Pitfalls in Designing Zero-Effort Deauthentication: Opportunistic Human Observation Attacks

Loading...
Thumbnail Image
Journal Title
Journal ISSN
Volume Title
Conference article in proceedings
This publication is imported from Aalto University research portal.
View publication in the Research portal
View/Open full text file from the Research portal
Date
2016
Major/Subject
Mcode
Degree programme
Language
en
Pages
1-14
Series
Network and Distributed System Security Symposium 2016
Abstract
Deauthentication is an important component of any authentication system. The widespread use of computing devices in daily life has underscored the need for zero-effort deauthentication schemes. However, the quest for eliminating user effort may lead to hidden security flaws in the authentication schemes. As a case in point, we investigate a prominent zero-effort deauthentication scheme, called ZEBRA, which provides an interesting and a useful solution to a difficult problem as demonstrated in the original paper. We identify a subtle incorrect assumption in its adversary model that leads to a fundamental design flaw. We exploit this to break the scheme with a class of attacks that are much easier for a human to perform in a realistic adversary model, compared to the naive attacks studied in the ZEBRA paper. For example, one of our main attacks, where the human attacker has to opportunistically mimic only the victim’s keyboard typing activity at a nearby terminal, is significantly more successful compared to the naive attack that requires mimicking keyboard and mouse activities as well as keyboardmouse movements. Further, by understanding the design flaws in ZEBRA as cases of tainted input, we show that we can draw on well-understood design principles to improve ZEBRA’s security.
Description
VK: Asokan, N.
Keywords
Other note
Citation
Huhta , O , Shrestha , P , Udar , S , Juuti , M , Saxena , N & Asokan , N 2016 , Pitfalls in Designing Zero-Effort Deauthentication: Opportunistic Human Observation Attacks . in Network and Distributed System Security Symposium 2016 . Internet Society , San Diego , pp. 1-14 , Network and Distributed System Security Symposium , San Diego , California , United States , 21/02/2016 . https://doi.org/10.14722/ndss.2016.23199