spikes or mismatched excitation timing that diverge from human touch profiles. Critical applications handling payments or sensitive operations should avoid relying purely on unshielded capacitive touch confirmation when operating in untrusted physical proximity.

(AI summary — Gemini Flash)