💻 computer science

Capacitive Touchscreens at Risk: A Practical Side-Channel Attack on Smartphones via Electromagnetic Emanations

This paper introduces TESLA, a novel contactless electromagnetic side-channel attack that exploits touchscreen emanations to accurately reconstruct sensitive user inputs like PIN codes, keyboard entries, and handwriting trajectories on various commercial smartphones in practical scenarios.

Original authors: Yukun Cheng, Changhai Ou, Shiyu Zhu, Jinyuan Zhang, Zhenfang Qiu, Xingshuo Han, Tianwei Zhang, Yuan Li, Shihui Zheng

Published 2026-05-15

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yukun Cheng, Changhai Ou, Shiyu Zhu, Jinyuan Zhang, Zhenfang Qiu, Xingshuo Han, Tianwei Zhang, Yuan Li, Shihui Zheng

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your smartphone screen isn't just a piece of glass you touch; it's actually a tiny, invisible radio station that broadcasts your secrets every time you tap it. That is the core discovery of a new study called TESLA.

Here is the story of how it works, explained simply:

The Invisible Broadcast

Think of your smartphone's touchscreen like a giant, high-speed grid of invisible wires. To know where you are touching, the phone constantly sends electrical signals through these wires, scanning the screen from top to bottom, very quickly.

When your finger touches the screen, it acts like a conductor (like a bridge) that changes the electrical flow. This change creates a tiny, unique "fingerprint" in the electromagnetic waves (invisible radio signals) that leak out of the phone.

The Analogy: Imagine a person walking across a wooden floor. Even if you can't see them, you can hear their footsteps. If they walk on the left side of the room, the sound echoes differently than if they walk on the right. TESLA is like a super-sensitive microphone that listens to the "footsteps" of your finger on the screen's electrical grid.

The Attack: Listening from the Shadows

The researchers (the "attackers" in this story) don't need to hack your phone, install spyware, or even touch it. They just need to sit nearby with a special listening device (a probe), perhaps hidden in a bag or under a table.

The Setup: You are in a meeting room or a library, unlocking your phone or typing a password.
The Eavesdropping: The attacker's probe is just a few inches away, listening to the electromagnetic "hum" of your phone.
The Magic: Because the phone scans the screen in a specific order (left to right, top to bottom), the timing of the signal tells the attacker exactly where you touched.

What Can They Steal?

The paper shows that this "listening" trick is incredibly powerful. The researchers tested it on popular phones like the iPhone X, Samsung S10, and Huawei Mate 30. Here is what they could reconstruct:

Your PIN Code: If you unlock your phone with a 4 or 6-digit code, the attacker can guess it with 99.3% accuracy. It's like hearing the rhythm of your taps and knowing exactly which buttons you pressed.
Your Typing: They can reconstruct what you are typing on the keyboard. If you type a password or a secret message, they can read it with 97.6% accuracy.
Your Apps: They can tell if you are using a banking app, a shopping app, or a music player just by looking at where on the screen you tend to tap.
Your Handwriting: This is the most impressive part. If you sign a document or write a note by hand, the attacker can draw a near-perfect copy of your handwriting on their own screen. They got the shape of the letters right 76.8% of the time.

Why Is This So Dangerous?

Previous attacks had big "catches." Some required you to be charging your phone with a specific cable. Others needed the attacker to physically modify the phone. Some only worked in a quiet lab.

TESLA is different because:

It's Contactless: The attacker doesn't need to touch your phone or plug it in.
It's Fast: They can catch thousands of "samples" (taps) in just one minute.
It's Everywhere: It works in a noisy library or a quiet meeting room. It doesn't care if you are using a wireless charger or not.

The "Why" Behind the Leak

Why does this happen? It's because of how the phone is built. To save space and money, phones scan the screen in a specific, predictable pattern.

Horizontal vs. Vertical: The researchers found that it's easy to tell if you tapped the top row or the bottom row (because the timing is different). But it's harder to tell if you tapped the top-left corner vs. the bottom-left corner, because those spots are scanned at almost the exact same time.
The Fix: The paper suggests that phone makers could fix this by scrambling the order in which they scan the screen (like shuffling a deck of cards every second) or by adding better shielding to stop the signals from leaking out.

The Bottom Line

The paper concludes that our smartphones are currently broadcasting our most sensitive interactions (passwords, signatures, private messages) into the air. While the researchers built a tool to steal this information, their goal is to wake up manufacturers so they can build better defenses.

In short: Your phone is whispering your secrets to anyone standing close enough with the right ears. TESLA is the tool that taught us how to listen.

Technical Summary: TESLA – A Practical Side-Channel Attack on Smartphones via Electromagnetic Emanations

1. Problem Statement

Modern smartphones universally utilize capacitive touchscreens, which, while offering superior durability and multi-touch capabilities, inadvertently introduce severe privacy vulnerabilities. Existing side-channel attacks targeting these devices suffer from significant practical limitations:

Limited Scope: Many prior works focus on a single type of sensitive information (e.g., only PIN codes or only fingerprints) rather than a comprehensive range of user activities.
Intrusive Requirements: High-accuracy attacks often require physical modifications to the device (e.g., compromised USB cables) or specific device states (e.g., the phone must be on a wireless charger).
Temporal and Environmental Constraints: Some methods require prolonged signal capture durations or rely on specialized laboratory conditions and hardware, reducing their feasibility in real-world scenarios.

The core problem addressed is the lack of a contactless, non-intrusive, and generalized side-channel attack capable of recovering diverse sensitive user data (discrete inputs and continuous trajectories) under realistic, everyday conditions.

2. Methodology: The TESLA Framework

The authors propose TESLA (Touchscreen Electromagnetic Side-channel Leakage Attack), a novel framework that exploits inherent electromagnetic (EM) emanations generated during the touchscreen scanning process. The attack operates via a four-phase pipeline:

A. Vulnerability Mechanism

The attack leverages two fundamental principles:

Human Coupling Effect: When a finger touches the screen, it alters the mutual capacitance between the transmitting (TX) and receiving (RX) electrodes, changing the system's impedance and amplifying EM emissions.
Scan Driving Method (SDM): Most smartphones use SDM, where TX electrodes are activated sequentially. A touch at a specific horizontal coordinate introduces a predictable temporal delay ( $\Delta t$ ) in the EM signal relative to the scan cycle start. This creates a unique "time-to-space" mapping where the timing of EM peaks correlates directly with the touch location. Crucially, this leakage is independent of animated visual feedback.

B. Attack Pipeline

User Interaction Classification: A Random Forest classifier analyzes EM signal characteristics (touch duration and frequency) to distinguish between screen unlocking, keyboard input, application interaction, and handwriting.
Signal Interception: An algorithm detects the "trigger" (sharp jump), "valid signal" (containing location data), and "termination" (stabilization) phases of the EM trace to isolate the relevant data and improve the signal-to-noise ratio.
Signal Normalization: Intercepted signals are reshaped via up/down-sampling to a fixed length and normalized using Z-score normalization to ensure consistent input for deep learning models.
Sensitive Information Extraction:
- Discrete Inputs (PINs/Keystrokes): A Multi-Layer Perceptron (MLP) classifies touch locations based on the normalized signal features.
- Application Categories: A Convolutional Neural Network (CNN) analyzes "touch hotspots" (distribution patterns of touches) to infer the application type (e.g., payment vs. shopping).
- Handwriting Trajectories: A Transformer-based architecture captures temporal dependencies in continuous signals to reconstruct 2D spatial coordinates, followed by post-processing (smoothing) and splicing to generate the final trajectory.

3. Key Contributions

Discovery of a Unified Leakage Basis: The paper reveals that EM emanations during touchscreen scanning encode the spatiotemporal evolution of touch interactions, forming a unified leakage basis for both discrete and continuous inputs.
A Generalized Attack Framework: TESLA is the first contactless attack capable of recovering a broad spectrum of sensitive data: screen-unlocking PINs, keyboard inputs, interacting application categories, and continuous handwriting trajectories.
Practical Feasibility: The attack requires no physical contact, no device modification, and no specific device states (e.g., wireless charging). It functions effectively in both public (libraries) and private (meeting rooms) environments with a probe placed merely 5 cm from the device.
Cross-Device Transferability: The framework demonstrates robust transferability, allowing models trained on one device to successfully attack different units of the same model, and showing adaptability across different manufacturers (Apple, Xiaomi, Samsung, Huawei).

4. Experimental Results

The authors evaluated TESLA on four commercial smartphones: iPhone X, Xiaomi 10 Pro, Samsung S10, and Huawei Mate 30 Pro.

Discrete Input Recovery:
- PIN Codes: Achieved 99.3% accuracy in recognizing 4-digit PINs.
- Keyboard Inputs: Achieved 97.6% accuracy in reconstructing keyboard inputs.
- Application Categories: Achieved 95.0% accuracy in inferring application types.
- End-to-End Success: In top-5 attempts (allowing 5 guesses), the system achieved a 99.33% success rate in reconstructing complete user input sequences across all tested scenarios.
Continuous Trajectory Recovery:
- Character Recognition: Achieved 76.8% accuracy in recognizing handwritten characters.
- Geometric Similarity: Achieved a Jaccard index of 0.74 for 2D trajectory reconstruction, indicating high spatial overlap between original and recovered paths.
Robustness:
- The attack maintained high accuracy (over 95% for PINs) even with background applications running.
- Performance remained effective at distances up to 25 cm, though accuracy decreased with distance.
- The attack functioned effectively through wooden barriers (e.g., tables) and in noisy public environments, albeit with slightly reduced accuracy compared to private settings.

5. Significance and Claims

The paper claims that TESLA fundamentally elevates the understanding of capacitive touchscreen security by unifying the physical leakage mechanisms for both discrete and continuous inputs. Unlike previous works that were limited to specific targets or required restrictive conditions, TESLA demonstrates that everyday capacitive touch interactions are inherently vulnerable to remote, contactless eavesdropping.

The authors emphasize that this vulnerability is not a software bug but a consequence of the hardware scanning architecture (SDM) and human coupling physics. Consequently, the paper urges manufacturers to implement scanning sequence randomization at the Analog Front End (AFE) level to break the predictable time-to-space mapping, as software-level obfuscation (like keyboard shuffling) is insufficient for protecting continuous inputs like signatures.

The work serves as a critical warning that current smartphone security models may be insufficient against sophisticated, non-intrusive side-channel attacks capable of compromising high-security tasks such as electronic signatures and financial transactions.