Targeted Online Password Guessing
Top Cited Papers
- 24 October 2016
- conference paper
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 1242-1254
- https://doi.org/10.1145/2976749.2978339
Abstract
While trawling online/offline password guessing has been intensively studied, only a few studies have examined targeted online guessing, where an attacker guesses a specific victim's password for a service, by exploiting the victim's personal information such as one sister password leaked from her another account and some personally identifiable information (PII). A key challenge for targeted online guessing is to choose the most effective password candidates, while the number of guess attempts allowed by a server's lockout or throttling mechanisms is typically very small. We propose TarGuess, a framework that systematically characterizes typical targeted guessing scenarios with seven sound mathematical models, each of which is based on varied kinds of data available to an attacker. These models allow us to design novel and efficient guessing algorithms. Extensive experiments on 10 large real-world password datasets show the effectiveness of TarGuess. Particularly, TarGuess I~IV capture the four most representative scenarios and within 100 guesses: (1) TarGuess-I outperforms its foremost counterpart by 142% against security-savvy users and by 46% against normal users; (2) TarGuess-II outperforms its foremost counterpart by 169% on security-savvy users and by 72% against normal users; and (3) Both TarGuess-III and IV gain success rates over 73% against normal users and over 32% against security-savvy users. TarGuess-III and IV, for the first time, address the issue of cross-site online guessing when given the victim's one sister password and some PII.Keywords
Funding Information
- National Key Research and Development Plan (2016YFB0800600)
- National Natural Science Foundation of China (61472016; 61472083)
This publication has 22 references indexed in Scilit:
- A study of personal information in human-chosen passwords and its security implicationsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2016
- Monte Carlo Strength EvaluationPublished by Association for Computing Machinery (ACM) ,2015
- Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of PasswordsIEEE Transactions on Dependable and Secure Computing, 2015
- