Shoulder Surfing Research Articles

Finding and Mitigating a Vulnerability of the Color Wheel PIN Protocol

There is an increasing usage in the banking sector of Smartphones enabled with Near Field Communication (NFC), to improve the services offered for the customers. This usage requires a security enhancement of the systems that employ this technology like the Automated Teller Machines (ATMs). One example is the Color Wheel Personal Identification Number (CWPIN) security protocol designed to authenticate users on ATMs using NFC enabled smartphones without typing the PIN code directly. CWPIN has been compared in the literature to several other protocols and was considered easier to use, more cost-effective and more resistant to various attacks on ATMs such as card reader skimming, keylogger injection, shoulder surfing, etc. Nevertheless, we demonstrate in this paper that CWPIN is vulnerable to the multiple video recordings intersection attack. We do so through concrete examples and a thorough analysis that reveals a high theoretical probability of attack success. A malicious party can use one or two hidden cameras to record the ATM and smartphone screens during several authentication sessions, then disclose the user's PIN code by intersecting the information extracted from the video recordings. In a more complex scenario, these video recordings could be obtained by malware injected into the ATM and the user's smartphone to record their screens during CWPIN authentication sessions. Our intersection attack requires a few recordings, usually three or four, to reveal the PIN code and can lead to unauthorized transactions if the user's smartphone is stolen. We also propose a mitigation of the identified attack through several modifications to the CWPIN protocol and discuss its strengths and limitations.

ShouldAR: Detecting Shoulder Surfing Attacks Using Multimodal Eye Tracking and Augmented Reality

Shoulder surfing attacks (SSAs) are a type of observation attack designed to illicitly gather sensitive data from "over the shoulder" of victims. This attack can be directed at mobile devices, desktop screens, Personal Identification Number (PIN) pads at an Automated Teller Machine (ATM), or written text. Existing solutions are generally focused on authentication techniques (e.g., logins) and are limited to specific attack scenarios (e.g., mobile devices or PIN Pads). We present ShotjldAR, a mobile and usable system to detect SSAs using multimodal eye gaze information (i.e., from both the potential attacker and victim). ShouldAR uses an augmented reality headset as a platform to incorporate user eye gaze tracking, rear-facing image collection and eye gaze analysis, and user notification of potential attacks. In a 24-participant study, we show that the prototype is capable of detecting 87.28% of SSAs against both physical and digital targets, a two-fold improvement on the baseline solution using a rear-facing mirror, a widely used solution to the SSA problem. The ShouldAR approach provides an AR-based, active SSA defense that applies to both digital and physical information entry in sensitive environments.

Cue-based two factor authentication

With the increasing usage of cameras, the threat from video attacks has greatly increased in recent years in addition to shoulder surfing. Many organizations have implemented two-factor authentication to enhance security. However, attackers can still steal users' usernames and passwords from two-factor authentication through video attack or shoulder surfing and applied the credential stuffing attack, as most people use the same passwords on different applications. Cue-based authentication provides high protection against shoulder surfing attacks, but it remains vulnerable to video attacks. To mitigate the threats of video attacks, we propose cue-based two-factor authentication (i.e., Cue-2FA), which is distinct from other methods by separating cue display from response input (refer to Chapter 1). We conducted two user studies to compare the usability and security between Cue-2FA and a standard Time-based-One-Time-Password two-factor authentication (i.e., TOTP-2FA). The evaluate results revealed Cue-2FA provides both higher usability and stronger resistance to the shoulder surfing attack. However, when both the cue and response are recorded, Cue-2FA is not more resistant to the video attack than TOTP-2FA. To address this issue, we introduced misleading operations to Cue-2FA when inputting a response, which significantly improves the resistance to the video attack.

