Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware
|
|
|
- Silas Ford
- 5 years ago
- Views:
Transcription
1 Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware Collin Jackson Dan Boneh John Mitchell Stanford University
2 Web Threats Phishing Spoof website convinces user to log in Common password problem Same password for different sites Keylogger spyware Malicious software observes login Transaction generator spyware Hijacks login session, sends requests 2
3 Web Threats Phishing SafeHistory SpoofGuard SafeCache Common password problem PwdHash Keylogger spyware SpyBlock (no server changes) Transaction generator spyware SpyBlock (with server changes) 3
4 Phishing Problem Bank A pwd A pwd A Fake Site User has existing relationship with target site User cannot reliably identify fake site Captured password can be used at target site 4
5 Anti-Phishing Working Group: antiphishing.org 5
6 Context-aware phishing Bank of America customers see: Please log in to your Bank of America account Wells Fargo customers see: Please log in to your Wells Fargo account Works in all major browsers, Outlook
7 Protecting Browser State C. Jackson, A. Bortz, D. Boneh, J. C. Mitchell (WWW 06) Snooping violates same-origin principle: Only the site that stores some information in the browser may later read or modify that information. Stylesheets applied to hyperlinks SafeHistory narrows policy to safe cases Javascript cache timing techniques SafeCache partitions cache for safety 7
8 Common Password Problem Bank A pwd A pwd B = pwd A Site B Phishing attack or break-in at site B reveals pwd at A Server-side solutions will not keep pwd safe Solution: Strengthen with client-side support 8
9 PwdHash B. Ross, C. Jackson, N. Miyake, D. Boneh, J. C. Mitchell (USENIX Sec 05) Bank A pwd A pwd B = Site B Generate a unique password per site HMAC fido:123 (banka.com) Q7a+0ekEXb HMAC fido:123 (siteb.com) OzX2+ICiqc Hashed password is not usable at target site 9
10 User Interface Spoofing Attacker can display password fields or dialogs: Password is sent to attacker in the clear 10
11 Trusted Password Interfaces Password prefix PwdHash Starts with Secure attention sequence Isolated screen area Trusted image or phrase Passmark SpyBlock 11
12 Keylogger Spyware Problem pwd A Bank A pwd A pwd A Attacker Attacker observes login on local machine Password is sent to attacker for later use Screenshot can observe screen keyboards 12
13 APWG July 05 13
14 Transaction Generator Problem Bank A $$$ Why bother with passwords? Once user is logged in, attacker can: Corrupt user requests Issue unauthorized requests Attacker 14
15 SpyBlock C. Jackson, D. Boneh, J. C. Mitchell Isolated component for authentication Untrusted environment for user apps 15
16 Authentication modes Hashing, injection require no server assistance Server support for additional protection 16
17 Password injection Intercept outbound requests and insert password Check for password fields in HTML to deter reflection 17
18 Strong password authentication User Authentication Agent Application Environment Remote Server Negotiate SSL context S Password (trusted path) Negotiate secret K via PAKE Server HTTPS confirmation HMAC K (S 0) Warning (if auth failed) Client HTTPS confirmation HMAC K (S 1) Application environment does not learn user password HTTPS is verified to prevent network man-in-the-middle 18
19 Transaction confirmation Application environment cannot MAC fake transaction Unique transaction ID prevents replay attacks 19
20 Project websites Phishing Common password problem Keylogger spyware Transaction generator spyware
21 21
22 Browser Access Control Noncooperative: Same origin policy Semicooperative: Third party blocking policy Cooperative:??? 22
23 Why use Password Prefix? Protection mechanism built in to password Does not rely on user to make a decision Same prefix works for everyone Distinguishes secure passwords from normal passwords social security numbers PINs Only use it when you want to 23
24 Why use Password Prefix? Protection mechanism built in to password Does not rely on user to make a decision Same prefix works for everyone Distinguishes secure passwords from normal passwords social security numbers PINs Only use it when you want to 24
25 Other Challenges Password Reset Internet Cafes Dictionary Attacks Spyware, DNS poisoning (no protection) Other issues (described in the paper) Choosing salt for hash Encoding hashed password Additional attacks and defenses 25
