Pitfalls in Designing Zero-Effort Deauthentication: Opportunistic Human Observation Attacks

Abstract

Deauthentication is an important component of any authentication system. The widespread use of computing devices in daily life has underscored the need for zero-effort deauthentication schemes. However, the quest for eliminating user effort may lead to hidden security flaws in the authentication schemes.As a case in point, we investigate a prominent zero-effort deauthentication scheme, called ZEBRA, which provides an interesting and a useful solution to a difficult problem as demonstrated in the original paper. We identify a subtle incorrect assumption in its adversary model that leads to a fundamental design flaw. We exploit this to break the scheme with a class of attacks that are much easier for a human to perform in a realistic adversary model, compared to the naïve attacks studied in the ZEBRA paper. For example, one of our main attacks, where the human attacker has to opportunistically mimic only the victim's keyboard typing activity at a nearby terminal, is significantly more successful compared to the naïve attack that requires mimicking keyboard and mouse activities as well as keyboardmouse movements. Further, by understanding the design flaws in ZEBRA as cases of tainted input, we show that we can draw on well-understood design principles to improve ZEBRA's security.

WACA: Wearable-Assisted Continuous Authentication

“…The attacker can either try to bypass the system via providing data from his smartwatch or can try to use the victim's smartwatch somehow obtained (e.g., can steal it or victim can leave it behind). • More Powerful Adversaries: Furthermore, a powerful adversary can be aware of WACA and try to defeat it using special tools and skills by imitating legitimate users [19], [20] or launching statistical attacks [21], [22]. This powerful adversary (insider or outsider) can be a human or a trained bot.…”

“…In this subsection, we evaluate the performance of WACA against two powerful attacks: imitation [19], [20] and statistical [21], [22] attacks. In these attacks, the attacker is aware of WACA and can try to defeat WACA using special tools and skills.…”

“…Zero-effort attacks will not be successful due to the low EER values in WACA as analyzed in the previous sub-sections. However, the effectiveness of the imitation attacks performed by a human should be investigated as noted in some recent studies [19], [20].…”

“…Fortunately, WACA can provide a better solution for these inactive cases. If the smartwatch deployed for data collection has a proximity sensor (or using the Bluetooth signal strengths [20]), the user's closeness to the computer can be checked. If the user moves away, then the user can be logged out.…”

“…(iii) How accurately can it identify an insider? Moreover, we also evaluated the robustness of our proposed method against powerful attacks, including, imitation [19], [20], statistical [21], [22], and insider attacks. Contributions: The main contributions of this work are summarized as follows:…”