With smart devices being an essential part of our everyday lives, unsupervised access to the mobile sensors' data can result in a multitude of side-channel attacks. In this paper, we study potential data leaks from Apple Pencil (2nd generation) supported by the Apple iPad Pro, the latest stylus pen which attaches to the iPad body magnetically for charging. We observe that the Pencil's body affects the magnetic readings sensed by the iPad's magnetometer when a user is using the Pencil. Therefore, we ask: Can we infer what a user is writing on the iPad screen with the Apple Pencil, given access to only the iPad's motion sensors' data? To answer this question, we present Side-channel attack on Stylus pencil through Sensors (S3), a system that identifies what a user is writing from motion sensor readings. We first use the sharp fluctuations in the motion sensors' data to determine when a user is writing on the iPad. We then introduce a high-dimensional particle filter to track the location and orientation of the Pencil during usage. Lastly, to guide particles, we build the Pencil's magnetic map serving as a bridge between the measured magnetic data and the Pencil location and orientation. We evaluate S3 with 10 subjects and demonstrate that we correctly identify 93.9%, 96%, 97.9%, and 93.33% of the letters, numbers, shapes, and words by only having access to the motion sensors' data.

翻译：智能设备是我们日常生活的重要组成部分, 智能设备是我们日常生活的一个基本部分, 不受监督地访问移动传感器的数据可能导致多起侧通道攻击。 在本文中, 我们研究苹果 Pencil (第二代) 可能的数据泄漏, 由苹果 iPad Pro 支持的苹果 Pencil (第二代), 最新的 Stylus 笔与iPad 身体磁充电连接。 我们观察到, Pencil 的身体会影响iPad 磁强计在用户使用 Pencil 时所感知的磁读数。 因此, 我们问: 我们能否推断一个用户在 iPad 屏幕上用苹果 Pencil 写入的 iPad 屏幕上写了什么 。 由于 iPad Pencil 只访问 iPacil 运动传感器的数据 iPencil (第二代) 的 iPapplecil (第二代), 可能从苹果 Pencil (第二代) (第二代) 中读取到 iPencial 方向 。 为了 Smal 方向的数据, 我们首先使用 10 和 Penc 方向 数据 。