Chapter 3 - User Authentication Flashcards
User Authentication Simple Definition
The process of verifying an identity claimed by or for a system entity
NIST Definition of User Authentication
The Process of establishing confidence in user identities presented electronically to an information system
What is User Authentication considered?
Role in Security System
- Fundamental building block
- primary line of defense in computer security
- basis for most types of access control and accountability
Two steps in the authentication process
- Identification: Presenting an identifier to the system
- Verification: confirm binding between the entity and the identifier
Is FaceID identifier or verifier?
Verifier because it validates identity by comparing face to stored facial data.
Identifier is implicit!
4 means of authenticating user identity and issues with each
Something the individual: _____
- Something individual knows
(Password, PIN, answer to security questions) - must be as secure as the password
- Password guessing/stealing/forgetting - Something the individual possesses Token
(Smartcard, electronic keycard, physical key)
- theft/loss - Something the individual is
(Static biometrics like fingerprint, retina or face)
- false positives/negatives
- user acceptance issues
- inconvenience to set up - Something the individual does
(dynamic biometrics like voice pattern, handwriting, or typing ryhythm)
What is password-based authentication?
Method where a user provides a name/(loginID) and a password, which the system compares with a stored password for that login
userID
1. Authorized to enter system?
2. Which privileges?
3. Access control
Password Vulnerabilities (8)
Eric, Please Offer Spectacular Passwords When Making Users
- Electronic monitoring
- Password guessing (against single user)
- Offline dictionary attacks
- Specific account attacks
- Popular password attacks
- Workstation hijacking
- Exploiting user mistakes
- Exploiting multiple password use
Popular Password Attack
Password Vulnerabilities
Attacker gains unauthorized access by guessing popular passwords
make policies against selection of commonly used passwords (prevent), scan ip address of authentication requests (detect)
Password Guessing (against single user)
Password Vulnerabilities
Guessing against a specific user
min length, character set, training
Electronic monitoring
Password Vulnerabilities
Malware that records every keystroke a user types
Offline dictionary attack
Password Vulnerabilities
Attacker obtains database of hashed passwords and compares them against hash values of commonly used passwords
Access contols (prevent) intrustion detection (detect) rapid reissuance of passwords (respond)
Specific Account Attacks
Password Vulnerabilities
Gathering personal information about a user to guess password
Accout lockout mechanisms
Example of workstation hijacking
Password Vulnerabilities
Attacker accesses a logged-in workstation that was left unattended
Example of Exploiting user mistakes
Password Vulnerabilities
User leaves password on a sticky note on desk
Example of multiple passwords use
Password Vulnerabilities
Attacker gains access to one account and reuses the credentials to access the user’s email or banking accouts
salting helps prevent this!
Online vs. Offline password attacks
Online: Requires interaction with a service or resource
Offline: Works with intercepted or stolen data (password files)
Countermeasures (8)
Password Countermeasures
- Prevent unauthorized password files access
- Intrusion detection measures
- Rapid reissuance of compromised passwords
- Account lockout mechanisms
- Policies against using common passwords and using similar passwords on network devices
- Regular password reissuance
- Training in and enforcement of password policies
- Automatic workstation logout
Account Lockout Mechanisms
Password Countermeasures
The account is locked after a given number of failed attempts
*Has a downside: Can be abused for denial of service attack
Why are passwords the most common authentication technique despite all the vulnerabilities?
- tokens expensive and inconvenient to carry around
- biometrics depend on client side hardware and it requires specific software implemnation on both sides, usually one side reluctant
Why should passwords NEVER be stored “in clear” ?
Password Countermeasures
- Sysadmin could access all user’ passwords
- Intruder would get a very valuable asset
BTW: Never email password!!
What are hashed and salted passwords?
Password Countermeasures
Passwords are transformed using a hash function
with a salt value, or random value added to each password before hashing to make attacks harder
Salt values are stored in the password value in clear
How is password verified with salting and hashing?
Password Countermeasures
- User enters password
- Retrieve user’s salt value from password file
- Combine them, and pass through hash function
- Compare newly computed hash with stored hash
Why is salting important in password storage? (2)
Password Countermeasures
- It prevents duplicate passwords from being visible in the password file, increasing the difficulty of offline dictionary attacks (attacker has to add all possible salts to commonly used passwords, will take forever)
- Becomes nearly impossible to find out whether a person with passwords on two or more systems has used the same password
(salt of b bits increases number of possible passwords by a factor of 2^b)
Salt ensures that each password has a unique hash
Whys is it a “slow” hash function in salt & hashing?
Password Countermeasures
This delay makes it computationally expensive for attackers to execute brute-force attacks
Old salting vs new salting
Password Countermeasures
- 12-bit salt using DES encryption into a one-way hash function (based on MD5, which is not SHA512)
- 48-bit+ salt using Bcyrpt hash algorithm (Blowfish block cipher)
Shadow password file
Password Countermeasures
Separate file from the user IDs where the hashed passwords are kept
User Education
Password Countermeasures
Users told importance of using hard to guess passwords, provided with guidelines
Computer generated passwords
Password Countermeasures
Hard to guess for attackers but users have trouble remembering them
Could use password managers
Reactive password checking
Password Countermeasures
System periodically runs its own password cracker to find guessable passwords
cancel those guessed and notify user
Proactive password checking
definition and 2 examples
User checks if user selected password is allowable at time of selection and if not rejects it
- Rule enforcement (basic16 > comprehensive8)
- Password checker (compile dictionary of “bad passwords”)
Goal: Eliminate guessable passwords while allowing memorable passwords
What is the problem with traditional UNIX password scheme?
