NDLI: Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes

Please wait, while we are loading the content...

LiveLabs: Building In-Situ Mobile Sensing & Behavioural Experimentation TestBeds

Listening through a Vibration Motor

Beetle: Flexible Communication for Bluetooth Low Energy

Mobility Modeling and Prediction in Bike-Sharing Systems

DefDroid: Towards a More Defensive Mobile OS Against Disruptive App Behavior

Expansion of Human-Phone Interface By Sensing Structure-Borne Sound Propagation

FOCUS: Robust Visual Codes for Everyone

CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices

Platypus: Indoor Localization and Identification through Sensing of Electric Potential Changes in Human Bodies

Practical Human Sensing in the Light

MCDNN: An Approximation-Based Execution Framework for Deep Stream Processing Under Resource Constraints

Defending against Sybil Devices in Crowdsourced Mapping Services

I-Pic: A Platform for Privacy-Compliant Image Capture

FlashBack: Immersive Virtual Reality on Mobile Devices via Rendering Memoization

Practical Bluetooth Traffic Sniffing: Systems and Privacy Implications

Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes

The Design and Implementation of a Mobile RFID Tag Sorting Robot

I am a Smartwatch and I can Track my User's Arm

TaskFolder: Dynamic and Fine-Grained Workload Consolidation for Mobile Devices

TransitLabel: A Crowd-Sensing System for Automatic Labeling of Transit Stations Semantics

What You Mark is What Apps See

uLink: Enabling User-Defined Deep Linking to App Content

Characterizing and Improving WiFi Latency in Large-Scale Operational Networks

Privacy Capsules: Preventing Information Leaks by Mobile Apps

Idea: A System for Efficient Failure Management in Smart IoT Environments

BodyScan: Enabling Radio-based Sensing on Wearable Devices for Contactless Activity and Vital Sign Monitoring

Understanding the Characteristics of Android Wear OS

Reactive Control of Autonomous Drones

Viola: Trustworthy Sensor Notifications for Enhanced Privacy on Mobile Systems

ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic

Regulating ARM TrustZone Devices in Restricted Spaces

Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes

Content Provider	ACM Digital Library
Author	Khan, Hassan Hengartner, Urs Vogel, Daniel
Abstract	Touch input implicit authentication (``touch IA'') employs behavioural biometrics like touch location and pressure to continuously and transparently authenticate smartphone users. We provide the first ever evaluation of targeted mimicry attacks on touch IA and show that it fails against shoulder surfing and offline training attacks. Based on experiments with three diverse touch IA schemes and 256 unique attacker-victim pairs, we show that shoulder surfing attacks have a bypass success rate of 84% with the majority of successful attackers observing the victim's behaviour for less than two minutes. Therefore, the accepted assumption that shoulder surfing attacks on touch IA are infeasible due to the hidden nature of some features is incorrect. For offline training attacks, we created an open-source training app for attackers to train on their victims' touch data. With this training, attackers achieved bypass success rates of 86%, even with only partial knowledge of the underlying features used by the IA scheme. Previous work failed to find these severe vulnerabilities due to its focus on random, non-targeted attacks. Our work demonstrates the importance of considering targeted mimicry attacks to evaluate the security of an implicit authentication scheme. Based on our results, we conclude that touch IA is unsuitable from a security standpoint.
Starting Page	387
Ending Page	398
Page Count	12
File Format	PDF EPUB
ISBN	9781450342698
DOI	10.1145/2906388.2906404
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-06-20
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Shoulder surfing attacks Mimicry attacks Continuous authentication Implicit authentication
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Investigating gesture-based password: usability and vulnerability to shoulder-surfing attacks

WYSWYE: shoulder surfing defense for recognition based graphical passwords

Multi-touch authentication on tabletops

Operation Code Authentication preventing shoulder surfing attacks

S3TFPAS: Scalable shoulder surfing resistant textual-formula base password authentication system

LatentGesture: active user authentication through background touch analysis

Assessing the vulnerability of magnetic gestural authentication to video-based shoulder surfing attacks

A Gaze Gesture-Based User Authentication System to Counter Shoulder-Surfing Attacks

A graphical password against spyware and shoulder-surfing attacks

Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes

Similar Documents

Investigating gesture-based password: usability and vulnerability to shoulder-surfing attacks

WYSWYE: shoulder surfing defense for recognition based graphical passwords

Multi-touch authentication on tabletops

Operation Code Authentication preventing shoulder surfing attacks

S3TFPAS: Scalable shoulder surfing resistant textual-formula base password authentication system

LatentGesture: active user authentication through background touch analysis

Assessing the vulnerability of magnetic gestural authentication to video-based shoulder surfing attacks

A Gaze Gesture-Based User Authentication System to Counter Shoulder-Surfing Attacks

A graphical password against spyware and shoulder-surfing attacks

Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes