一句话：提出一种 Android 手机 GPU 侧信道攻击，利用 GPU overdraw 与性能计数器变化推断屏幕键盘按键，窃取用户名和密码。
本文研究智能手机 GPU 是否可被非特权攻击者用作窃取用户凭据的侧信道。作者针对 Android 手机上的 Qualcomm Adreno GPU，分析用户在屏幕键盘上按键时弹出窗口渲染所产生的 GPU overdraw，并发现每次按键造成的 overdraw 会对应一组独特的 GPU 性能计数器变化。基于这一观察，攻击者可在无特权条件下采集这些计数器并准确推断按键序列，从而恢复登录用户名和密码。作者在多种 Android 手机型号上进行实际实验，结果显示该攻击能正确推断超过 80% 的用户凭据输入，同时在受害设备上带来的计算开销和网络流量可忽略不计。论文还建议通过限制 GPU 性能计数器访问或对其取值进行混淆来缓解该攻击。
Graphics Processing Unit (GPU) on smartphones is an effective target for hardware attacks. In this paper, we present a new side channel attack on mobile GPUs of Android smartphones, allowing an unprivileged attacker to eavesdrop the user's credentials, such as login usernames and passwords, from their inputs through on-screen keyboard. Our attack targets on Qualcomm Adreno GPUs and investigate the amount of GPU overdraw when rendering the popups of user's key presses of inputs. Such GPU overdraw caused by each key press corresponds to unique variations of selected GPU performance counters, from which these key presses can be accurately inferred. Experiment results from practical use on multiple models of Android smartphones show that our attack can correctly infer more than 80% of user's credential inputs, but incur negligible amounts of computing overhead and network traffic on the victim device. To counter this attack, this paper suggests mitigations of access control on GPU performance counters, or applying obfuscations on the values of GPU performance counters.