26 Password Reset After install, PwdHash can t protect existing pwds Only passwords starting are secure User can choose where to use PwdHash User must enter old password unhashed into password reset page Pwd Prefix makes it easy Old passwords won t be accidentally hashed New, secure passwords are automatically hashed Starts 26
27 Internet Cafes Users cannot install software at Internet Cafes. Would not be a problem if PwdHash were universally available Interim solution: A secure web site for remote hashing, e.g. Hash is computed using JavaScript Server never sees password Resulting hash is copied into clipboard Can also be used as a standalone password generator Internet Explorer Firefox 27
28 Dictionary attacks After phishing attack or break-in to low security site, attacker can repeatedly guess password and check hash. Succeeds on 15% of passwords (unlike 100% today) Less effective on longer, stronger passwords Solution: better authentication protocol (SPEKE, SRP, etc.) Requires server-side changes Defense: user specifies a global pwd to strengthen all pwd hashes Creates a new pwd management problem for shared machines Defense: slow hash function (Halderman, Waters, Felten 05) Increases time of dictionary attack 28
Client-side defenses against web-based identity theft
Client-side defenses against web-based identity theft Students: Robert Ledesma, Blake Ross, Yuka Teraguchi Faculty: Dan Boneh and John Mitchell Stanford University PORTIA Project 1 Phishing Attack Spam
Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer
Financial Cryptography - Feb 13, 2007 Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer Mohammad Mannan and Paul C. van Oorschot Digital Security Group Carleton University,
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 22
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 22 Announcements Project 4 is available on the web: Due Friday April 20th at 11:59 PM Some of today's slides adopted from Dan Boneh
Robust Defenses for Cross-Site Request Forgery
University of Cyprus Department of Computer Science Advanced Security Topics Robust Defenses for Cross-Site Request Forgery Name: Elena Prodromou Instructor: Dr. Elias Athanasopoulos Authors: Adam Barth,
Bank Infrastructure - Video - 1
Bank Infrastructure - 1 05/09/2017 Threats Threat Source Risk Status Date Created Account Footprinting Web Browser Targeted Malware Web Browser Man in the browser Web Browser Identity Spoofing - Impersonation
Hash-based password authentication protocol against phishing and pharming attacks
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING XX, XXX-XXX (201X) Hash-based password authentication protocol against phishing and pharming attacks IKSU KIM 1, YONGYUN CHO 2 1 School of Computer Science
User Authentication + Other Human Aspects
CSE 484 (Winter 2010) User Authentication + Other Human Aspects Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
CS 361S. Phishing. Vitaly Shmatikov
CS 361S Phishing Vitaly Shmatikov $1,500,000,000 Global losses from phishing in 2012 estimated at $1.5 Billion Source: RSA Fraud Report slide 2 MillerSmiles.co.uk slide 3 A Snapshot of My Mailbox service@paypal.com
Applying Context to Web Authentication
Applying Context to Web Authentication John Linn, Burt Kaliski, and Moti Yung, RSA Laboratories; Magnus Nyström, RSA Security Inc. Prepared for W3C Workshop on Transparency and Usability of Web Authentication,
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com KASPERSKY FRAUD PREVENTION 1. Ways of Attacking Online Banking The prime motive behind cybercrime is making money and today s sophisticated criminal
Endpoint Security - what-if analysis 1
Endpoint Security - what-if analysis 1 07/23/2017 Threat Model Threats Threat Source Risk Status Date Created File Manipulation File System Medium Accessing, Modifying or Executing Executable Files File
Passpet: Convenient Password Management and Phishing Protection
Passpet: Convenient Password Management and Phishing Protection Ka-Ping Yee University of California, Berkeley ping@zesty.ca Kragen Sitaker kragen@pobox.com ABSTRACT We describe Passpet, a tool that improves
Robust Defenses for Cross-Site Request Forgery
Robust Defenses for Cross-Site Request Forgery Tsampanaki Nikoleta Lilitsis Prodromos Gigis Petros Paper Authors: Adam Barth, Collin Jackson, John C. Mitchell Outline What is CSRF attack? What is a login
Copyright
1 Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats?
