Password Theft Research Articles

English

English

Secured Password Technique Using Devices

Text based password is most commonly used user authentication .To log on to websites, users must memorize the selected password. Password based authentication can resist brute force and dictionary attacks, if they select a stronger password but users often select weak password for their convenience and remembrance. They reuse password in different sites for simplicity, it would make the attacker to find their passwords in different sites. These are caused by the negative impact of human behavior. Typing password on untrusted computers suffers from stealing of password i.e. shoulder surfing. Then researchers have designed graphical password which made attackers to find out the commonly selective areas (Hotspots). Some researchers have focused on three-factor authentication for reliability and depends on password, token, biometric. For this authentication, the user must input a password and provide a pass code generated by the token, and scan her biometric features (e.g., fingerprint). This is a comprehensive defense mechanism against password stealing attacks, but it requires high cost. Another user authentication is Opass, which uses a cell phone to enter the password. The password that is entered by the user is converted to a one-time password and in this system it provides more security by enabling a encryption for the converted one-time password. By using the cell phone and providing an encryption, the security can be increased. This would reduce the user from remembering from many passwords and thus reduce the password stealing. The user can then successfully enter to their website and enjoy the accessibility. This reduces the negative influence of human factors compared to previous schemes, and is the first user authentication protocol to prevent password stealing (i.e., phishing, keylogger, and malware) and also prevent password reuse attacks simultaneously.

GESTURE BASED TOUCHPAD SECURITY SYSTEM WITH DESIGN OF TOUCH SCREEN CONTROLLER

The purpose of the project is to present a new approach on the design of security systems by using a touch sensitive device. Security is a permanent concern in a variety of environments ranging from physical access restriction in home and industrial settings to information security in digital systems. Numeric passwords, fingerprint recognition, and many other techniques have been extensively implemented in the past but they present certain drawbacks. The proposed technique makes use of a touch device to recognize symbols as passwords and takes time into account to add a new dimension and prevent password theft. We implemented a prototype that demonstrates the capabilities of the proposed security approach by showing one direct application in physical access restriction systems.

Password multimodality method in financial transactions

In financial transactions,some safety and reliability problems exist in the client authentication system with single keyboard password mode.To solve these problems,the password multimodality method was proposed.Modal sensors accessed the password codeword information and transmitted its normalized result.The formatted code information was pre-processed in property and then classified by its attributes.After that,the multimode passwords were fused through sharing public units.For a certain M bits password,if each bit had N kinds of possible modals,the password theft rate was 1/(10MCN×MM).In this multimode input system,the keyboard password and black box handwriting are the two default modals,and the application results demonstrate that the proposed method realizes the disordered blending input of multimodal password codeword.At M=6,the password theft rate is 1/(106C2×66),and the method types and difficulty of cracking those passwords increase with the number of modals.The password input system's safety,reliability and other performances are significantly better than those with only one modal.

Implementation of Efficient Audit Service Outsourcing for Data Integrity by Interfacing the Mobile Device in Clouds

computing provide much more effective computing by centralized memory processing, storage and bandwidth. The problem in cloud computing is that they are facing a potentially formidable risk for missing or corrupted data. Third party auditor should be able to efficiently audit the cloud data storage without demanding the local copy of data. DES algorithm can use for encryption in CSP. In this paper, we propose to implement the mobile devices that can be interfaces in between the Cloud Service Provider and Third party Agent to avoid the delay in sending the modification done in the data storage to the cloud and also client's owner. Also we implement a user authentication protocol named oPass which leverages a user's cell phone and short message service (SMS) to prevent password stealing and password reuse attacks in cloud computing we demonstrate to decrease the delay through mobile device. Our simulation results for the cost, computational and communication overhead can perform more effective in cloud computing.

Defend a System against Keyloggers with a Privilege-Limited Account

Nowadays keystroke logging is one of the most widespread threats used for password theft. In this paper, rather than detecting existing malware or creating a trusted tunnel in the kernel, we present a method called Broker to protect the password that a user provides for a web page to login to a web service. Installing such solutions in a host only requires limited privileges of related computers. The Broker method uses a second device and the Broker server to safely transfer users’ account-related information. Comparing with previous work, the Broker method successfully separates user names and passwords so that even a second device and the Broker server are compromised, users still will not leak their private information to attackers. Finally, the Broker method can be applied to all websites without any modification of them.

OPass: A User Authentication Protocol Resistant to Password Stealing and Password Reuse Attacks

Text password is the most popular form of user authentication on websites due to its convenience and simplicity. However, users' passwords are prone to be stolen and compromised under different threats and vulnerabilities. Firstly, users often select weak passwords and reuse the same passwords across different websites. Routinely reusing passwords causes a domino effect; when an adversary compromises one password, she will exploit it to gain access to more websites. Second, typing passwords into untrusted computers suffers password thief threat. An adversary can launch several password stealing attacks to snatch passwords, such as phishing, keyloggers and malware. In this paper, we design a user authentication protocol named oPass which leverages a user's cellphone and short message service to thwart password stealing and password reuse attacks. oPass only requires each participating website possesses a unique phone number, and involves a telecommunication service provider in registration and recovery phases. Through oPass, users only need to remember a long-term password for login on all websites. After evaluating the oPass prototype, we believe oPass is efficient and affordable compared with the conventional web authentication mechanisms.

