Cracking-Resistant Password Vaults using Natural Language Encoders

Password vaults are increasingly popular applications that store multiple passwords encrypted under a single master password that the user memorizes. A password vault can greatly reduce the burden on a user of remembering passwords, but introduces a single point of failure. An attacker that obtains a user’s encrypted vault can mount offline brute-force attacks and, if successful, compromise all of the passwords in the vault. In this paper, we investigate the construction of encrypted vaults that resist such offline cracking attacks and force attackers instead to mount online attacks. Our contributions are as follows. We present an attack and supporting analysis showing that a previous design for cracking-resistant vaults—the only one of which we are aware—actually degrades security relative to conventional password-based approaches. We then introduce a new type of secure encoding scheme that we call a natural language encoder (NLE). An NLE permits the construction of vaults which, when decrypted with the wrong master password, produce plausible-looking decoy passwords. We show how to build NLEs using existing tools from natural language processing, such as n-gram models and probabilistic context-free grammars, and evaluate their ability to generate plausible decoys. Finally, we present, implement, and evaluate a full, NLE-based cracking-resistant vault system called NoCrack

On the Fly Access Request Authentication: Two-Layer Password-Based Access Control Systems for Securing Information

In the digital era, most of our highly sensitive documents are stored in computers. These documents are in a great threat unless protected using appropriate measures. Despite their several imperfections, passwords are becoming the de-facto mechanism for securing documents stored in local directories or on the websites. In this scheme users protect their documents using passwords. In order for such scheme to work, the passwords must be stored in the file system either in plain or hashed form so that they can be used as references when information is requested. This paper proposes innovative password-based protection system. Although the proposed system uses passwords for document protection, it proposes a completely different way of using and managing these passwords. Our system protects a stored document in terms of both the document itself and the password. Both the document’s content and the password are used along with random noises to generate security code that serves as a reference when the document is requested. The security code is neither reversible nor reproducible without a full knowledge of the password and the content of the document. The users of our system keep their passwords and provide them only when they first store the document and when they later request document retrieval. The passwords are never stored neither in their plain nor hashed forms. Experiments with our prototype implementation showed that our protection scheme is effective and passed important security tests

On the Gold Standard for Security of Universal Steganography

While symmetric-key steganography is quite well understood both in the information-theoretic and in the computational setting, many fundamental questions about its public-key counterpart resist persistent attempts to solve them. The computational model for public-key steganography was proposed by von Ahn and Hopper in EUROCRYPT 2004. At TCC 2005, Backes and Cachin gave the first universal public-key stegosystem - i.e. one that works on all channels - achieving security against replayable chosen-covertext attacks (SS-RCCA) and asked whether security against non-replayable chosen-covertext attacks (SS-CCA) is achievable. Later, Hopper (ICALP 2005) provided such a stegosystem for every efficiently sampleable channel, but did not achieve universality. He posed the question whether universality and SS-CCA-security can be achieved simultaneously. No progress on this question has been achieved since more than a decade. In our work we solve Hopper's problem in a somehow complete manner: As our main positive result we design an SS-CCA-secure stegosystem that works for every memoryless channel. On the other hand, we prove that this result is the best possible in the context of universal steganography. We provide a family of 0-memoryless channels - where the already sent documents have only marginal influence on the current distribution - and prove that no SS-CCA-secure steganography for this family exists in the standard non-look-ahead model.Comment: EUROCRYPT 2018, llncs styl

SPHINX: A Password Store that Perfectly Hides Passwords from Itself

Password managers (aka stores or vaults) allow a user to store and retrieve (usually high-entropy) passwords for her multiple password-protected services by interacting with a device serving the role of the manager (e.g., a smartphone or an online third-party service) on the basis of a single memorable (low-entropy) master password. Existing password managers work well to defeat offline dictionary attacks upon web service compromise, assuming the use of high-entropy passwords is enforced. However, they are vulnerable to leakage of all passwords in the event the device is compromised, due to the need to store the passwords encrypted under the master password and/or the need to input the master password to the device (as in smartphone managers). Evidence exists that password managers can be attractive attack targets. In this paper, we introduce a novel approach to password management, called SPHINX, which remains secure even when the password manager itself has been compromised. In SPHINX the information stored on the device is information theoretically independent of the user\u27s master password --- an attacker breaking into the device learns no information about the master password or the user\u27s site-specific passwords. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the master password --- the password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy passwords and makes it compulsory for the users to register these randomized passwords with the web services, hence fully defeating offline dictionary attack upon service compromise. The design and security of SPHINX is based on the device-enhanced PAKE model of Jarecki et al. that provides the theoretical basis for this construction and is backed by rigorous cryptographic proofs of security. While SPHINX is suitable for different device and online platforms, in this paper, we report on its concrete instantiation on smartphones given their popularity and trustworthiness as password managers (or even two-factor authentication). We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. Based on our inspection analysis, the overall user experience of SPHINX improves upon current managers. We also report on a lab-based usability study of SPHINX, which indicates that users\u27 perception of SPHINX security and usability is high and satisfactory when compared to regular password-based authentication. Finally, we discuss how SPHINX may be extended to an online service for the purpose of back-up or as an independent password manager

Metodología integral de protección de datos electrónicos médicos, aplicado al almacenamiento, acceso y análisis forense de las historias clínicas en Colombia

