Password Security Research Articles

Comparative study of password storing using hash function with MD5, SHA1, SHA2, and SHA3 algorithm

<span>The main purpose of passwords is to prevent unauthorized people from accessing the system. The rise in internet users has led to an increase in password hacking, which has resulted in a variety of problems. These issues include opponents stealing a company's or nation's private information and harming the economy or the organization's security. Password hacking is a common tool used by hackers for illegal purposes. Password security against hackers is essential. There are several ways to hack passwords, including traffic interception, social engineering, credential stuffing, and password spraying. In an attempt to prevent hacking, hashing algorithms are therefore mostly employed to hash passwords, making password cracking more difficult. In the suggested work, several hashing techniques, including message digest (MD5), secure hash algorithms (SHA1, SHA2, and SHA3) have been used. They have become vulnerable as a result of being used to store passwords. A rainbow table attack is conceivable. Passwords produced with different hash algorithms can have their hash values attacked with the help of the Hashcat program. It is proven that the SHA3 algorithm can help with more secure password storage when compared to other algorithms.</span>

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

Practical and Secure Password Authentication and Key-Agreement-Scheme-Based Dual Server for IoT Devices in 5G Network

Analysis and Design of Efficient Authentication Techniques for Password Entry with the Qwerty Keyboard for VR Environments.

Authentication in digital security relies heavily on text-based passwords, even with other available methods like biometrics and graphical passwords. While virtual reality (VR) keyboards are typically invisible to onlookers, the presence of inconspicuous sensors, including accelerometers, gyroscopes, and barometers, poses a potential risk of unauthorized observation and recording. Traditional defense shoulder-surfing attack methods typically involve breaking apart the Qwerty layout, which destroys the user's inherent familiarity with the layout. This research addresses the need for secure password entry in VR environments while retaining the Qwerty layout. We explore three keyboard-related position alteration strategies to ensure security while mitigating the decline in user experience. These strategies involve moving the entire keyboard, cursor, and keys. Our theoretical study assesses the effectiveness of these strategies against shoulder-surfing attacks. Two user studies, employing ray-based and position-based text entry methods, respectively, evaluate the practical effectiveness of the three strategies in resisting shoulder-surfing attacks, as well as their impact on typing performance and user experience. Our findings demonstrate that the three strategies achieve shoulder-surfing attack resistance comparable to a random layout keyboard. Moreover, compared to a random layout, the two strategies involving the movement of the entire keyboard and the repositioning of keys support faster entry rates and enhanced user experience.

A secure interoperable method for electronic health records exchange on cross platform blockchain network

An Electronic Health Record (EHR) store essential and sensitive patient's medical information. Since health information is highly confidential data, it should be accessible with the consent of the patient. Blockchain based EHR management system offers improvised privacy and patient-centric approach. EHR management systems are available with multiple blockchain platforms. Generally, EHRs are maintained at several independent blockchain platforms. EHR management systems should be capable of securely exchange data on cross platform blockchain network. The interoperability in such blockchain platforms should facilitate seamless cross-chain interaction and information exchange. This article proposes a method that facilitates secure EHR exchange on Ethereum and Hyperledger fabric network using hepatitis dataset. The key contributions of the proposed method include:•Hash lock based interoperable cross-chain method for EHR exchange across Ethereum and Hyperledger fabric.•Additional security to the EHR is ensured by partitioning EHR as on-chain (blockchain platform) and off-chain InterPlanetary File System (IPFS)•Secure Password Authentication-Based Key Exchange (SPAKE) based session management for EHR exchange across two parties.The proposed patient centric method is validated to ensures the successful exchange of patient EHR across Ethereum and Hyperledger fabric.