Is Everything We Know About Password-Stealing Wrong?

US Federal Reserve Regulation E guarantees that consumers are made whole when their bank passwords are stolen. The implications lead to several interesting conclusions. First, emptying accounts is extremely hard: transferring money in a way that is irreversible can generally only be done in a way that cannot later be repudiated. Password-enabled transfers can always be repudiated, which explains the importance of mules who accept bad transfers and initiate good ones. This suggests that the mules' accounts, rather than the victims', are pillaged. Passwords are but one link in the cybercrime value chain. Despite appearances, password stealing is a bad business proposition.

Simplified Native Language Passwords for Intrusion Prevention

Authentication is necessary in multi-user systems. User name and password are used to authenticate a user. Textual passwords are most common type used for authentication. Authentication schemes that use textual passwords are vulnerable to attacks password stealing, dictionary attack and shoulder surfing. Graphical passwords provide an alternative to graphical passwords but, simple schemes are vulnerable to shoulder surfing and hidden cameras. Native language passwords can be used for authentication and the user can remember it better than any other language. A shape based textual authentication is discussed in this paper and simplification of the native language passwords is proposed. Session passwords are generated for each login, making the authentication scheme more resistant to shoulder surfing and hidden camera attacks.

Using one-time passwords to prevent password phishing attacks

Phishing is now a serious threat to the security of Internet users' confidential information. Basically, an attacker (phisher) tricks people into divulging sensitive information by sending fake messages to a large number of users at random. Unsuspecting users who follow the instruction in the messages are directed to well-built spoofed web pages and asked to provide sensitive information, which the phisher then steals. Based on our observations, more than 70% of phishing activities are designed to steal users' account names and passwords. With such information, an attacker can retrieve more valuable information from the compromised accounts. Statistics published by the anti-phishing working group (APWG) show that, at the end of Q2 in 2008, the number of malicious web pages designed to steal users' passwords had increased by 258% over the same period in 2007. Therefore, protecting users from phishing attacks is extremely important. A naïve way to prevent the theft of passwords is to avoid using passwords. This raises the following question: Is it possible to authenticate a user without a preset password? In this paper, we propose a practical authentication service that eliminates the need for preset user passwords during the authentication process. By leveraging existing communication infrastructures on the Internet, i.e., the instant messaging service, it is only necessary to deploy the proposed scheme on the server side. We also show that the proposed solution can be seamlessly integrated with the OpenID service so that websites supporting OpenID benefit directly from the proposed solution. The proposed solution can be deployed incrementally, and it does not require client-side scripts, plug-ins, nor external devices. We believe that the number of phishing attacks could be reduced substantially if users were not required to provide their own passwords when accessing web pages.

Cyber Cruelty: Understanding and Preventing the New Bullying

As adolescents increasingly adopt cell phones, smart phones, and the Internet as tools for communication and social networking, they can become victims of the growing trend of cyberbullying - targeted harm inflicted through such technology. These forms of technology are often strange and unfamiliar to parents, teachers, and medical and mental health providers. This review article provides an introduction to cyberbullying, tools for screening, and opportunities for prevention. A mother brings her middle school student to a therapist because he is skipping school and isolating himself in his room; on interview he reveals he has been receiving threatening text messages and insulting MySpace comments from peers at school. A high school girl has been cutting herself with a razor and purging, and reveals to the clinician that a year ago her ex-boyfriend circulated a naked photo of her throughout her school. A young client's mother asks the therapist how to confront racial slurs that the client's classmates are posting on his Facebook page. These case scenarios underscore the ways in which clinicians are increasingly confronted with cyberbullying. The rapid worldwide adoption of the Internet, cell phones, and other new technology in the past two decades has revolutionized business, education, and sharing of ideas, religious or political beliefs, or sexual identity. Young people have become the Cyber Immersion Generation, as cyber technology becomes central to their daily life (Englander and Muldowney, 2007). The dark side of this useful technology is the rise of cyberbullying. Cyberbullying has been difficult to consistently define, due to constantly changing technology, but involves targeted harm inflicted through the use of text or images sent via the Internet, cell phones or other communication devices. It includes embarrassing or threatening text messages or instant messenger (IM) messages, electronic stalking, password theft or masquerading as another young person on social networking sites like MySpace or Facebook, distribution of embarrassing or sexual photographs or video (including sexting - sending sexually explicit photos via text message - and posting online footage of fights and assaults), creation of websites or Facebook pages devoted to criticizing one teen or to ranking the fattest or sluttiest kid in school, and even death threats delivered online. Teachers and administrators may even find themselves targets.