The effects of persuasion principles on perceived honesty during shoulder surfing attacks

Purpose This study aimed to investigate how honest participants perceived an attacker to be during shoulder surfing scenarios that varied in terms of which Principle of Persuasion in Social Engineering (PPSE) was used, whether perceived honesty changed as scenarios progressed, and whether any changes were greater in some scenarios than others. Design/methodology/approach Participants read one of six shoulder surfing scenarios. Five depicted an attacker using one of the PPSEs. The other depicted an attacker using as few PPSEs as possible, which served as a control condition. Participants then rated perceived attacker honesty. Findings The results revealed honesty ratings in each condition were equal during the beginning of the conversation, participants in each condition perceived the attacker to be honest during the beginning of the conversation, perceived attacker honesty declined when the attacker requested the target perform an action that would afford shoulder surfing, perceived attacker honesty declined more when the Distraction and Social Proof PPSEs were used, participants perceived the attacker to be dishonest when making such requests using the Distraction and Social Proof PPSEs and perceived attacker honesty did not change when the attacker used the target’s computer. Originality/value To the best of the authors’ knowledge, this experiment is the first to investigate how persuasion tactics affect perceptions of attackers during shoulder surfing attacks. These results have important implications for shoulder surfing prevention training programs and penetration tests.

Password Managers Use Among Individuals Who Are Visually Impaired: Awareness, Adoption, and Rejection

Little research has examined the aspects of PMs’ use among individuals who are blind or visually impaired (BVI) who face extra challenges while entering credentials, such as low typing rates, low typing accuracy, shoulder surfing attacks, and verification of the entered data. This paper explores how knowledgeable BVI individuals are of digital security threats; the status of accessibility in security software; awareness of PMs among BVI; and the factors that drive rejection or adoption of PMs. Our findings revealed that the self-reported knowledge of digital security threats is high; there are many accessibility shortcomings in various security software; and the awareness of PMs among BVI individuals is relatively high, although actual use is far less. About 1/4-th of the participants in the study who tried using PMs rejected them. We found that inaccessibility, cross-platform differences, and security concerns as the top rejection factors. By contrast, convenience, effort saving, and accuracy were the primary adoption factors.

Eye Based Secure Authentication System

Abstract: Personal identification numbers are commonly utilized for user verification and enhanced security. When users authenticate passwords through PINs, they must be obligatory to physically input the PIN, making them susceptible to password cracking techniques like shoulder surfing or thermal tracking. In contrast, utilizing hands-off gaze-based PIN entry methods eliminates any physical traces, providing a significantly more secure option for password entry. Gaze-based authentication involves determining the eye location across consecutive image frames and continuously tracking the precise eye center.

Secure authentication scheme to thwart known authentication attacks using Mobile Device

Recently, the use of two-factors authentication (2FA) has increased to mitigate the risk of stealing user credentials. Most of 2FA use a mobile device to complete the authentication process, but many of them require an Internet connection or a subscriber identity module (SIM) chip to activate the synchronization of the One Time Password (OTP), which may not be guaranteed all the time or may not be equipped in the user's phone in the first place. Thus, this paper attempts to overcome this problem by adopting the camera of the mobile device and QR code to verify the OTP instead of relying on the Internet connection or cellular network. The proposed approach involves encrypting keys and secret codes with symmetric and asymmetric keys for added security, and using QR to exchange those codes fast and more easily, including a code suffix to prevent phishing attacks. Security analysis proves that the scheme is immune to many well-known attacks such as MITM, Shoulder surfing Keylogger, Phishing Attacks, etc. This scheme could contribute to adding a secure, practical, and easy-to-use option to diversify of 2FA if it is adopted by service providers such as Google, Meta, and Microsoft. Keywords: Authentication; Two-Factor Authentication (2FA); Mobile device ; One-Time-Password (OTP); Challenge Response Protocol and Quick Response (QR) Code

Graphical Password Scheme Based on Color Hint Approach

Generally, textual password is the most used kind of authentication technique. However, this authentication type is vulnerable to a lot of attacks. Users using this kind of authentication techniques are at the risk of exposing vital organizational data or even password to attacks such as phishing, shoulder surfing, brute force and dictionary attacks etc. This is the major reason why a new authentication type is required, in other to minimize these threats or attacks, graphical authentication techniques were developed. But this authentication also faces attacks such as shoulder surfing and guessing attacks etc. In this paper, a graphical password scheme based on color hint approach has been developed and analyzed. The scheme authenticates users in two different ways which are: using an image to select different password click points and using secret color hint and transparent shapes as a way for the user to know the position of the click points after it had been reshuffled on the selected image. The project will be limited to the reliability, efficiency, ease of use and friendliness of graphical user interface during the user authentication. The system has been able to minimize or reduce the problem of shoulder surfing and guessing attacks.