Adaptive Cybersecurity in the Digital Age: Emerging Threat Vectors and Next-Generation Defense Strategies

Abstract: This article examines the rapidly evolving landscape of cybersecurity, focusing on emerging threats and innovative defense mechanisms. We analyze four key threat vectors: Advanced Persistent Threats (APTs), ransomware, Internet of Things (IoT) vulnerabilities, and social engineering attacks. These threats pose significant risks to organizations, including data breaches, financial losses, and operational disruptions. In response, we explore cutting-edge defense mechanisms such as Artificial Intelligence and Machine Learning for threat detection, Zero Trust Architecture for access control, blockchain for data integrity, behavioral analytics for insider threat detection, and quantum cryptography for enhanced encryption. The article also outlines best practices for cybersecurity, including regular software updates, strong password policies, employee training, and security audits. By synthesizing current research and industry trends, this article provides a comprehensive overview of the cybersecurity landscape, emphasizing the need for continuous adaptation and vigilance in the face of evolving cyber threats

Evaluating applied security controls for safeguarding medical device‐integrated electronic medical records

AbstractRationale, Aims, and ObjectivesMedical device‐integrated electronic medical records (MDI‐EMR) pose significant challenges in ensuring effective usage, data security and patient safety. The complexities of MDI‐EMR necessitate applying various security mechanisms to safeguard against cyber threats. Therefore, we evaluated cyber threats to MDI‐EMR and the effectiveness of applied security controls using a proposed framework from sociotechnical and risk assessment perspectives.MethodWe conducted a qualitative case study evaluation in a general hospital in Saudi Arabia using interviews, observation, and document analysis from the perspectives of major MDI‐EMR stakeholders, including healthcare providers, IT professionals and cybersecurity specialists.ResultsThe results showed the interplay among physical, technical and administrative security controls that maintained a secure posture of MDI‐EMR. The effectiveness of security controls is highly influenced by the staff's cybersecurity awareness and training. The perceived effectiveness of security controls varied among users, with some expressing satisfaction with the ease of use and reliability, while others highlighting challenges such as password complexity and access procedures. Understanding these diverse perspectives is crucial for tailoring security measures to meet the needs of different stakeholders effectively.ConclusionCollaboration among the key stakeholders is crucial for implementing security controls for MDI‐EMR. Balancing security measures with usability concerns is essential, as highlighted by challenges in implementing technical controls. A comprehensive approach encompassing physical, technical and administrative controls, continuous education and awareness initiatives are significant to empower staff in recognising and mitigating cyber threats effectively to safeguard medical data and ensure the integrity of healthcare systems.

What is the Effectiveness of Salt and Pepper in Preventing Rainbow Table Attacks in Modern Password Hashing Algorithms?

Password security remains a critical concern in the digital age, as attackers continuously evolve their techniques to crack password databases. Among the most effective defenses against these threats are salt and pepper, two cryptographic techniques used to enhance password hashing security. Salt introduces unique, random values to each password, ensuring that even identical passwords result in different hashes, while pepper adds a hidden system-wide secret to further complicate attacks. This paper explores how salt and pepper work together to defend against rainbow table attacks, significantly increasing the complexity for attackers attempting to reverse-engineer password hashes. While these techniques provide strong protection, they are not foolproof and must be paired with additional security measures such as key-stretching algorithms and multi-factor authentication (MFA) to offer comprehensive defense. The paper also examines the limitations of salt and pepper and suggests future advancements, such as post-quantum cryptography and passwordless authentication, as potential pathways to further improve password security.

Information security in remote work: Strategies and challenges in a post-pandemic world

