A Protection Technique for Screen Image-Based Authentication Protocols Utilizing the SetCursorPos Function

Oh, Insu; Lee, Kyungroul; Yim, Kangbin

doi:10.1007/978-3-319-93563-8_20

Cited by 4 publications

(5 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the attacker does not distinguish which data are real mouse data and which are fake, and as a result, the defense program effectively prevents the mouse data from being exposed. The process of this defense technique is shown in Figure 4 [9], and an example implementation result is shown in Figure 5 [9].…”

Section: Technique For Protecting Mouse Data Using the Wm_input Messagementioning

confidence: 99%

“…Despite these efforts, attack techniques have emerged that steal mouse data input from mouse devices via the GetCursorPos() function or the WM_INPUT message [6][7][8]. To prevent exposure mouse data from being compromised by mouse data attack techniques, mouse data defense techniques have emerged using the SetCursorPos() function or the WM_INPUT message [9]. These techniques effectively protect mouse data by preventing attackers from classifying real mouse data and fake mouse data by interfering with the generation of fake mouse data by defenders.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Mouse Data Attack Technique Using Machine Learning in Image-Based User Authentication: Based on a Defense Technique Using the WM_INPUT Message

Jung,

Hong,

Lee

2024

Electronics

View full text Add to dashboard Cite

Recently, as the non-face-to-face society persists due to the coronavirus (COVID-19), the Internet usage rate continues to increase, and input devices, such as keyboards and mice, are mainly used to authenticate users in non-face-to-face environments. Due to the nature of the non-face-to-face environment, important personal data are processed, and since these personal data include authentication information, it is very important to protect them. As such, personal information, including authentication information, is entered mainly from the keyboard, and attackers use attack tools, such as keyloggers, to steal keyboard data in order to grab sensitive user information. Therefore, to prevent disclosure of sensitive keyboard input, various image-based user authentication technologies have emerged that allow sensitive information, such as authentication information, to be entered via mouse. To address mouse data stealing vulnerabilities via GetCursorPos() function or WM_INPUT message, which are representative mouse data attack techniques, a mouse data defense technique has emerged that prevents attackers from classifying real mouse data and fake mouse data by the defender generating fake mouse data. In this paper, we propose a mouse data attack technique using machine learning against a mouse data defense technique using the WM_INPUT message. The proposed technique uses machine learning models to classify fake mouse data and real mouse data in a scenario where the mouse data defense technique, utilizing the WM_INPUT message in image-based user authentication, is deployed. This approach is verified through experiments designed to assess its effectiveness in preventing the theft of real mouse data, which constitute the user’s authentication information. For verification purposes, a mouse data attack system was configured, and datasets for machine learning were established by collecting mouse data from the configured attack system. To enhance the performance of machine learning classification, evaluations were conducted based on data organized according to various machine learning models, datasets, features, and generation cycles. The results, highlighting the highest performance in terms of features and datasets were derived. If the mouse data attack technique proposed in this paper is used, attackers can potentially steal the user’s authentication information from various websites or services, including software, systems, and servers that rely on authentication information. It is anticipated that attackers may exploit the stolen authentication information for additional damages, such as voice phishing. In the future, we plan to conduct research on defense techniques aimed at securely protecting mouse data, even if the mouse data attack technique proposed in this paper is attempted.

show abstract

Section: Technique For Protecting Mouse Data Using the Wm_input Messagementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Mouse Data Attack Technique Using Machine Learning in Image-Based User Authentication: Based on a Defense Technique Using the WM_INPUT Message

Jung,

Hong,

Lee

2024

Electronics

View full text Add to dashboard Cite

show abstract

“…To counteract this vulnerability, a defense technique that can prevent the mouse position exposure has been studied. 17 This technique is the disturbance of the attacker by the random generation of arbitrary coordinates, but it does not prevent the extraction of the mouse position so the attacker cannot know the correct coordinates. Accordingly, it is possible to protect against the attack without exposing the mouse position.…”

Section: Existing Defense Techniques Of the Mouse Data Exposurementioning

confidence: 99%

“…This attack exploits a vulnerability that can be obtained using the screen x and y coordinates in the calling of the GetCursorPos() function. To counteract this vulnerability, a defense technique that can prevent the mouse position exposure has been studied . This technique is the disturbance of the attacker by the random generation of arbitrary coordinates, but it does not prevent the extraction of the mouse position so the attacker cannot know the correct coordinates.…”

Section: Related Workmentioning

confidence: 99%

Vulnerability analysis on the image‐based authentication: Through the WM_INPUT message

Lee

Yim

Lee

2019

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

Summary We verified the mouse data exposure using the WM_INPUT message handler that obtains the mouse‐inputted data to derive the vulnerability of the image‐based authentication. Consequently, the mouse data were exposed on most of the banking and payment sites of South Korea. Experiment results show that the mouse data are exposed in image‐based authentication in six Internet banking services. Therefore, we proved that the safety of the authentication information is vulnerable even when image‐based authentication is applied. In the future, we will propose an image‐based authentication method to solve the vulnerability found from this paper and derive a set of criteria for the vulnerability analysis of image‐based authentication for the security assessment.

show abstract

“…In order to cope with the mouse attack technique, a mouse data protection technique that uses the SetCursorPos() function that prevents an attacker from tracking the mouse movement has emerged [11]. The key idea of this defense technique is not to expose the actual location input from the user, but to expose the mouse location information.…”

Section: Introductionmentioning

confidence: 99%

Vulnerability Analysis Challenges of the Mouse Data Based on Machine Learning for Image-Based User Authentication

2019

Self Cite

View full text Add to dashboard Cite

With the change from the pre-internet era to online society, user authentication technology is required, and for that, password-based authentication technology is generally used. However, the technology has vulnerabilities and security threats that cannot ensure security and reliability, due to the exposure of the keyboard data that comprises a password input from the keyboard. In order to settle this problem, imagebased authentication technology has emerged; but the password input from the mouse is not secure, due to the exposure of the mouse data. This problem has led to the emergence of mouse data protection technology. This technology protects mouse data by generating a large number of random mouse positions at any time, thereby inducing an attacker to track any mouse position generated by the defender, even if the attacker takes over the mouse data. Therefore, this mouse protection technology almost completely defends against existing mouse data attack techniques. With mouse data protection technology applied, the challenge of this paper is to verity the feasibility of mouse data attack. For the experiment, we collected both random mouse data generated by the defender and real mouse data input from the user, and verified the security of mouse data using mouse data classification based on machine learning. As a result of the experiment, we have verified the stealing of mouse data by using the proposed method with high quality, even if existing techniques of mouse data attack do not steal real mouse data. The best accuracy is 98%. In other words, the proposed method almost completely classifies the mouse data input from the user. Consequently, this paper derives and verifies the vulnerability and security threat of image-based authentication technology. Moreover, the vulnerability and security threat found in this paper not only constitute a new vulnerability and security threat, but can also be used as a criterion in security analysis and evaluation for image-based authentication technology.

show abstract

A Protection Technique for Screen Image-Based Authentication Protocols Utilizing the SetCursorPos Function

Cited by 4 publications

References 3 publications

Mouse Data Attack Technique Using Machine Learning in Image-Based User Authentication: Based on a Defense Technique Using the WM_INPUT Message

Mouse Data Attack Technique Using Machine Learning in Image-Based User Authentication: Based on a Defense Technique Using the WM_INPUT Message

Vulnerability analysis on the image‐based authentication: Through the WM_INPUT message

Vulnerability Analysis Challenges of the Mouse Data Based on Machine Learning for Image-Based User Authentication

Contact Info

Product

Resources

About