La Historia Clínica tiene unas características especiales que requieren un manejo diferente desde el punto de vista de la seguridad informática. Dadas las condiciones que anteceden para mantener su integridad, además de cumplir con la normatividad propia de cada país, se hace conveniente la transformación de la forma tradicional mediante manuscritos, a la utilización de las tecnologías de información. Con esta evolución, los incidentes de seguridad cibernética en un sector tan crítico como este, tienen un gran impacto en la sociedad, considerando que la información de la historia clínica podría ser usada de manera inadecuada, permitiendo el robo de identidad, ingreso no autorizado, daño de la información u alteración de los datos del paciente. Aplicando la Resolución Colombiana 1995 de 1999 [1], se desprende que la información del paciente debe registrarse cronológicamente, de la misma manera que los actos médicos, procedimientos ejecutados por el equipo de médico o cualquiera intervenga en su atención, a lo largo de los planteamientos hechos, los sistemas de salud se van volviendo cada vez más vulnerables a incidentes de seguridad informática, en consecuencia a la automatización, las tecnologías de información, los volúmenes de información y la conexión con los pacientes; Al mismo tiempo la inclusión de la seguridad en los sistemas de información de salud no es una prioridad. El resultado de esta investigación es una metodología integral que permita asegurar la accesibilidad al sistema, garantizar la integridad de los datos, además de la posibilidad de realizar un análisis forense en caso de ser vulnerado, al mismo tiempo logrando mitigar las causas, generando alertas, y factores por los cuales los datos electrónicos médicos en historias clínicas no logran ser protegidos.The Clinical History has some special characteristics that require different management from the point of view of computer security. Given the above conditions to maintain its integrity, in addition for complying with the regulations of each country, it is convenient to modify the traditional form by means of manuscripts, to the use of information technologies. With this evolution, the incidents of cybersecurity in a sector as critical as this one, have a great impact on society, such as information on history. Damage to information or alteration of patient data. Applying Colombian Resolution 1995 of 1999 [1], it follows that patient information must correspond chronologically, in the same way as medical acts, procedures performed by the doctor's team or any intervention in their care, throughout the given the facts, health systems are becoming increasingly vulnerable to computer security, automation, information technology, information and connection with patients; At the same time, the inclusion of security in health information systems is not a priority. The result of this research is a comprehensive methodology that allows accessibility in the system, the integrity of the data, the possibility of carrying out an analysis in the case of vulnerability, the same time in which mitigation of the causes is being achieved, generating alerts, electronic data in clinics cannot be protecte

Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools

The majority of Ethical Hacking (EH) tools utilised in penetration testing are developed by practitioners within the industry or underground communities. Similarly, academic researchers have also contributed to developing security tools. However, there appears to be limited awareness among practitioners of academic contributions in this domain, creating a significant gap between industry and academia’s contributions to EH tools. This research paper aims to survey the current state of EH academic research, primarily focusing on research-informed security tools. We categorise these tools into process-based frameworks (such as PTES and Mitre ATT&CK) and knowledge-based frameworks (such as CyBOK and ACM CCS). This classification provides a comprehensive overview of novel, research-informed tools, considering their functionality and application areas. The analysis covers licensing, release dates, source code availability, development activity, and peer review status, providing valuable insights into the current state of research in this field

Design, implementation and analysis of a theft-resistant password manager based on Kamouflage architecture

Masteroppgave informasjons- og kommunikasjonsteknologi - Universitetet i Agder, 2015As a solution for helping companies and users in the constant security dilemma of obtaining and using passwords in the securest ways possible, password managers have become custom around the globe. The design architecture on what development of password managers are based on, preserving authenticity, usability and reliability are principles that keep systems secure and defend against attacks or unfortunate circumstances. The design principles however, have changed little over time. After researching password managers and analyzing overall security, we use our findings to develop a design based on the implementation of decoys, customized for Android. This development was inspired by a paper named ”Kamouflage: Loss-Resistant Password Management” [27]

An Analysis of Modern Password Manager Security and Usage on Desktop and Mobile Devices

Security experts recommend password managers to help users generate, store, and enter strong, unique passwords. Prior research confirms that managers do help users move towards these objectives, but it also identified usability and security issues that had the potential to leak user data or prevent users from making full use of their manager. In this dissertation, I set out to measure to what extent modern managers have addressed these security issues on both desktop and mobile environments. Additionally, I have interviewed individuals to understand their password management behavior. I begin my analysis by conducting the first security evaluation of the full password manager lifecycle (generation, storage, and autofill) on desktop devices, including the creation and analysis of a corpus of 147 million generated passwords. My results show that a small percentage of generated passwords are weak against both online and offline attacks, and that attacks against autofill mechanisms are still possible in modern managers. Next, I present a comparative analysis of autofill frameworks on iOS and Android. I find that these frameworks fail to properly verify webpage security and identify a new class of phishing attacks enabled by incorrect handling of autofill within WebView controls hosted in apps. Finally, I interview users of third-party password managers to understand both how and why they use their managers as they do. I find evidence that many users leverage multiple password managers to address issues with existing managers, as well as provide explanations for why password reuse continues even in the presence of a password manager. Based on these results, I conclude with recommendations addressing the attacks and usability issues identified in this work