The increasing prevalence of remote work, accelerated by the COVID-19 pandemic, has brought significant information security challenges to organizations. While remote work offers numerous benefits such as flexibility and increased productivity, it also introduces unique risks, particularly in safeguarding sensitive data. The absence of traditional office security measures and reliance on potentially insecure home and public networks heighten these risks. Organizations must implement robust strategies, including the use of Virtual Private Networks (VPNs) and multi-factor authentication (MFA), to ensure secure communications and access to corporate systems. Additionally, the protection of devices used in remote work is critical, necessitating clear security policies, regular updates, and employee training on recognizing threats like phishing and malware. Studies by Kolomoets (2022) and Alsayfi and Alsirhani (2023) highlight the importance of addressing the increased risks associated with remote work, particularly the potential for data breaches due to the lack of direct access to comprehensive security controls. These studies recommend best practices such as secure password management and regular employee training to mitigate these threats. Tanriverdi and Metin (2021) emphasize the need for renewed focus on security awareness and behavior as remote work becomes the norm. Furthermore, Rakha (2023) explores the legal implications and best practices for maintaining cybersecurity in remote settings, while Livshitz (2022) focuses on data privacy challenges, providing insights into regulatory compliance and security audits. In conclusion, safeguarding information security in remote work environments requires a holistic approach that integrates technology, continuous education, and stringent security policies. Organizations must prioritize these efforts to protect sensitive data and maintain privacy in an increasingly remote workforce.

Enhancing Cloud Data Security using Artificial Neural Networks for Users’ Account Hijacking Security Threats

Objectives: To ensure the security of passwords of cloud users' accounts that cannot be decrypted easily by any software or hackers. Methods: In this manuscript, we have designed an experimental setup using a feed-forward back-propagation algorithm of Artificial Neural Networks techniques to ensure cloud data security. For this purpose, we have utilized password-based datasets created by us. 70% of the datasets are allocated for training and 30% for testing and validation purposes. In this training, TRAINLM training function, LEARNGDM adaptive function, performance function is MSE, and PURELIN and TANSIG transfer function to transfer the neurons from input to hidden layer and hidden to the output layer has been used. The minimum learning rate is set to 0.001. Findings: A username and password are required to access cloud services. A cloud-based storage system is used to store login credentials. Due to inadequate security, attackers use hacking techniques to gain access to users’ accounts. Attackers steal data, resources, or services from these accounts. To ensure the security of passwords of cloud users' accounts, we have designed an experimental setup using a feed-forward back-propagation algorithm of neural network techniques. Through this approach, the passwords are stored in a weight matrix, which is a multi-dimensional structure. Novelty: The dimensions of the weight matrix are obscured, making it impossible for the hackers to determine its structure. As a result, we conclude that cloud data is effectively secured on the cloud server. Keywords: Artificial Neural Networks, Cloud Computing, Data Security, Feed-Forward Back-Propagation Algorithm, Machine Learning

Improving the Usability of Graphical Authentication Systems Using Subject-Based Images

Recognition based graphical authentication systems rely on a system user’s ability to recognize previously chosen images and use those images to gain access into a computing systems, devices or application. Recognition based systems that utilise several types of images have been developed and studied. The déjà vu scheme depends on the use of abstract (meaningless) images. Images in the déjà vu scheme have no exact meaning. This scheme has also been actively studied. This article presents a between user study conducted on two recognition-based schemes using system prototypes. The Abstract Based Graphical Authentication (ABGA) was designed to simulate the déjà vu scheme. The performance of this system was compared with the performance of a novel system developed for this research. The novel system, called Subject Based Graphical Authentication (SBGA), in which the system used images from the various disciplines of the research participants. The researcher conducted a lab-based study with 100 participants, 50 participants for each of the prototypes. The study investigated the impact of using subject based images to enhance the usability and security of recognition-based graphical passwords. Two graphical models were thus developed and presented to the 100 participants, which comprised of staff and students from the departments of Computer Science, Mathematics, and Engineering. In the experiments, participants selected their graphical passwords from sets of images representing their various disciplines. The researcher observed that the memorability rate for graphical passwords consisting of subject based images aligned with participants' disciplines surpassed the rate for passwords with purely abstract images. The results indicated 81.7% successful login rate and 18.3% failure rate for Subject Based Graphical Authentication (SBGA). In contrast, Abstract Based Graphical Authentication (ABGP) exhibited a 51.5% successful login rate and a 48.7% failure rate. The findings provide significant insights for graphical password designers and developers seeking to enhance system memorability. Balancing image familiarity with security considerations can lead to more user-friendly and effective recognition-based authentication systems. This study provides valuable insights into the benefits of incorporating familiar images in recognition-based graphical passwords, showcasing a significant improvement in memorability and user authentication success. The findings underscore the importance of considering the user’s familiarity with portfolio images in the design of graphical authentication systems.