Web Security, Summer Term 2012
IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Web Security, Summer Term 2012 7 Broken Authentication and Session
Web Security, Summer Term 2012
Table of Contents IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Introduction Examples of Attacks Brute Force Session
CS 142 Winter Session Management. Dan Boneh
CS 142 Winter 2009 Session Management Dan Boneh Sessions A sequence of requests and responses from one browser to one (or more) sites Session can be long (Gmail - two weeks) or short without session mgmt:
CS System Security Mid-Semester Review
CS 356 - System Security Mid-Semester Review Fall 2013 Mid-Term Exam Thursday, 9:30-10:45 you may bring one 8-1/2 x 11 sheet of paper with any notes you would like no cellphones, calculators This is to
Security Awareness. Chapter 2 Personal Security
Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords
Authentication Security
Authentication Security Hui Zhu Copyright 2005 www.ebizsec.com Agenda Authentication Components Authentication Hacking Consideration for Authentication Security Principle for Authentication Security Case
How to Render SSL Useless. Render SSL Useless. By Ivan Ristic 1 / 27
How to Render SSL Useless By Ivan Ristic 1 / 27 Who is Ivan Ristic? 1) ModSecurity (open source web application firewall), 2) Apache 2 / 33 Security (O Reilly, 2005), 3) SSL Labs (research and assessment
Security and Privacy
E-mail Security and Privacy Department of Computer Science Montclair State University Course : CMPT 320 Internet/Intranet Security Semester : Fall 2008 Student Instructor : Alex Chen : Dr. Stefan Robila
Robust Defenses for Cross-Site Request Forgery Review
Robust Defenses for Cross-Site Request Forgery Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka October 16, 2011 1 Introduction to the topic and the reason for the topic
NET 311 INFORMATION SECURITY
NET 311 INFORMATION SECURITY Networks and Communication Department Lec12: Software Security / Vulnerabilities lecture contents: o Vulnerabilities in programs Buffer Overflow Cross-site Scripting (XSS)
Part II: Passwords. Ron van der Meyden. (University of New South Wales Sydney, Australia) March 12, R. van der Meyden Part II: Passwords
Part II: Passwords Ron van der Meyden (University of New South Wales Sydney, Australia) March 12, 2013 Passwords An old security mechanism: Soldiers access to camp Secret society handshakes Objective:
Security and Privacy. SWE 432, Fall 2016 Design and Implementation of Software for the Web
Security and Privacy SWE 432, Fall 2016 Design and Implementation of Software for the Web Today Security What is it? Most important types of attacks Privacy For further reading: https://www.owasp.org/index.php/
Web Cash Fraud Prevention Best Practices
Web Cash Fraud Prevention Best Practices Tips on what you can do to prevent Online fraud. This document provides best practices to avoid or reduce exposure to fraud. You can use it to educate your Web
The StrideLinx Remote Access Solution comprises the StrideLinx router, web-based platform, and VPN client.
Introduction: Intended Audience The StrideLinx Remote Access Solution is designed to offer safe and secure remote access to industrial equipment worldwide for efficient remote troubleshooting, programming
Information Security CS 526
Information Security CS 526 Topic 7: User Authentication CS526 Topic 7: User Authentication 1 Readings for This Lecture Wikipedia Password Password strength Salt_(cryptography) Password cracking Trusted
Password. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource.
P1L4 Authentication What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource. Authentication: Who are you? Prove it.
Online auhthentication methods. Evaluate the strength of online authentication methods
Online auhthentication methods Evaluate the strength of online authentication methods Introduction Cornel de Jong System and Network Engineering Universiteit van Amsterdam Spui 21 1012WX Amsterdam Supervisors:
Password Managers: Attacks and Defenses
Password Managers: Attacks and Defenses David Silver!! Suman Jana Dan Boneh Stanford University Eric Chen! Collin Jackson Carnegie Mellon University 8/21/14 Usenix Security 2014 A tool for Convenience?