Research of the potential impact of social engineering on digital transformation processes

Digital transformation reflects the process of transition of society and business to new technologies in order to improve operations and provide new opportunities. This process includes the introduction of artificial intelligence, the Internet of Things, cloud services, and many other technologies to improve business results. Such a transition promises us a number of advantages, including: flexibility and efficiency of digital processes due to total computerization; increasing the efficiency of production processes due to the Internet of Things, cloud computing and automation; improving interaction with customers based on artificial intelligence. This is far from a complete list of Digital Transformation technologies. But no matter how many technologies appear in the future, all of them, along with their advantages, create new challenges for cyber security, including those based on social engineering methods. Social engineering is manipulative and deceptive methods used to obtain confidential information, access systems, or gain control over people through the use of psychological and social mechanisms. The article examines known cases of cyberattacks using social engineering. It is shown that neither small nor large companies are immune from social engineering. The basic model of social engineering, which is based on the tendency of people to transfer all information and perform illogical actions, was studied. Social engineering technologies were analyzed: Pretexting, Phishing, Road apple, Shoulder surfing, Service for service. Potential threats from social engineering methods for systems: SCADA, Cloud Computing, Internet of Things, Drones, Big Data, Blockchain, Artificial Intelligence and Social Networks are assessed. The key means of countering social engineering in the era of digital transformation have been identified. Conclusions are made regarding the impact of social engineering in the future.

Combination of Alphanumeric Password and Graphic Authentication for Cyber Security

The main objective of this research is to create a more secure and user-friendly password-generation method that is less vulnerable to attacks such as shoulder surfing. Similarly, while textual or alphanumeric passwords are not entirely secure, they also come with certain limitations, including issues related to memory. The novelty of this research is the development of a new algorithm (Secure Password Algorithm/SPA) for password generation that uses graphics to generate textual input from users based on user perceptions. This method is more resilient against attacks like shoulder surfing and offers a more secure and user-friendly way of creating passwords. This research uses a combination of literature review and SPA proposals to create passwords with graphical and encryption techniques. The literature review examines the weaknesses of existing graphical and text password methods. The proposed algorithm focuses on user perception and confidential data to create more secure and easy-to-use passwords. The research results show that this research can provide a new, more secure, and user-friendly method of generating passwords such as shoulder surfing. Research supports software implementation of these algorithms and psychometric, psychological, and psychiatric studies to improve user input and protect systems from malicious attacks. Graphical passwords provide better recall compared to textual passwords, and the proposed algorithm for password generation using graphical and encryption techniques provides a more secure and user-friendly method of password generation that is less vulnerable to attacks such as shoulder surfing. The proposed new encryption algorithm has succeeded in overcoming various potential weaknesses and attacks on previous encryption methods. The test results demonstrate the efficiency and near invulnerability of the SPA algorithm against brute force attacks on specific security parameters. Tested alongside AES, shows comparable security levels, particularly in resource-constrained environments. To address doubts, the paper establishes evaluation standards for computational complexity, resistance to known attacks, and adaptability to evolving threats. The algorithm has the potential to be a stronger and more secure solution for generating passwords to safeguard confidential user information.