Cybersecurity Awareness Model with Methods: Analytical Hierarchy Process and Structural Equation Model

This era of revolution has influenced all sectors of society, including education, where technological advancements are now integral to online teaching and learning. However, not everyone fully understands the potential negative impacts of internet usage. The purpose of this research was to investigate and analyze cybersecurity awareness. The study focused on students at Aerospace Air Marshal Suryadarma University. The research employed a quantitative design, either descriptive (where subjects are typically measured once) or experimental (where subjects are measured multiple times). A descriptive study establishes a relationship between variables, while an experimental study determines causation. To analyze the collected data, SEM AMOS was utilized to measure students' awareness of cybersecurity. The study focused on five key areas: (a) regulation, (b) internet usage, (c) password security, (d) data security, and (e) cyberattacks. Based on the research framework and these focus areas, several indicators were developed for the study. The findings concluded that students are aware of cybersecurity issues.

Enhancing the Security of Information Systems Using Iot Technology

A medical patient information system is one of the systems that are currently in widespread use, and one of these is the psychiatric patient information system, which is used in clinics that treat patients who suffer from mental illnesses. It entails keeping track of the patients who visit these clinics for treatment and ensuring that they receive the necessary medications at the appropriate dosages. Patient information such as text, images, or others must be retained in this sort of system, and the reports that the system generates regularly for pharmaceuticals that are dispensed in various clinics separate this type of system from others. This study presents an innovative security strategy for accessing a managed care information system, emphasizing the use of IoT technology to enhance password security and protect sensitive patient information. Utilizing the Internet of Things (IoT) technology has enhanced the efficiency of creating secure passwords. The results of the tests showed that the goal of protecting patient information from people who didn't want to see it was very secure. This was shown in the literature.

Design and Development of Cybersecurity Suite

Protecting personal, corporate and government data in the digital age requires cybersecurity. Traditional cybersecurity methods sometimes lack comprehensive and dynamic protection mechanisms as cyber-attacks change and become more sophisticated. A new cybersecurity suite is proposed in this study. It integrates various advanced security technologies into a single user-friendly platform interaction. This paper specifically combines techniques for real-time phishing detection, strong password management, safe encryption and decryption services and an interactive module to promote user awareness and behaviours to improve digital security for individuals and organization. Rapid prototyping is used in iterative and incremental development phases to adapt to changing security needs and user input. This method allows the platform to be constantly improved to satisfy the current cybersecurity standards and react to new threats. The prototyped developed provides proactive digital defence, a complete cybersecurity platform that equips users to defend their digital presence. With the intuitive design and advanced feature set, the prototype aspires to democratize cybersecurity. Empirical testing of the prototype revealed that makes an effective protection of a wider audience without the complexities of security software. This paper contributes in the advances cybersecurity technology and shaping the digital protection measures.

New Test to Detect Clustered Graphical Passwords in Passpoints Based on the Perimeter of the Convex Hull