Shields Up! Protecting browsers, endpoints and enterprises against web-based attacks

Browser-based malware attacks have become increasingly common, and the packing of legitimate websites using techniques such as SQL injection and FTP password theft has led to a proliferation of bot-infected machines. How can users protect themselves against such threats? Virtualising the browser can help to provide detection by inserting a virtual layer between the application and the operating system. This article describes the mechanics of popular Web-based attacks, and looks at the idea of a virtual shield to help protect unwitting surfers from danger. What do security technology and Norman Britain have in common? Well, the former may have come a long way in the last 850 years, but we can still learn a thing or two from the latter, and apply it accordingly.

Virtually secure? [virtual machine

The argument for virtualisation as a security tool makes perfect sense: however it is delivered, malware generally attacks the underlying operating system. It installs software to carry out a malware writer's goals, which are largely criminal, consisting of spam distribution, password stealing, and account harvesting. But in a virtualised environment, the operating system becomes nothing more than a file - a movable, replaceable entity. Operating systems in virtualised environments are delivered as virtual machines (VMs). If something goes wrong with the VM - if it gets compromised by malware, for example - then the idea is that it won't affect any other operating systems that you run atop that virtualised environment. If you're really worried about its security, you can remove it altogether and replace it with a fresh one, it's as simple as moving a file.

Why Johnny can't surf (safely)? Attacks and defenses for web users

In their seminal article “Why Johnny Can't Encrypt” [Whitten A, Tygar JD. Why Johnny can't encrypt: a usability case study of PGP 5.0. In: Proceedings of the eighth USENIX security symposium; August 1999.], Whitten and Tygar showed that usability weaknesses of encryption software may result in failure to protect users, in spite of good cryptography. A similar situation happens, on a huge scale, on the Web: the widely deployed SSL/TLS protocols provide good cryptography, yet there is a growing amount of successful attacks on web users, causing massive damages. In this article, we focus on password theft via fake websites, to which we refer as phishing. We believe that phishing is currently the most severe threat facing web users. We begin with a brief review of SSL/TLS. Many sensitive sites do not use SSL/TLS, or use it incorrectly (e.g. to encrypt password, filled into an unprotected login form); we explain why. Even if sites use SSL/TLS (correctly), this may not be enough to prevent phishing – at least, using the basic security and identification indicators of most browsers (URL, padlock and HTTPS). We discuss basic and advanced indicators, and their usability problems. We review recent usability studies, whose results are rather alarming, and put in question the ability of users to avoid phishing sites based on security and identification indicators.

Safe and Secure Services Based on NGN

Next Generation Network (NGN), which has been undergoing standardization as it has developed, is expected to create new services that converge the fixed and mobile networks. This paper introduces the basic requirements for NGN in terms of security and explains the standardization activities, in particular, the requirements for the security function described in Y.2701 discussed in ITU-T SG-13. In addition to the basic NGN security function, requirements for NGN authentication are also described from three aspects: security, deployability, and service. As examples of authentication implementation, three profiles—namely, fixed, nomadic, and mobile—are defined in this paper. That is, the “fixed profile” is typically for fixed-line subscribers, the “nomadic profile” basically utilizes WiFi access points, and the “mobile profile” provides ideal NGN mobility for mobile subscribers. All three of these profiles satisfy the requirements from security aspects. The three profiles are compared from the viewpoint of requirements for deployability and service. After showing that none of the three profiles can fulfill all of the requirements, we propose that multiple profiles should be used by NGN providers. As service and application examples, two promising NGN applications are proposed. The first is a strong authentication mechanism that makes Web applications more safe and secure even against password theft. It is based on NGN ID federation function. The second provides an easy peer-to-peer broadband virtual private network service aimed at safe and secure communication for personal/SOHO (small office, home office) users, based on NGN SIP (session initiation protocol) session control.

Exploring MBR rootkits

Cyber-crime today is a well-organised business that relies on stealth. Malware infections are intended to obtain financial benefits through password theft, spamming, advertising, and so on. That is why security companies have been talking about a silent epidemic for some time. The epidemic is there, but users are unaware.

Intrusion Detection Systems: Threats, Taxonomy, Tuning

An intrusion is defined as any set of actions that attempts to compromise the integrity, the confidentiality, or the availability of a resource. Following the pioneering work of Anderson in 1980 it has been recognised that while computer systems and networks need to be protected from unauthorised external access, using firewalls for example, it is not possible to provide an unconditional guarantee of invulnerability to intrusion. There are a number of reasons for this. One is the extreme diversity of intrusions observed, for example password stealing and cracking, masquerade and sniffer attacks, subversion of security controls (via trapdoors, Trojans etc), denial of service attacks, and malicious codes (viruses, worms, Trojans, logic bombs etc). Another reason is that over 70 per cent of attacks on networks are believed to be internal in origin.