Targeted Online Password Guessing

Abstract

While trawling online/offline password guessing has been intensively studied, only a few studies have examined targeted online guessing, where an attacker guesses a specific victim's password for a service, by exploiting the victim's personal information such as one sister password leaked from her another account and some personally identifiable information (PII). A key challenge for targeted online guessing is to choose the most effective password candidates, while the number of guess attempts allowed by a server's lockout or throttling mechanisms is typically very small.We propose TarGuess, a framework that systematically characterizes typical targeted guessing scenarios with seven sound mathematical models, each of which is based on varied kinds of data available to an attacker. These models allow us to design novel and efficient guessing algorithms. Extensive experiments on 10 large real-world password datasets show the effectiveness of TarGuess. Particularly, TarGuess I∼IV capture the four most representative scenarios and within 100 guesses: (1) TarGuess-I outperforms its foremost counterpart by 142% against security-savvy users and by 46% against normal users; (2) TarGuess-II outperforms its foremost counterpart by 169% on security-savvy users and by 72% against normal users; and (3) Both TarGuess-III and IV gain success rates over 73% against normal users and over 32% against security-savvy users. TarGuess-III and IV, for the first time, address the issue of cross-site online guessing when given the victim's one sister password and some PII.

PSV (Password Security Visualizer): From Password Checking to User Education

“…As a demonstrator, the targeted dictionary attack currently gets the user's first and last names by asking them to log into his/her Facebook account via the Facebook API. This can be extended to cover more personal information such as what was used in [13,31].…”

“…Because the pervasive use of passwords, they are frequently targeted in cyber attacks and many large-scale password leakage incidents have been reported especially in recent years [9,22]. Password strengthening technologies such as password hashing and salting have been developed to provide more protection on passwords stored on the server side, but human users remain a weak link because they often choose weak passwords to compromise security for usability, thus making password cracking much more effective [11,17,31,32].…”

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

“…In the cryptanalysis of the two-factor authentication schemes, the adversary A is also supposed to have the following capacities [29,[47][48][49] …”

“…is the running time for exclusive-or operation. |D pw | denotes the number of passwords in D pw , and |D pw | is very limited in practice [49,50]; usually |D pw | ≤ 10 6 ; so the above attack is quite efficient.…”

A novel statistical technique for intrusion detection systems

“…In addition, intrusion detection systems can also be classified as signature based or anomaly based depending upon the attack detection method. The signature-based systems are trained by extracting specific patterns (or signatures) from previously known attacks while the anomaly-based systems learn from the normal data collected when there is no anomalous activity [1,30,31,32,43]. The main purpose of an IDS is to detect as many attacks as possible with minimum number of false alarms, i.e., the system must be accurate in detecting attacks.…”