Centralized vs Decentralized Targeted Brute-Force Attacks: Guessing With Side-Information

Abstract

According to recent empirical studies, a majority of users have the same, or very similar, passwords across multiple passwordsecured online services. This practice can have disastrous consequences, as one password being compromised puts all the other accounts at much higher risk. Generally, an adversary may use any side-information he/she possesses about the user, be it demographic information, password reuse on a previously compromised account, or any other relevant information to devise a better brute-force strategy (so called targeted attack). In this work, we consider a distributed brute-force attack scenario in which m adversaries, each observing some side information, attempt breaching a password secured system. We compare two strategies: an uncoordinated attack in which the adversaries query the system based on their own side-information until they find the correct password, and a fully coordinated attack in which the adversaries pool their side-information and query the system together. For passwords X of length n, generated independently and identically from a distribution PX , we establish an asymptotic closed-form expression for the uncoordinated and coordinated strategies when the side-information Y (m) are generated independently from passing X through a memoryless channel P Y |X , as the length of the password n goes to infinity. We illustrate our results for binary symmetric channels and binary erasure channels, two families of side-information channels which model password reuse. We demonstrate that two coordinated agents perform asymptotically better than any finite number of uncoordinated agents for these channels, meaning that sharing side-information is very valuable in distributed attacks.

Information Security and Privacy in Smart Devices

“…The attacks' operators of social engineering attacks against KBA can be classified into two approaches. Social engineering attacks include social-based attacks (using psychological skills to collect KBA information) (Granger, 2001) (Salahdine & Kaabouch, 2019), and computer-based attacks (the use of sophisticated technical tools to obtain KBA information) (Krombholz, Hobel, Huber, & Weippl, 2015). In turn, depending on how the attack is conducted, social engineering attacks can be classified into three categories, physical, technical and socio-technical (or social) based attacks.…”

“…A brute force attack on KBA is the act of trial and error to gain access via trying multiple combinations of password. There are different forms of brute force attack to KBA including offline cracking attack (taking a password from a password storage file that has been recovered from the system) (Blocki, Harsha, & Zhou, 2018), letter frequency analysis attack (replace popular letters in ciphertext with common letters in the used language) (CRYPTO-IT, 2020), or targeted brute force attacks which primarily uses input dictionary creation programs and password guess generators (to target other accounts with previously compromised account details) (Tools, n.d.) (Salamatian, Huleihel, Beirami, Cohen, & M édard, 2020). Another form of brute force attack on KBA is rainbow table attack which enables the recovery feasibility of long, human chosen passwords, which computes hashes of the large set of available strings, rather than specifically calculating a hash function for every string present and comparing them to the target (ParthDutt, n.d.) (Marforio, Masti, Soriente, Kostiainen, & Capkun, 2016) (L. Zhang, Tan, & Yu, 2017).…”

Universal Randomized Guessing Subjected to Distortion

“…Thus, if the channel introduces erasures, the goal is to fill the missing gaps. In a sense, this model was extended by Salamatian et al in [43], where multiple guessers tried to fill the missing gaps, or correct errors introduced by the channel, using either a centralized or a decentralized approach. On the other hand, submitting guesses through a noisy channel was considered by Merhav in [51].…”

“…In [55], Sason derived bounds on the Rényi entropy of a function of a random variable, and applied them to derive non-asymptotic bounds on the difference between the exponent in guessing the original random variable, and that of guessing the (possibly non one-to-one) function. Several works considered guessing with side information [2,56,50,43,57]. Yona and Diggavi [58] considered the problem of guessing a word which has a similar hash function as the source word -a highly practical scenario as passwords are rarely stored as is, and only a hash is used.…”

“…From a practical viewpoint, this process applies in cases where a pre-compiled list of usernames and passwords is used -"hard-coding" the guessing strategy[41,42]. This should be compared to distributed brute-force attacks[38,43], and the asynchronous, randomized strategies we suggest herein.…”