What is the recommended hash instead?
It uses DES cipher which is insecure, but this scheme is still required with many accout management softwares for compatibility reasons
MD5 with 48 bit salt and 128 bit hash value that uses an inner loop with 1000 iterations to slow it down (longer to crack)
Most secure Unix hash/salt scheme
developed for OpenBSD, the “Bcrypt” hash function. 55 character max for password, 128 bit salt, outputs to 192 bit hash value.
Can configure a cost variable to increase hash time more
Methods for proactive password checking
Password Countermeasures
- Specific rules
- Password cracker (large dictionary of passwords not to use + variations)
- Neural networks-based evaluation
- Password invalidation based on public data breaches
Dictionary Attack
Password Cracking
Attacker obtains password file, develops a dictionary of possible passwords, then hashes each possible password (with the salt value) and then compares to stored hash values in the password file
each password hashed with EVERY salt… takes awhile
Rainbow table attacks
Password Cracking
Attacker precomputes hashes from possible passwords (assuming a hash function) and creates a mammoth table that maps passwords (rainbow table) to hash values (in password file)
Large salt makes it too difficult.
If attacker can match a hash in their table to hash stored in password file, they have cracked the password
Why is rainbow table attack more efficient than dictionary?
Password Cracking
Instead of computing the hash for each password guess in real-time, it compares to stored hashes in rainbow table
Rainbow tables can be resused if no salt was uses!
trade off space for time
1.4 gb of data was shown to crack 99.9% of all alphanumeric windows passwords
How does an attacker get a password file? (5)
sniff some ass, booty back
- Exploit software vulnerability in OS to bypass access control system (at least for long enough to steal that file!)
- Accident of protection rendering password file readable
- Find copy on backup/archival disk physical security weakness
- Boot disk from another operating system
- Sniffing network traffic
Password Cracking using AI (Example)
Password Cracking
PassGAN: Generative adversarial networks generate password guesses after learning distribution of passwords by processing the spoils of previous real-world breaches
What was the password cracking method used in T6?
Password Cracking
John the Ripper
Popular open source password cracker that combines brute-force and dictionary techniques
Alarming Password Statistics
- 9.8% of users have the password “password” “123456” or “12345678”
- 91% of users have a password from teh top 1000 passwords
What is multi-factor authentication (MFA)?
MFA
Authentication that uses two or more methods
EX
- Something the user knows (password)
- Something the user has (dynamic PIN or device-generated code)
SMS are not good for security
MFA can be good, but…
MFA
Must consider the security of the channel used for 2nd step of verification:
- IN band: single device use to input both factors
- OUT band: on multiple devices
What is a passkey?
A replacement for traditional passwords that uses public-key cryptography, storing the key on local devices and resisting phishing attacks
Goal to completely replace traditional username and passwords
Benefits of passkeys
Stored locally, reducing server-side breach impact
Better usability compared to traditional passwords
Can also use biometric verification
How do passkeys resist phishing attacks?
Phishers don’t have access to the private key securely stored locally on device
What are memory cards and smartcards in token-based authentication?
Token Based Authentication
Memory cards: Store data but do not process it (magnetic stripe cards)
Smartcards: Include embedded microprocessors (does your card have a “chip”?)
Memory Card Drawbacks (4)
Token-Based Authentication
- Requires special reader
- Loss or theft
- Information often stored in clear
- Good for ATM but inconvenient for personal computer
Does hotel properly reprogram lock at each room change?
Do MUCH better with pin
2 types of smart card electronic interfaces
- contact: insert card into reader (conductive plate, gold)
- contactless: radio frequencies to connect from inches away (card chip often powered by electromagnetic signal from reader!)
Authentication Protocols for Smartcards
Token-Based Authentication
- Static: user authenticates himself to token, then token authenticates user to computer (similar to memory card)
- dynamic password generator (token generates unique password periodically, password entered into computer)
- challenge-response (computer generates challenge, smart token generates response) ex - token encrypts a challenge string with token’s private key
Components of smart card
- microprocessor (can have coprocessor dedicated to cryptography to speed it up)
- memory (ROM, EEROM, RAM
- I/O ports (wireless or through electrical contacts with insert reader)
What is remote user authentication
Remote User Authentication
verifying user identity over a network, requiring protocols to defend against threats eavesdropping, replay attacks, and password interception
Generally rely on challenge-response protocol
Password protocol in remote authentication
instead of transmitting just hash of password, transmit (from user endpoint to system) function where hashed password is one of the arguments
- use random number as one of arguments
- prevents replay attack because adversary can’t resend the content in data packet, it won’t contain the hashed password and the random number ensures that each remote authentication attempt is singular
What is a replay attack
when an attacker captures a valid authentication message and reuses it to gain unauthorized access
Attacks on user authentication (6)
- client attacks
- host attacks
- eavesdropping/theft/copying
4.replay attacks
5.trojan horse
6.denial of service