Pattern unlocking guided multi‐modal continuous authentication for smartphone with multi‐branch context‐aware representation learning and auto encoder

AbstractWidely accepted explicit authentication protocols are vulnerable to a series of attacks, for example, shoulder surfing and smudge attacks, leaving users with the constant burden of periodic password changes. As such, we propose a novel framework for continuous authentication on smartphones. This approach is guided by pattern unlocking, which is widely used and will not cause learning cost. After collecting multi‐modal data that describe both behavioral and contextual information, we employ a multi‐branch context‐aware attention network as the representation learner to perform feature extraction, then an auto encoder is then used for authentication. To overcome challenges, including cold‐start and few‐shot training, which is less discussed in other works, we incorporate transfer learning with a coarse‐to‐fine pre‐training workflow. Additionally, we deploy a hierarchical approach to offload model tuning overhead from smartphones. Extensive experiments on more than 68 000 real‐world recordings validate the effectiveness of the proposed method, with an EER (equal error rate) of 2.472% under mixed contexts, which consistently outperforms state‐of‐the‐art approaches under both static and mixed contexts.

Social engineering

The realm of cybersecurity is replete with challenges, not least among them being the art of social engineering. This form of attack leverages human tendencies such as trust, leading to potential breaches. Though more covert than brute force or technical hacks, social engineering can be insidiously effective. Within this exposition, we probe various manifestations of social engineering: from phishing to pretexting, baiting to tailgating, and the subtle act of shoulder surfing, concluding with mitigation strategies.

Role of Shoulder Surfing in Cyber Security (Experimental Study to the Comparative Framework)

Role of Shoulder Surfing in Cyber Security (Experimental Study to the Comparative Framework)

The Assistance of Eye Blink Detection for Two- Factor Authentication

This paper discusses the implementation of a blink detection method using 68 facial markers and the eye aspect ratio (EAR) to provide strong protection for access systems. It investigates the importance of 68 facial markers and explores how to use eye landmarks to calculate the eye aspect ratio. Access systems, which should have good security measures and be difficult to decipher, are typically safeguarded by passwords or multi-factor verification, such as passwords combined with facial recognition. However, these methods have inherent weaknesses, including the risk of shoulder surfing with passwords and the potential to be deceived by fake face images with facial recognition. To address these issues, a two-factor authentication method by using password with eye blink recognition is proposed as an effective solution for access control. By incorporating real-time eye blinking action, the system can avoid the use of fake images and prevent shoulder spoofing. To demonstrate the practical application of eye blink detection for enhanced two-factor authentication, a web application called "Eblink" is introduced. Functional tests have been conducted to validate the application's core features.

An Advanced Knowledge Based Graphical Authentication Framework with Guaranteed Confidentiality and Integrity

The information and security systems largely rely on passwords,which remain the fundamental part of any authentication process. The conventional authentication method based on alphanumerical username and password suffer from significant disadvantages. The graphical password-based authentication system has recently been introduced as an effective alternative. Although the graphical schemes effectively generate the passwords with better flexibility and enhanced security, the most common problem with this is the shoulder surfing attack. This paper proposes an effective 3D graphical password authentication system to overcome such drawbacks. The system is based on the selection of click points for generating passwords. The proposed work involved a training phase for evaluating the model in terms of the success rate. The overall evaluations of the model in terms of password entropy, password space, login success rates, and prediction probability in the shoulder surfing and guessing attacks proved that the model is more confidential and maintains a higher range of integrity than the other existing models.

Development of keypads which use colors or shapes to prevent shoulder surfing

Development of keypads which use colors or shapes to prevent shoulder surfing

Secure two-factor mutual authentication scheme using shared image in medical healthcare environment

The cloud healthcare system has become the essential online service during the COVID-19 pandemic. In this type of system, the authorized user may login to a distant server to acquire the service and resources they demand, we need full security procedures that cover criteria such as authentication, privacy, integrity, and availability. The journey of security for any healthcare system starts with the authentication of users based on their privileges. Traditional user authentication mechanisms, such as password and personal identification number (PIN) typing, are vulnerable to malicious attacks like on/offline, insider, replay, guessing, and shoulder surfing. To address these issues, we proposed a secure authentication scheme that uses the authenticated delegating mechanism based on two factors: a one-time password and generating a secure variable vector from a legible user's digital image to enable the permission of a user through the back-end database of a cloud server. The proposed mutual authentication can protect the information against well-known attacks, ensure the user's privacy, and key management. Moreover, comparisons with existing schemes show that the proposed scheme supplies more privacy, security metrics, and resistance to attacks than the others while being more efficient in computation and communication costs.

