Snoop-Forge-Replay Attacks on Continuous Verification With Keystrokes
Snoop-Forge-Replay Attacks on Continuous Verification With Keystrokes
复制标题
通过击键进行连续验证的 Snoop-Forge-Replay 攻击
DOI：
--
复制
发表时间：
2013
影响因子：
6.8
通讯作者：
V. Phoha
中科院分区：
文献类型：
--
作者：
K. Rahman;K. Balagani;V. Phoha
我们提出了一种新的攻击称为窥探伪造重放攻击基于密码的连续验证系统。窥探-伪造-重放是样本级伪造攻击，并且不特定于任何特定的基于密码的连续验证方法或系统。它可以启动与容易获得的键盘记录器和API的合成。我们的2640个实验结果表明：1）与零努力冒名顶替者攻击相比，snoop-forge-replay攻击具有惊人的高错误率，零努力冒名顶替者攻击已经成为评估基于身份验证的连续验证系统的事实上的标准; 2）四种最先进的验证方法，三种类型的验证，和11个配对设置（-在连续验证的一个关键参数，我们在本文中检查）容易受到攻击; 3）即使在低至20到100个信标被窥探以创建防御时，攻击也是有效的。根据我们的结果，我们对当前基于键击的连续验证系统提供的安全性提出质疑。此外，在我们的实验中，我们利用虚拟化技术在短时间内生成了数千个数据包。我们指出，攻击者也可以利用我们实验中使用的虚拟化设置来扩展和加速攻击。
We present a new attack called the snoop-forge-replay attack on keystroke-based continuous verification systems. The snoop-forge-replay is a sample-level forgery attack and is not specific to any particular keystroke-based continuous verification method or system. It can be launched with easily available keyloggers and APIs for keystroke synthesis. Our results from 2640 experiments show that: 1) the snoop-forge-replay attacks achieve alarmingly high error rates compared to zero-effort impostor attacks, which have been the de facto standard for evaluating keystroke-based continuous verification systems; 2) four state-of-the-art verification methods, three types of keystroke latencies, and 11 matching-pair settings (-a key parameter in continuous verification with keystrokes) that we examined in this paper were susceptible to the attack; 3) the attack is effective even when as low as 20 to 100 keystrokes were snooped to create forgeries. In light of our results, we question the security offered by current keystroke-based continuous verification systems. Additionally, in our experiments, we harnessed virtualization technology to generate thousands of keystroke forgeries within a short time span. We point out that virtualization setup such as the one used in our experiments can also be exploited by an attacker to scale and speedup the attack.