CSC 386 – Computer Security Scott Heggen. Agenda Authentication.

CSC 386 – Computer Security

Scott Heggen

Agenda

• Authentication

Authentication

• What’s the most common form of authentication today?

• Why do we need authentication?• The user identity is a parameter in access control decisions.• The user identity is recorded when logging security relevant events in an audit

trail.

Identification and Authentication

• What’s the difference?

?

mYP4$$w0rd!

Passwords

• Passwords are a secret shared between the user and the system. How does the user initially get the password?

• The mere process of distributing a password is a security issue!

Devil’s Advocate

• Could I guess someone’s password?• Exhaustive search (brute force): try all possible combinations of valid symbols

up to a certain length.• Intelligent search: search through a restricted name space, e.g. passwords

that are somehow associated with a user like name, names of friends and relatives, car brand, car registration number, phone number,…, or try passwords that are generally popular. • Typical example for the second approach: dictionary attack trying all

passwords from an on-line dictionary.• You cannot prevent an attacker from accidentally guessing a valid password,

but you can try to reduce the probability of a password compromise.

Defense

• What can you do to reduce the probability of someone guessing your password?• Set a password: if there is no password for a user account, the attacker does not even have to

guess it.• Change default passwords: often passwords for system accounts have a default value like

“manager”. • Avoid guessable passwords

• Length• Variety• Randomness

Good Passwords

• Which password is best?Password Brute Force Dictionary Attack Intelligent Search

password Sum(46) from 1 to 8 (# of words)^1

MyPassword Sum(46) from 1 to 10 (# of words)^2

MyP@$$w0rd Sum(46) from 1 to 10 ?

P@$$MYw0rd Sum(46) from 1 to 10 ?

dr0wMY$$@P Sum(46) from 1 to 10 ?

RedHatBrownCatYouFat Sum(46) from 1 to 20 (# of words)^6

?

Good Passwords

Additional Defenses

• Password ageing: set an expiry dates for passwords to force users to change passwords regularly.• Prevent users from reverting to old passwords, e.g. keep a list of the

last ten passwords used. • Limit login attempts: the system can monitor unsuccessful login

attempts and react by locking the user account (completely or for a given time interval) to prevent or discourage further attempts. • Inform user: after successful login, display time of last login and the

number of failed login attempts since, to warn the user about recently attempted attacks.

Good Passwords

• Which password is best?• Can you memorize it?• Do you need to write it down?• Does it change too often?• Are you reusing a favorite password?

Password

password

MyPassword

MyP@$$w0rd

P@$$MYw0rd

dr0wMY$$@P

RedHatBrownCatYouFat

Devil’s Advocate

• Say you are authenticating with a remote system (e.g., a website). What ways can someone learn your username and password?• Spoofing • Phishing• Social Engineering

Spoofing

• “Hi, I’m your bank. There was a bank error in your favor. Click here to see the error.”

Countermeasures

• Display number of failed logins: may indicate to the user that an attack has happened. • Trusted path: guarantee that user communicates with the operating

system and not with a spoofing program; e.g., Windows has a secure attention key CTRL+ALT+DEL for invoking the operating system logon screen. • Mutual authentication: user authenticated to system, system

authenticated to user.

Phishing

• “Hi, I’m a Kenyan prince. I want to send you $2,000,0000,00 dollars. Send me your SSN, birth date, address, full legal name, driver’s license number, ….”

Countermeasures

• Take care to enter your passwords only at the “right” site (but how do you know?)• No legitimate business will ask you for your password via e-mail • Why would they need it? They can access all of your information already!

Social Engineering

• Attacker impersonates the user to trick someone else into releasing information:• http://www.healthsecuritysolutions.com/2012/12/kate-middleton-prank-facil

iated-by-simple-social-engineering/#.U_3x0cVdWs0