Outline. Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

Size: px

Start display at page:

Download "Outline. Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion"

Lorin Victoria Garrett
5 years ago
Views:

2 Outline Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

3 Traditional two factor Authentication

4 Traditional two factor Authentication

5 Sound Proof Two factor Authentication

6 Sound Proof Two factor Authentication

7 Security of Sound-Proof Goal is to defeat a remote attacker Assumption: Attacker cannot guess the victim environment

8 Our Attack Approach No need to predict the ambient environment of the phone. Rather, make the phone create predictable or previously know sounds.

9 Contributions made Novel attack against a notable zero-effort 2FA scheme. Correlation analysis of the attack system. Real-world attack strategies based on population statistics.

10 Outline Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

11 Threat Model The Attacker Knows victim s credentials from a leaked Database. Has not compromised user s phone. Is not co-located with the victim. Knows user s Phone #, and other personal information.

12 Sound-Proof Architecture

13 Sound-Proof Correlation Algorithm One-third octave band: Divides audio into bands ranging from 50Hz to 4kHz. Results 20 One-third octave bands. Compute maximum cross-correlation for each band Corr(i,j) = max(crosscorr(xi,xj))

14 Outline Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

15 Attack Details

16 Types of Attacks Ringtone Attacks e.g. Phone Call, Viber, Whatsapp, Facebook, Skype, FaceTime. App Notification Attack e.g. SMS, Skype, Whatsapp, Viber.

17 Parameterization for Attack Evaluation Collected audio samples at different locations, such as lab/office, Home, Café, Library. Total 525 audio pairs samples collected. Correlation thresholds chosen for attack evaluations are: Tc = , 0.18, 0.2

18 Attack Success Rate

19 Population Statistics Recruited 113 Amazon Mechanical Turk workers. Found two most popular phone brands iphone (39%) and Samsung (27%) Queried Type of Ringtone default, vibrate or silent In different situations while at work, home or asleep

20 Popular ringtone setting for Samsung and iphone

21 Popular ringtone setting for Samsung and iphone

22 Popular ringtone setting for Samsung and iphone

23 Popular ringtone setting for Samsung and iphone

24 Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack on each round. Compromised user accounts(cn) can be computed by CN(i) = device * state * Itt(k) * UN(i-1) Fraction of compromised user account at ith round.

Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack

25 Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack on each round. Compromised user accounts(cn) can be computed by CN(i) = device * state * Itt(k) * UN(i-1) Probability of owning a specific type of device

26 Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack on each round. Compromised user accounts(cn) can be computed by CN(i) = device * state * Itt(k) * UN(i-1) Probability of phone being in a particular state.

27 Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack on each round. Compromised user accounts(cn) can be computed by CN(i) = device * state * Itt(k) * UN(i-1) Interative Success rate = [ 1 ( 1 x ) ^ k ], k = 3

28 Real World Attack Strategy Survey result help to device a real-world attack strategy Attack strategy contains of multiple rounds Different type of attack on each round. Compromised user accounts(cn) can be computed by CN(i) = device * state * ltt(k) * UN(i-1) Uncompromised User Accounts from the previous round.

29 A Real World Attack

30 A Real World Attack

31 A Real World Attack

32 A Real World Attack

33 Outline Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

34 Potential Mitigations Disabling TSA during call/notification. Customized ringtone frequently Mixing sound and vibration. Blocking sound creation during recording Detection of device emitted audio during recording.

35 Outline Introduction Background Attack and Analysis Potential Mitigations Discussion and Conclusion

36 Discussion: Other Security Applications Sound-based co-presence detection. Sound-based device pairing.

37 Conclusions Zero-effort TFA based on ambient audio is an attractive proposition. We showed it is susceptible to practical remote attack. Demands mitigation strategies Mitigation should not compromise usability.

U.S. Mobile Consumers and OTT Services: Who uses which apps to watch video and connect? Market Study 2Q 2017

U.S. Mobile Consumers and OTT Services: Who uses which apps to watch video and connect? Market Study 2Q 2017 U.S. Mobile Consumers and OTT Services: Who uses which apps to watch video and connect? Market