Abstract. Graphical passwords (GPs) that authenticate users using images are considered as one potential alternative to overcome the issues of traditional textual passwords. Based on the idea of utilizing an extremely large image, map-based GPs like PassMap and GeoPass have been developed, where users can select their secrets (geographical point) on a world map. In particular, PassMap allows users to select two locations on a map, while GeoPass reduces the location number to only one. At first glance, selecting one location is more vulnerable to attacks, while increasing the location number may add burden on users. In the literature, there is no research exploring this issue. Motivated by this, our purpose in this work is to explore the effect of location number between PassMap and GeoPass in terms of users' performance and feedback. In this work, we develop a generic and open platform for realizing map-based schemes, and conduct a user study with 60 participants, which reveals that selecting two locations would not degrade the scheme performance. Our effort aims to complement exiting research studies in this area.
Security researchers who jailbreak iOS devices had crowdsourced for system level vulnerabilities [1] for iOS. However, their success depended on whether a particular device owner encountered a crash in system-level code. To conduct voluntary security testing, Black-box fuzzing is one of the ideal low-cost and simple technique to find system level vulnerabilities for the less technical crowd. However, it is usually not the most effective method due to the large fuzzing space. At the same time, when fuzzing mobile devices such as today's smartphones, it is extremely time consuming to instrument mobile devices of varying versions of system software across the world. In this paper, we describe Mobile Vulnerability Discovery Pipeline (MVDP), a semi-automated, vulnerability discovery pipeline for mobile devices. MVDP is a carefully crafted process targeted to produce malicious output that is more likely to crash the target leading to vulnerability discovery. MVDP employs a few novel black-box fuzzing techniques such as distributed fuzzing, parameter selection, mutation position optimisation and selection of good seed files. To date, MVDP has discovered around 1900 crashing inputs and helped to identify 7 unique vulnerabilities across various Android and iOS phone models.
Nowadays, smartphones are widely adopted in people's daily lives. With the increasing capability, phone charging has become a basic requirement and a large number of public charging facilitates are under construction for this purpose. However, public charging stations may open a hole for cyber-criminals to launch various attacks, especially charging attacks, to steal phone user's private information. Juice filming charging (JFC) attack is one such threat, which can refer users' sensitive information from both Android OS and iOS devices, through automatically monitoring and recording phone screen during the whole charging period. Due to the potential damage of JFC attacks, there is a need to investigate its influence in practical scenarios. Motivated by this, in this work, we firstly conduct a large user survey with over 2500 participants about their awareness and attitude towards charging attacks. We then for the first time investigate the impact of JFC attack under three practical scenarios. Our work aims to complement the state-of-the-art and stimulate more research in this area.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.