This research paper presents a new test based on a novel approach for identifying clustered graphical passwords within the Passpoints scenario. Clustered graphical passwords are considered a weakness of graphical authentication systems, introduced by users during the registration phase, and thus it is necessary to have methods for the detection and prevention of such weaknesses. Graphical authentication methods serve as a viable alternative to the conventional alphanumeric password-based authentication method, which is susceptible to known weaknesses arising from user-generated passwords of this nature. The test proposed in this study is based on estimating the distributions of the perimeter of the convex hull, based on the hypothesis that the perimeter of the convex hull of a set of five clustered points is smaller than the one formed by random points. This convex hull is computed based on the points that users select as passwords within an image measuring 1920 × 1080 pixels, using the built-in function convhull in Matlab R2018a relying on the Qhull algorithm. The test was formulated by choosing the optimal distribution that fits the data from a total of 54 distributions, evaluated using the Kolmogorov–Smirnov, Anderson–Darling, and Chi-squared tests, thus achieving the highest reliability. Evaluating the effectiveness of the proposed test involves estimating type I and II errors, for five levels of significance α∈{0.01,0.02,0.05,0.1,0.2}, by simulating datasets of random and clustered graphical passwords with different levels of clustering. In this study, we compare the effectiveness and efficiency of the proposed test with existing tests from the literature that can detect this type of pattern in Passpoints graphical passwords. Our findings indicate that the new test demonstrates a significant improvement in effectiveness compared to previously published tests. Furthermore, the joint application of the two tests also shows improvement. Depending on the significance level determined by the user or system, the enhancement results in a higher detection rate of clustered passwords, ranging from 0.1% to 8% compared to the most effective previous methods. This improvement leads to a decrease in the estimated probability of committing a type II error. In terms of efficiency, the proposed test outperforms several previous tests; however, it falls short of being the most efficient, using computation time measured in seconds as a metric. It can be concluded that the newly developed test demonstrates the highest effectiveness and the second-highest efficiency level compared to the other tests available in the existing literature for the same purpose. The test was designed to be implemented in graphical authentication systems to prevent users from selecting weak graphical passwords, enhance password strength, and improve system security.

Penyalahgunaan Data Pribadi Sebagai Bentuk Kejahatan Sempurna Dalam Perspektlf Hukum Siber

The misuse of personal data has become a highly relevant issue in the digital age, where cases of privacy violations are increasing sharply. Personal data such as contact information, transaction history, and online activities have become prime targets for cybercriminals to use for fraud, identity theft, and even political manipulation. These crimes often occur in various locations around the world, taking advantage of regulatory breaks and jurisdictional differences, making law enforcement difficult. To address this problem, a multi-dimensional approach is required. Stricter regulations, such as the General Data Protection Regulation (GDPR) in the European Union, are needed to protect personal data with strict sanctions for violations. In addition, international collaboration is essential as cybercrime often crosses national borders, requiring close cooperation between countries to track and apprehend perpetrators. Public awareness and education are also key components in reducing the risk of cybercrime. People should be encouraged to take proactive measures such as the use of strong passwords and two-step verification. Companies and service providers also need to take responsibility for customer data security by implementing strong protection measures and transparency in data management. In conclusion, the use of personal data as a form of perfect crime is a complex issue, requiring strict regulation, international collaboration, and awareness raising to create a safer digital environment.

Comparing experts’ and users’ perspectives on the use of password workarounds and the risk of data breaches

Purpose The increased use of Information Systems (IS) as a working tool for employees increases the number of accounts and passwords required. Despite being more aware of password entropy, users still often participate in deviant password behaviors, known as “password workarounds” or “shadow security.” These deviant password behaviors can put individuals and organizations at risk, resulting in a data breach. This paper aims to engage IS users and Subject Matter Experts (SMEs), focused on designing, developing and empirically validating the Password Workaround Cybersecurity Risk Taxonomy (PaWoCyRiT) – a 2x2 taxonomy constructed by aggregated scores of perceived cybersecurity risks from Password Workarounds (PWWAs) techniques and their usage frequency. Design/methodology/approach This research study was a developmental design conducted in three phases using qualitative and quantitative methods: (1) A set of 10 PWWAs that were identified from the literature were validated by SMEs along with their perspectives on the PWWAs usage and risk for data breach; (2) A pilot study was conducted to ensure reliability and validity and identify if any measurement issues would have hindered the results and (3) The main study data collection was conducted with a large group of IS users, where also they reported on coworkers' engagement frequencies related to the PWWAs. Findings The results indicate that statistically significant differences were found between SMEs and IS users in their aggregated perceptions of risks of the PWWAs in causing a data breach, with IS users perceiving higher risks. Engagement patterns varied between the two groups, as well as factors like years of IS experience, gender and job level had statistically significant differences among groups. Practical implications The PaWoCyRiT taxonomy that the we have developed and empirically validated is a handy tool for organizational cyber risk officers. The taxonomy provides organizations with a quantifiable means to assess and ultimately mitigate cybersecurity risks. Social implications Passwords have been used for a long time to grant controlled access to classified spaces, electronics, networks and more. However, the dramatic increase in user accounts over the past few decades has exposed the realization that technological measures alone cannot ensure a high level of IS security; this leaves the end-users holding a critical role in protecting their organization and personal information. Thus, the taxonomy that the authors have developed and empirically validated provides broader implications for society, as it assists organizations in all industries with the ability to mitigate the risks of data breaches that can result from PWWAs. Originality/value The taxonomy the we have developed and validated, the PaWoCyRiT, provides organizations with insights into password-related risks and behaviors that may lead to data breaches.

