PILOT: Password and PIN Information Leakage from Obfuscated Typing Videos

This paper studies leakage of user passwords and PINs based on observations of typing feedback on screens or from projectors in the form of masked characters that indicate keystrokes. To this end, we developed an attack called Password and Pin Information Leakage from Obfuscated Typing Videos (PILOT). Our attack extracts inter-keystroke timing information from videos of password masking characters displayed when users type their password on a computer, or their PIN at an ATM. We conducted several experiments in various attack scenarios. Results indicate that, while in some cases leakage is minor, it is quite substantial in others. By leveraging inter-keystroke timings, PILOT recovers 8-character alphanumeric passwords in as little as 19 attempts. When guessing PINs, PILOT significantly improved on both random guessing and the attack strategy adopted in our prior work [4]. In particular, we were able to guess about 3% of the PINs within 10 attempts. This corresponds to a 26-fold improvement compared to random guessing. Our results strongly indicate that secure password masking GUIs must consider the information leakage identified in this paper

Оценивание информативности признаков в наборах данных для проведения продлённой аутентификации

Continuous verification eliminates the flaws of existing static authentication, e.g. identifiers can be lost or forgotten, and the user logs in the system only once, which may be dangerous not only for areas requiring a high level of security but also for a regular office. Checking the user dynamically during the whole session of work can improve the security of the system, since while working with the system, the user may be exposed to an attacker (to be assaulted for example) or intentionally transfer rights to him. In this case, the machine will not be operated by the user who performed the initial login. Classifying users continuously will limit access to sensitive data that can be obtained by an attacker. During the study, the methods and datasets used for continuous verification were checked, then some datasets were chosen, which were used in further research: smartphone and smart watch movement data (WISDM) and mouse activity (Chao Shen’s, DFL, Balabit). In order to improve the performance of models in the classification task it is necessary to perform a preliminary selection of features, to evaluate their informativeness. Reducing the number of features makes it possible to reduce the requirements for devices that will be used for their processing, and to increase the volume of enumeration of classifier parameter values at the same time, thereby potentially increasing the proportion of correct answers during classification due to a more complete enumeration of value parameters. For the informativeness evaluation, the Shannon method was used, as well as the algorithms built into programs for data analysis and machine learning (WEKA: Machine Learning Software and RapidMiner). In the course of the study, the informativeness of each feature in the selected datasets was evaluated, and then users were classified with RapidMiner. The used in classifying features selection was decreased gradually with a 20% step. As a result, a table was formed with recommended sets of features for each dataset, as well as dependency graphs of the accuracy and operating time of various models.Продлённая аутентификация позволяет избавиться от недостатков, присущих статической аутентификации, например, идентификаторы могут быть потеряны или забыты, пользователь совершает только первоначальный вход в систему, что может быть опасно не только для областей, требующих обеспечения высокого уровня безопасности, но и для обычного офиса. Динамическая проверка пользователя во время всего сеанса работы может повысить безопасность системы, поскольку во время работы пользователь может подвергнуться воздействию со стороны злоумышленника (например, быть атакованным) или намеренно передать ему права. В таком случае оперировать машиной будет не пользователь, который выполнил первоначальный вход. Классификация пользователей во время работы системы позволит ограничить доступ к важным данным, которые могут быть получены злоумышленником. Во время исследования были изучены методы и наборы данных, использующихся для продлённой аутентификации. Затем был сделан выбор наборов данных, которые использовались в дальнейшем исследовании: данные о движении смартфона и смарт-часов (WISDM) и динамике активности мыши (Chao Shen’s, DFL, Balabit). Помочь улучшить результаты работы моделей при классификации может предварительный отбор признаков, например, через оценивание их информативности. Уменьшение размерности признаков позволяет снизить требования к устройствам, которые будут использоваться при их обработке, повысить объём перебора значений параметров классификаторов при одинаковых временных затратах, тем самым потенциально повысить долю правильных ответов при классификации за счёт более полного перебора параметров значений. Для оценивания информативности использовались метод Шеннона, а также алгоритмы, встроенные в программы для анализа данных и машинного обучения (WEKA: Machine Learning Software и RapidMiner). В ходе исследования были выполнены расчёты информативности каждого признака в выбранных для исследования наборах данных, затем с помощью RapidMiner были проведены эксперименты по классификации пользователей с последовательным уменьшением количества используемых при классификации признаков с шагом в 20%. В результате была сформирована таблица с рекомендуемыми наборами признаков для каждого набора данных, а также построены графики зависимостей точности и времени работы различных моделей от количества используемых при классификации признаков

Insider Misuse Identification using Transparent Biometrics

Insider misuse is a key threat to organizations. Recent research has focused upon the information itself – either through its protection or approaches to detect the leakage. This paper seeks a different approach through the application of transparent biometrics to provide a robust approach to the identification of the individuals who are misusing systems and information. Transparent biometrics are a suite of modalities, typically behavioral-based that can capture biometric signals covertly or non-intrusively – so the user is unaware of their capture. Transparent biometrics are utilized in two phases a) to imprint digital objects with biometric-signatures of the user who last interacted with the object and b) uniquely applied to network traffic in order to identify users traffic (independent of the Internet Protocol address) so that users rather than machine (IP) traffic can be more usefully analyzed by analysts. Results from two experimental studies are presented and illustrate how reliably transparent biometrics are in providing this link-ability of information to identity.