Stop sweating the password and learn to love public key cryptography. Chris Streeks Solutions Engineer, Yubico
1 Stop sweating the password and learn to love public key cryptography Chris Streeks Solutions Engineer, Yubico Stop Sweating the Password! 2 Agenda Introduction The modern state of Phishing How to become
Kerberos and Single Sign On with HTTP
Kerberos and Single Sign On with HTTP Joe Orton Red Hat Overview Introduction The Problem Current Solutions Future Solutions Conclusion Introduction WebDAV: common complaint of poor support for authentication
Berner Fachhochschule Haute cole spcialise bernoise Berne University of Applied Sciences 2
Table of Contents Hacking Web Sites Broken Authentication Emmanuel Benoist Spring Term 2018 Introduction Examples of Attacks Brute Force Session Spotting Replay Attack Session Fixation Attack Session Hijacking
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
Cross-site request forgery Cross-site scripting Man-in-the-browser Session hijacking Malware Man-in-the-middle DNS cache poisoning DNS spoofing DNS hijacking Dictionary attacks DDoS DDoS Eavesdropping
This presentation covers Gen Z s Security capabilities.
This presentation covers Gen Z s Security capabilities. 1 2 Gen Z architecture assumes every component is an attack vector. This is critical to appreciate, as time and again cyber attacks have exploited
INTERNET SAFETY IS IMPORTANT
INTERNET SAFETY IS IMPORTANT Internet safety is not just the ability to avoid dangerous websites, scams, or hacking. It s the idea that knowledge of how the internet works is just as important as being
Computer Security. 08. Authentication. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Authentication Paul Krzyzanowski Rutgers University Spring 2018 1 Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Protocols such
Computer Security 3/20/18
Authentication Identification: who are you? Authentication: prove it Computer Security 08. Authentication Authorization: you can do it Protocols such as Kerberos combine all three Paul Krzyzanowski Rutgers
EFFICIENT METHOD FOR SECURELY MANAGING PASSWORDS
EFFICIENT METHOD FOR SECURELY MANAGING PASSWORDS 1 ASMA TANVEER, 2 AIHAB KHAN, 3 MALIK SIKANDER HAYAT KHIYAL, 4 SYED AFAQ HUSSAIN 1 Student of Department of Software Engineering Fatima Jinnah Women University,
Securing Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
Addressing Credential Compromise & Account Takeovers: Bearersensitive. Girish Chiruvolu, Ph.D., CISSP, CISM, MBA ISACA NTX April 19
Addressing Credential Compromise & Account Takeovers: Bearersensitive OTPS Girish Chiruvolu, Ph.D., CISSP, CISM, MBA ISACA NTX April 19 Impact Across Every Industry Phishing: Low Cost, Big Impact for
CIS 5373 Systems Security
CIS 5373 Systems Security Topic 4.1: Network Security Basics Endadul Hoque Slide Acknowledgment Contents are based on slides from Cristina Nita-Rotaru (Northeastern) 2 Network Security INTRODUCTION 3 What
Secure Frame Communication in Browsers Review
Secure Frame Communication in Browsers Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka October 16, 2011 1 Introduction to the topic and the reason for the topic being
Pass, No Record: An Android Password Manager
Pass, No Record: An Android Password Manager Alex Konradi, Samuel Yeom December 4, 2015 Abstract Pass, No Record is an Android password manager that allows users to securely retrieve passwords from a server
Securing Internet Communication
Securing Internet Communication CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John Bethencourt, Erika Chin, Matthew Finifter, Cynthia Sturton, Joel Weinberger http://inst.eecs.berkeley.edu/~cs161/
The PKI Lie. The OWASP Foundation Attacking Certificate Based Authentication. OWASP & WASC AppSec 2007 Conference
The PKI Lie Attacking Certificate Based Authentication Ofer Maor CTO, Hacktics OWASP & WASC AppSec 2007 Conference San Jose Nov 2007 Copyright 2007 - The OWASP Foundation Permission is granted to copy,
Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]
![Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]](/thumbs/96/126527464.jpg "Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]")
s@lm@n Microsoft Exam 98-367 Security fundamentals Version: 9.0 [ Total Questions: 123 ] Question No : 1 The Active Directory controls, enforces, and assigns security policies and access rights for all