Empowering college students with personal privacy protection and anti-fraud on the internet: A comprehensive learning approach

As college students increasingly navigate their academic pursuits and social lives through the digital realm, safeguarding personal privacy on the internet becomes a pressing concern. For example, deep forgery technology has further increased personal privacy concerns. This technique can produce fake videos, pictures, and sounds that are highly realistic, making it a tool for the misuse of personal and sound data. Several artificial intelligences (AI) systems require large amounts of data for training and improvement, which can involve collecting and storing sensitive personal information. If this data is not adequately protected, and there is no clear privacy policy, it may lead to the misuse or disclosure of personal information. In response to the rapid development of artificial intelligence and the impact of deep forgery technology on privacy and security, this research first tested the students' understanding of deep forgery technology, then introduced the dangers of this technology, and finally gave them a reasonable and effective solution. To promote active learning, activities are integrated to simulate real-world scenarios that college students might encounter. These include creating strong passwords, identifying phishing attempts, and understanding the implications of oversharing on social media platforms. Additionally, students are encouraged to examine case studies documenting privacy breaches and their impact on individuals and society. This essay aims to present an effective learning approach for college students to enhance their understanding of personal privacy protection online and provide an effective way of solving personal problems.

Password Strength Evaluation via Zipf's Law and Password Entropy

Password Strength Evaluation via Zipf's Law and Password Entropy

ANALYSING MALICIOUS SOFTWARE SUPPORTING DDOS ATTACKS ON IOT NETWORKS

Background. With the proliferation of Internet of Things (IoT) networks in the digital age, the risk of cyberattacks, especially DDoS attacks, is also increasing. IoT devices such as smart refrigerators, thermostats, webcams and other Internet-connected home appliances are being targeted by attackers who can use them as part of a botnet to conduct DDoS attacks. These devices often have inadequate network security and are rarely updated, making them vulnerable. DDoS attacks can result in significant losses such as lost revenue, reputational damage and costs to restore services. So, the vulnerability of IoT networks to DDoS attacks and the need to develop effective protection measures is a pressing issue. Objective. The purpose of the paper is to analyse software that supports DDoS attacks in IoT networks. Provide general recommendations to help improve approaches to defence measures in IoT networks against DDoS-enabled malware. Methods. Five main DDoS attack models are considered: agent-handler model, reflexive model, IRC-based model, web-based model, and P2P-based model. Three most dangerous software capable of DDoS attacks on IoT networks are analyzed: Mirai, XOR.DDoS and Linux.Hydra. Results. There are many models and methods of DDoS attacks on IoT networks. The most dangerous are Mirai, XOR.DDoS and Linux.Hydra. Each of these software has its own specific characteristics and methods of carrying out attacks. The study also showed that there are several effective measures to counter these attacks, including setting strong passwords, regularly updating software, setting up traffic filters and restricting network access. Conclusions. Key aspects of DDoS attacks, their models and process steps are considered. The paper focuses on the three most dangerous software used to conduct such attacks and provides recommendations on how to counteract them.

Evaluation of Password Security Compliance Using Nist SP 800-63

Evaluation of Password Security Compliance Using Nist SP 800-63