Behavioral Biometrics-based Continuous User Authentication

The field of cybersecurity is exploring new ways to defend against cyber-attacks, including a technique called continuous user authentication. This method uses keystroke (typing) data to continuously match the user\u27s typing pattern with patterns previously recorded using artificial intelligence (AI) to identify the user. While this approach has the potential to improve security, it also has some challenges, including the time it takes to register a user, the performance of machine learning algorithms on real-world data, and latency within the system. In this study, the researchers proposed solutions to these issues by using transfer learning to reduce user registration time, testing machine learning algorithms on real-world data, and developing a universal benchmarking framework to evaluate databases in practical situations. The results of the experiments supported the researchers\u27 observations and suggestions for improving continuous user authentication

On the Inference of Soft Biometrics from Typing Patterns Collected in a Multi-device Environment

In this paper, we study the inference of gender, major/minor (computer science, non-computer science), typing style, age, and height from the typing patterns collected from 117 individuals in a multi-device environment. The inference of the first three identifiers was considered as classification tasks, while the rest as regression tasks. For classification tasks, we benchmark the performance of six classical machine learning (ML) and four deep learning (DL) classifiers. On the other hand, for regression tasks, we evaluated three ML and four DL-based regressors. The overall experiment consisted of two text-entry (free and fixed) and four device (Desktop, Tablet, Phone, and Combined) configurations. The best arrangements achieved accuracies of 96.15%, 93.02%, and 87.80% for typing style, gender, and major/minor, respectively, and mean absolute errors of 1.77 years and 2.65 inches for age and height, respectively. The results are promising considering the variety of application scenarios that we have listed in this work.Comment: The first two authors contributed equally. The code is available upon request. Please contact the last autho

Biomove: Biometric user identification from human kinesiological movements for virtual reality systems

© 2020 by the authors. Licensee MDPI, Basel, Switzerland. Virtual reality (VR) has advanced rapidly and is used for many entertainment and business purposes. The need for secure, transparent and non-intrusive identification mechanisms is important to facilitate users’ safe participation and secure experience. People are kinesiologically unique, having individual behavioral and movement characteristics, which can be leveraged and used in security sensitive VR applications to compensate for users’ inability to detect potential observational attackers in the physical world. Additionally, such method of identification using a user’s kinesiological data is valuable in common scenarios where multiple users simultaneously participate in a VR environment. In this paper, we present a user study (n = 15) where our participants performed a series of controlled tasks that require physical movements (such as grabbing, rotating and dropping) that could be decomposed into unique kinesiological patterns while we monitored and captured their hand, head and eye gaze data within the VR environment. We present an analysis of the data and show that these data can be used as a biometric discriminant of high confidence using machine learning classification methods such as kNN or SVM, thereby adding a layer of security in terms of identification or dynamically adapting the VR environment to the users’ preferences. We also performed a whitebox penetration testing with 12 attackers, some of whom were physically similar to the participants. We could obtain an average identification confidence value of 0.98 from the actual participants’ test data after the initial study and also a trained model classification accuracy of 98.6%. Penetration testing indicated all attackers resulted in confidence values of less than 50% (\u3c50%), although physically similar attackers had higher confidence values. These findings can help the design and development of secure VR systems

Biomove: Biometric user identification from human kinesiological movements for virtual reality systems

© 2020 by the authors. Licensee MDPI, Basel, Switzerland. Virtual reality (VR) has advanced rapidly and is used for many entertainment and business purposes. The need for secure, transparent and non-intrusive identification mechanisms is important to facilitate users’ safe participation and secure experience. People are kinesiologically unique, having individual behavioral and movement characteristics, which can be leveraged and used in security sensitive VR applications to compensate for users’ inability to detect potential observational attackers in the physical world. Additionally, such method of identification using a user’s kinesiological data is valuable in common scenarios where multiple users simultaneously participate in a VR environment. In this paper, we present a user study (n = 15) where our participants performed a series of controlled tasks that require physical movements (such as grabbing, rotating and dropping) that could be decomposed into unique kinesiological patterns while we monitored and captured their hand, head and eye gaze data within the VR environment. We present an analysis of the data and show that these data can be used as a biometric discriminant of high confidence using machine learning classification methods such as kNN or SVM, thereby adding a layer of security in terms of identification or dynamically adapting the VR environment to the users’ preferences. We also performed a whitebox penetration testing with 12 attackers, some of whom were physically similar to the participants. We could obtain an average identification confidence value of 0.98 from the actual participants’ test data after the initial study and also a trained model classification accuracy of 98.6%. Penetration testing indicated all attackers resulted in confidence values of less than 50% (\u3c50%), although physically similar attackers had higher confidence values. These findings can help the design and development of secure VR systems

To Extend or not to Extend: on the Uniqueness of Browser Extensions and Web Logins

Recent works showed that websites can detect browser extensions that users install and websites they are logged into. This poses significant privacy risks, since extensions and Web logins that reflect user's behavior, can be used to uniquely identify users on the Web. This paper reports on the first large-scale behavioral uniqueness study based on 16,393 users who visited our website. We test and detect the presence of 16,743 Chrome extensions, covering 28% of all free Chrome extensions. We also detect whether the user is connected to 60 different websites. We analyze how unique users are based on their behavior, and find out that 54.86% of users that have installed at least one detectable extension are unique; 19.53% of users are unique among those who have logged into one or more detectable websites; and 89.23% are unique among users with at least one extension and one login. We use an advanced fingerprinting algorithm and show that it is possible to identify a user in less than 625 milliseconds by selecting the most unique combinations of extensions. Because privacy extensions contribute to the uniqueness of users, we study the trade-off between the amount of trackers blocked by such extensions and how unique the users of these extensions are. We have found that privacy extensions should be considered more useful than harmful. The paper concludes with possible countermeasures.Comment: accepted at WPES 201