Proceedings of the 10 th USENIX Security Symposium
USENIX Association Proceedings of the 10 th USENIX Security Symposium Washington, D.C., USA August 13 17, 2001 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION 2001 by The USENIX Association All Rights Reserved
Progressive Authentication in ios
Progressive Authentication in ios Genghis Chau, Denis Plotnikov, Edwin Zhang December 12 th, 2014 1 Overview In today s increasingly mobile-centric world, more people are beginning to use their smartphones
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
COPYRIGHTED MATERIAL. Contents. Part I: The Basics in Depth 1. Chapter 1: Windows Attacks 3. Chapter 2: Conventional and Unconventional Defenses 51
Acknowledgments Introduction Part I: The Basics in Depth 1 Chapter 1: Windows Attacks 3 Attack Classes 3 Automated versus Dedicated Attacker 4 Remote versus Local 7 Types of Attacks 8 Dedicated Manual
Defeating All Man-in-the-Middle Attacks
Defeating All Man-in-the-Middle Attacks PrecisionAccess Vidder, Inc. Defeating All Man-in-the-Middle Attacks 1 Executive Summary The man-in-the-middle attack is a widely used and highly preferred type
CSE 484 / CSE M 584: Computer Security and Privacy. Usable Security. Fall Franziska (Franzi) Roesner
CSE 484 / CSE M 584: Computer Security and Privacy Usable Security Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner,
Drone /12/2018. Threat Model. Description. Threats. Threat Source Risk Status Date Created
Drone - 2 04/12/2018 Threat Model Description Threats Threat Source Risk Status Date Created Mobile Phone: Sensitive Data Leakage Smart Devices Mobile Phone: Session Hijacking Smart Devices Mobile Phone:
WHAT IS CORPORATE ACCOUNT TAKEOVER? HOW DOES IT HAPPEN?
WHAT IS CORPORATE ACCOUNT TAKEOVER? Corporate Account Takeover (also referred to as CATO) is a type of fraud where criminals gain access to a business financial accounts to make unauthorized transactions.
Comodo Internet Security Essentials Software Version 1.3
Comodo Internet Security Essentials Software Version 1.3 User Guide Guide Version 1.3.010518 Comodo Security Solutions 1255 Broad Street Clifton, NJ, 07013 United States Table of Contents Comodo Internet
Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer
Using a Personal Device to Strengthen Password Authentication from an Untrusted Computer Mohammad Mannan and P. C. van Oorschot School of Computer Science Carleton University, Ottawa, Canada Abstract.
Security and Privacy. Xin Liu Computer Science University of California, Davis. Introduction 1-1
Security and Privacy Xin Liu Computer Science University of California, Davis Introduction 1-1 What is network security? Confidentiality: only sender, intended receiver should understand message contents
One-Time-Password-Authenticated Key Exchange
One-Time-Password-Authenticated Key Exchange Kenneth G. Paterson 1 and Douglas Stebila 2 1 Information Security Group Royal Holloway, University of London, Egham, Surrey, UK 2 Information Security Institute
ClientNet. Portal Admin Guide
ClientNet Portal Admin Guide Document Revision Date: June 5, 2013 ClientNet Portal Admin Guide i Contents Introduction to the Portal... 1 About the Portal... 1 Logging On and Off the Portal... 1 Language
Cache Cookies for Browser Authentication (Extended Abstract)
Cache Cookies for Browser Authentication (Extended Abstract) Ari Juels Markus Jakobsson Tom N. Jagatic RSA Laboratories and Indiana University and Indiana University RavenWhite Inc. RavenWhite Inc. ajuels@rsasecurity.com
Looking Forward: Challenges in Mobile Security. John Mitchell Stanford University
Looking Forward: Challenges in Mobile Security John Mitchell Stanford University Outline Mobile platform security SessionJuggler Using phone as authentication token SelectiveAuth Protecting resources on
Deliver Strong Mobile App Security and the Ultimate User Experience
Deliver Strong Mobile App Security and the Ultimate User Experience The Presenters Will LaSala, Director of Services @ VASCO Will has been with VASCO since 2001 and over the years has been involved in
CS 161 Computer Security
Popa & Weaver Fall 2016 CS 161 Computer Security 10/4 Passwords 1 Passwords are widely used for authentication, especially on the web. What practices should be used to make passwords as secure as possible?
