Towards Baselines for Shoulder Surfing on Mobile Authentication
Towards Baselines for Shoulder Surfing on Mobile Authentication
复制标题
迈向移动身份验证的肩窥基线
DOI：
10.1145/3134600.3134609
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Ravi Kuber
中科院分区：
文献类型：
--
作者：
Adam J. Aviv;John T. Davin;Flynn Wolf;Ravi Kuber
考虑到移动的设备和解锁过程的性质，解锁认证是通过肩扛冲浪（一种观察攻击形式）的凭证泄漏的主要目标。虽然研究界已经研究了最大限度地减少或防止肩部冲浪威胁的解决方案，但我们对攻击如何在当前系统上执行的理解却没有得到很好的研究。在本文中，我们描述了一个大型的在线实验（n = 1173），致力于建立一个基线的肩膀冲浪漏洞，目前的解锁认证系统。使用受害者从不同角度在不同手机上输入一组4和6长度的PIN和Android解锁模式的受控视频记录，我们要求参与者扮演攻击者，试图根据观察来确定身份验证输入。我们发现，6位数的PIN是最难以捉摸的攻击面，其中一个单一的观察导致只有10.8%的成功攻击（26.5%的多个观察）。相比之下，6个长度的Android模式，一次观察，发现攻击率为64.2%（79.9%，多次观察）。删除模式的反馈行将安全性提高到35.3%（多个观察值为52.1%）。这一证据，以及与手的位置、手机大小和观察角度相关的其他结果，表明了与肩扛冲浪漏洞相关的最佳和最差情况，这既可以帮助用户改善他们的安全选择，也可以为研究人员建立基线。
Given the nature of mobile devices and unlock procedures, unlock authentication is a prime target for credential leaking via shoulder surfing, a form of an observation attack. While the research community has investigated solutions to minimize or prevent the threat of shoulder surfing, our understanding of how the attack performs on current systems is less well studied. In this paper, we describe a large online experiment (n = 1173) that works towards establishing a baseline of shoulder surfing vulnerability for current unlock authentication systems. Using controlled video recordings of a victim entering in a set of 4- and 6-length PINs and Android unlock patterns on different phones from different angles, we asked participants to act as attackers, trying to determine the authentication input based on the observation. We find that 6-digit PINs are the most elusive attacking surface where a single observation leads to just 10.8% successful attacks (26.5% with multiple observations). As a comparison, 6-length Android patterns, with one observation, were found to have an attack rate of 64.2% (79.9% with multiple observations). Removing feedback lines for patterns improves security to 35.3% (52.1% with multiple observations). This evidence, as well as other results related to hand position, phone size, and observation angle, suggests the best and worst case scenarios related to shoulder surfing vulnerability which can both help inform users to improve their security choices, as well as establish baselines for researchers.