Evaluation of passwords' vulnerability to shoulder surfing attacks : doctoral dissertation
Ocenjevanje ranljivosti gesel na napad z opazovanjem

english

doktorska dela

2022

authentication   experimental design   graphical passwords   shoulder surfing   textual passwords   vulnerability evaluation

Univerza v Mariboru, Fakulteta za elektrotehniko računalništvo in informatiko

The password security problem is one of the most critical challenges in the field of information security. It is characterized by the increasing security deficiencies of textual passwords that have dominated the authentication space for half a century. Over this time, methods aiming to replace them have been proposed, all bearing different sets of flaws. Among them, graphical passwords stand out as an alternative that improves on the resilience to brute-force attacks, while attaining a reasonable level of usability and deployability. However, their visual prominence potentially makes them more vulnerable to physical observation.Shoulder surfing attack (SSA) is a social engineering technique that is often considered in the context of graphical authentication. Despite that, the vulnerability to this attack vector is rarely evaluated empirically, and the existing experimental evaluations suffer from poor quality and validity. The main purpose of this research was to examine the reasons behind substandard empirical SSA evaluations, and to design appropriate methodological improvements to facilitate high-quality SSA evaluation.In the exploratory phase, we conducted a systematic review of the shoulder surfing literature. The investigation identified two major problems. Firstly, a multitude of vulnerability metrics are employed across the literature, mainly due to a limited understanding of the SSA phenomenon and underlying factors that affect it. Secondly, SSA experiments are usually designed based on arbitrary ad-hoc decisions because researchers rely on intuition and expert knowledge to determine circumstances in which given methods are vulnerable to observation.To address the problem of SSA susceptibility measurement, we constructed a vulnerability metric ensemble from all potential measures. Individual metrics were normalized and adapted to consider partial guesses, before they were combined into composite metrics based on their core focus and similarity. This approach allowed for general and in-depth analyses of a given method's susceptibility to SSA from several points of view. Ultimately, this enables researchers to explore the potential factors and underlying reasons behind why a given method may be susceptible to observation.The established ensemble was integrated into a SSA evaluation framework. It comprised a set of 30 parameters: 10 to describe the method's design aspects and establish circumstances in which the method may be vulnerable to observation, and 20 to determine the most suitable experimental setup based on the threat model. The framework was devised with the intention to provide researchers with a methodological apparatus to facilitate high-quality SSA experiment design and execution. In pursuit of this goal, revisions of the framework are expected through novel insight obtained from the executed experiments.The evaluation framework and vulnerability metric ensemble were validated in a live shoulder surfing experiment. A total of 276 participants were recruited to simulate malicious and incidental observers attacking three authentication methods: textual passwords, the Game Changer Password System, and association lists. Eight experimental groups were compared and analyzed in terms of all SSA vulnerability metrics and login times under various experimental conditions. The results confirm that graphical methods are more susceptible to physical observation, due to their visual prominence and transparency of human-computer interaction.The work performed in this dissertation makes a key contribution toward an objective and comprehensive evaluation of the SSA vulnerability. Through continuous improvement of the evaluation framework and the vulnerability metric ensemble, the quality of empirical SSA studies is expected to grow. The obtained insight should increase researchers' understanding of the shoulder surfing phenomenon, and promote future design of SSA-resistant authentication mechanisms.

07.08.2023