CSE 484 / CSE M 584: Computer Security and Privacy. Web Security. Autumn Tadayoshi (Yoshi) Kohno
CSE 484 / CSE M 584: Computer Security and Privacy Web Security Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Ada Lerner, John Manferdelli,
CSCE 813 Internet Security Case Study II: XSS
CSCE 813 Internet Security Case Study II: XSS Professor Lisa Luo Fall 2017 Outline Cross-site Scripting (XSS) Attacks Prevention 2 What is XSS? Cross-site scripting (XSS) is a code injection attack that
<input type="password"> must die!
must die! Daniel R. Sandler and Dan S. Wallach W2SP 2008: Web 2.0 Security & Privacy 2008 May 22, 2008 1 PROBLEM (SOLUTION) This talk is about a big problem. 2 And a small solution.
Ethical Hacking and Prevention
Ethical Hacking and Prevention This course is mapped to the popular Ethical Hacking and Prevention Certification Exam from US-Council. This course is meant for those professionals who are looking for comprehensive
On the Internet, nobody knows you re a dog.
On the Internet, nobody knows you re a dog. THREATS TO DISTRIBUTED APPLICATIONS 1 Jane Q. Public Big Bank client s How do I know I am connecting to my bank? server s Maybe an attacker...... sends you phishing
Who are you? Enter userid and password. Means of Authentication. Authentication 2/19/2010 COMP Authentication is the process of verifying that
Who are you? Authentication COMP620 Authentication is the process of verifying that the user or system is who they claim li to be. A system may be acting on behalf of a given principal. Authentication
P2_L12 Web Security Page 1
P2_L12 Web Security Page 1 Reference: Computer Security by Stallings and Brown, Chapter (not specified) The web is an extension of our computing environment, because most of our daily tasks involve interaction
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA CTO Office www.digi.me another Engineering Briefing digi.me keeping your data secure at all times ALL YOUR DATA IN ONE PLACE TO SHARE WITH PEOPLE WHO
HOST Authentication Overview ECE 525
Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication in real-time
Information Security CS 526
Information Security CS 526 Topic 7: User Authentication CS526 Topic 7: User Authentication 1 Readings for This Lecture Wikipedia Password Password strength Salt_(cryptography) Password cracking Trusted
Wayward Wi-Fi. How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk
Wayward Wi-Fi How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk 288 MILLION There are more than 288 million unique Wi-Fi networks worldwide. Source: Wireless Geographic Logging
Best Practices Guide to Electronic Banking
Best Practices Guide to Electronic Banking City Bank & Trust Company offers a variety of services to our customers. As these services have evolved over time, a much higher percentage of customers have
Password Authenticated Key Exchange by Juggling
A key exchange protocol without PKI Feng Hao Centre for Computational Science University College London Security Protocols Workshop 08 Outline 1 Introduction 2 Related work 3 Our Solution 4 Evaluation
The security of Mozilla Firefox s Extensions. Kristjan Krips
The security of Mozilla Firefox s Extensions Kristjan Krips Topics Introduction The extension model How could extensions be used for attacks - website defacement - phishing attacks - cross site scripting
Chapter 10: Security. 2. What are the two types of general threats to computer security? Give examples of each.