Secure two-factor mutual authentication scheme using shared image in medical healthcare environment

The cloud healthcare system has become the essential online service during the COVID-19 pandemic. In this type of system, the authorized user may login to a distant server to acquire the service and resources they demand, we need full security procedures that cover criteria such as authentication, privacy, integrity, and availability. The journey of security for any healthcare system starts with the authentication of users based on their privileges. Traditional user authentication mechanisms, such as password and personal identification number (PIN) typing, are vulnerable to malicious attacks like on/offline, insider, replay, guessing, and shoulder surfing. To address these issues, we proposed a secure authentication scheme that uses the authenticated delegating mechanism based on two factors: a one-time password and generating a secure variable vector from a legible user's digital image to enable the permission of a user through the back-end database of a cloud server. The proposed mutual authentication can protect the information against well-known attacks, ensure the user's privacy, and key management. Moreover, comparisons with existing schemes show that the proposed scheme supplies more privacy, security metrics, and resistance to attacks than the others while being more efficient in computation and communication costs.

Secure and Memorable Authentication Using Dynamic Combinations of 3D Objects in Virtual Reality

As Virtual Reality (VR) applications gain popularity, the need for a secure, usable, and memorable user authentication method becomes crucial. However, security and privacy in such VR applications are often ignored. Current methods are insufficient in preventing man-in-the-room (MITR) attacks, which allow attackers to observe user interactions in VR while remaining invisible, and inputted passwords can easily be stolen. In this study, we propose a dynamic combination of multi-attribute authentication methods for VR, where various 3D objects and their attributes can be created and displayed. Users must select combinations of 3D objects and their attributes provided by our designed principles for identity authentication. We explore the impact of method parameters on security and provide three specific parameter schemes to deploy the practical authentication system. We designed three user studies to evaluate the usability, security, and memorability of our authentication system. The results show that the proposed scheme can effectively resist both shoulder surfing and MITR attacks with unsuccessful attack rates of 100% and 95.83%, respectively. Furthermore, this research provides suggestions to secure VR applications while maintaining usability and enhancing the memorability of the authentication method.

Graphical Password Authentication: Image Grid Based Digital Lock for Mobile Apps

Abstract: Over the past few decades, research on authentication methods has advanced significantly. While the initial focus was on using standardised password selection and management approaches to secure textual passwords, this was made possible by learning about the flaws in the existing systems based on the attacks performed on the same systems' vulnerabilities. With the rise of biometric-based authentication, the next stage in the study and development of improved solutions has begun. Although initially rather entertaining, this authentication method is very insecure. Once a person's biometrics have been stolen or replicated, new biometrics cannot be made. Compared to a person's one-step biometric authentication, biometrics in the multifactor authentication of an enterprise are less vulnerable. The development of graphical passwords is the result of all these issues with authentication systems. While multifactor graphical passwords impede smartphone users' usability and speedier processing-computational flexibility, overly simplistic graphical passwords are prone to shoulder surfing. Users of Android devices need an authentication system that is easy to use, quick, secure, and that gains faster access to the device. A study was done evaluating the usability, predictability, resistance to various attacks, and other characteristics of various graphical passwords. Grid-based graphical passwords outperformed their rivals among the different types of graphical passwords that were taken into consideration. The majority of graphical password implementations in the past have been on personal computers (PCs), while smartphone usage is far more prevalent than on PCs. We propose to develop an Android application with gridbased image-based graphical password authentication that will be secure and help a lot of users protect the secondary identities that they carry about in the form of smartphones. After evaluating which factors must remain in the system, the application was divided into five modules. Each module was first built using flowcharts, and later, the Java programming language was used to build the app in Android Studio.