263 research outputs found
Moving in next door: Network flooding as a side channel in cloud environments
The final publication is available at http://link.springer.com/chapter/10.1007/978-3-319-48965-0_56Co-locating multiple tenants' virtual machines (VMs) on the same host underpins public clouds' affordability, but sharing physical hardware also exposes consumer VMs to side channel attacks from adversarial co-residents. We demonstrate passive bandwidth measurement to perform traffic analysis attacks on co-located VMs. Our attacks do not assume a privileged position in the network or require any communication between adversarial and victim VMs. Using a single feature in the observed bandwidth data, our algorithm can identify which of 3 potential YouTube videos a co-resident VM streamed with 66% accuracy. We discuss defense from both a cloud provider's and a consumer's perspective, showing that effective defense is difficult to achieve without costly under-utilization on the part of the cloud provider or over-utilization on the part of the consumer.We would like to acknowledge the MIT PRIMES program and thank in particular Dr. Slava Gerovitch and Dr. Srini Devadas for their support. We are also grateful to Boston University, the Hariri Institute, and the Massachusetts Open Cloud. This paper is based upon work supported by the National Science Foundation under Grants No. 1414119 and 1413920
PILOT: Password and PIN Information Leakage from Obfuscated Typing Videos
This paper studies leakage of user passwords and PINs based on observations
of typing feedback on screens or from projectors in the form of masked
characters that indicate keystrokes. To this end, we developed an attack called
Password and Pin Information Leakage from Obfuscated Typing Videos (PILOT). Our
attack extracts inter-keystroke timing information from videos of password
masking characters displayed when users type their password on a computer, or
their PIN at an ATM. We conducted several experiments in various attack
scenarios. Results indicate that, while in some cases leakage is minor, it is
quite substantial in others. By leveraging inter-keystroke timings, PILOT
recovers 8-character alphanumeric passwords in as little as 19 attempts. When
guessing PINs, PILOT significantly improved on both random guessing and the
attack strategy adopted in our prior work [4]. In particular, we were able to
guess about 3% of the PINs within 10 attempts. This corresponds to a 26-fold
improvement compared to random guessing. Our results strongly indicate that
secure password masking GUIs must consider the information leakage identified
in this paper
The development of a biometric keystroke authentication framework to enhance system security
Computer systems have proven to be essential to achieving our daily tasks such as managing our banking accounts, managing our health information and managing critical information systems such as drinking water systems or nuclear power plant systems. Such distributed systems are networked and must be protected against cyber threats. This research presents the design and implementation of a stand alone web based biometric keystroke authentication framework that creates a user\u27s keystroke typing profile and use it as a second form of authentication. Several biometric models were then bench marked for their accuracy by computing their EER. By using keystroke biometrics as a second form of authentication the overall system\u27s security is enhanced without the need of extra peripheral devices and without interrupting a user\u27s work-flow
Battle Ground: Data Collection and Labeling of CTF Games to Understand Human Cyber Operators
Industry standard frameworks are now widespread for labeling the high-level
stages and granular actions of attacker and defender behavior in cyberspace.
While these labels are used for atomic actions, and to some extent for
sequences of actions, there remains a need for labeled data from realistic
full-scale attacks. This data is valuable for better understanding human
actors' decisions, behaviors, and individual attributes. The analysis could
lead to more effective attribution and disruption of attackers.
We present a methodological approach and exploratory case study for
systematically analyzing human behavior during a cyber offense/defense
capture-the-flag (CTF) game. We describe the data collection and analysis to
derive a metric called keystroke accuracy. After collecting players' commands,
we label them using the MITRE ATT&CK framework using a new tool called
Pathfinder. We present results from preliminary analysis of participants'
keystroke accuracy and its relation to score outcome in CTF games. We describe
frequency of action classification within the MITRE ATT&CK framework and
discuss some of the mathematical trends suggested by our observations. We
conclude with a discussion of extensions for the methodology, including
performance evaluation during games and the potential use of this methodology
for training artificial intelligence.Comment: 9 pages, accepted to 2023 Workshop on Cyber Security Experimentation
and Test (CSET
IDENTIFICATION OF USERS VIA SSH TIMING ATTACK
Secure Shell, a tool to securely access and run programs on a remote machine, is an important tool for both system administrators and developers alike. The technology landscape is becoming increasingly distributed and reliant on tools such as Secure Shell to protect information as a user works on a system remotely. While Secure Shell accounts for the abuses the security of older tools such as telnet overlook, it still has fundamental vulnerabilities which leak information about both the user and their activities through timing attacks. The OpenSSH client, the implementation included in all Linux, Mac, and Windows computers, sends each keystroke entered to the server as soon as it becomes available. As a result, an attacker can observe the network patterns to know when a user presses a key and draw conclusions based on that information such as what a user is typing or who they are. In this thesis, we demonstrate that such an attack allows a malicious observer to identify a user with a concerning level of accuracy without having direct access to either the client or server systems. Using machine learning classifiers, we identify individual users in a crowd based solely on the size and timing of packets traveling across the network. We find that our classifiers were able to identify users with 20\% accuracy using as little as one hour of network traffic. Two of them promise to scale well to the number of users
- …