Name Date Chapter 10: Security After completion of this chapter, students should be able to: Explain why security is important and describe security threats. Explain social engineering, data wiping, hard
Web insecurity Security strategies General security Listing of server-side risks Language specific security. Web Security.
Web Security Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming Web Security Slide 1/25 Outline Web insecurity Security strategies General security Listing of server-side risks Language
OpenID Security Analysis and Evaluation
University of British Columbia OpenID Security Analysis and Evaluation San-Tsai Sun, Kirstie Hawkey, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering (LERSSE) University
Security and Authentication
Security and Authentication Authentication and Security A major problem with computer communication Trust Who is sending you those bits What they allow to do in your system 2 Authentication In distributed
Web Security. Course: EPL 682 Name: Savvas Savva
Web Security Course: EPL 682 Name: Savvas Savva [1] A. Barth and C. Jackson and J. Mitchell, Robust Defenses for Cross-Site Request Forgery, pub. in 15th ACM Conference, 2008. [2] L. Huang and A. Moshchuk
Keep Passwords Away from Memory: Password Caching and Verification Using TPM
22nd International Conference on Advanced Information Networking and Applications Keep Passwords Away from Memory: Password Caching and Verification Using TPM Hua Wang, Yao Guo, Xia Zhao, Xiangqun Chen
Backend IV: Authentication, Authorization and Sanitization. Tuesday, January 13, 15
6.148 Backend IV: Authentication, Authorization and Sanitization The Internet is a scary place Security is a big deal! TODAY What is security? How will we try to break your site? Authentication,
IPv6 Traffic Hijack Test System and Defense Tools Using DNSSEC
IPv6 Traffic Hijack Test System and Defense Tools Using DNSSEC Lin Tao lintao850711@sina.com Liu Wu liuwu@cernet.edu.cn Duan Haixin dhx@cernet.edu.cn Sun Donghong sdh@cernet.edu.cn Abstract IPv6 is widely
CSE484 Final Study Guide
CSE484 Final Study Guide Winter 2013 NOTE: This study guide presents a list of ideas and topics that the TAs find useful to know, and may not represent all the topics that could appear on the final exam.
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
INSTRUCTION MANUAL BreakingSecurity.net. Revision Remcos v2.3.0
INSTRUCTION MANUAL Revision 14 -- Remcos v2.3.0 2019 BreakingSecurity.net 1 TABLE OF CONTENTS CHAPTER 1: INTRODUCTION TO REMCOS... 3 USAGE CASES... 3 COMPATIBILITY & DEVELOPMENT... 3 STRUCTURE... 4 CHAPTER
Keywords security model, online banking, authentication, biometric, variable tokens
Volume 4, Issue 11, November 2014 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Authentication
CIS 4360 Secure Computer Systems XSS
CIS 4360 Secure Computer Systems XSS Professor Qiang Zeng Spring 2017 Some slides are adapted from the web pages by Kallin and Valbuena Previous Class Two important criteria to evaluate an Intrusion Detection
CompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management
CompTIA Security+ Lecture Six Threats and Vulnerabilities Vulnerability Management Copyright 2011 - VTC Malware Malicious code refers to software threats to network and systems, including viruses, Trojan
Browser code isolation
CS 155 Spring 2016 Browser code isolation John Mitchell Acknowledgments: Lecture slides are from the Computer Security course taught by Dan Boneh and John Mitchell at Stanford University. When slides are
Breaking SSL Why leave to others what you can do yourself?
Breaking SSL Why leave to others what you can do yourself? By Ivan Ristic 1/ 26 Who is Ivan Ristic? 1) ModSecurity (open source web application firewall), 2) Apache 2/ 33 Security (O Reilly, 2005), 3)
Black Hat Europe 2009
Black Hat Europe 2009 Mobile Security Lab Hijacking Mobile Data Connections 1 Provisioning & WAP primer Forging Messages Demo: Remote provisioning Provisioning: Process and Issues Attack scenario and exploiting
Phishing Read Behind The Lines
Phishing Read Behind The Lines Veljko Pejović veljko@cs.ucsb.edu What is Phishing? "Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and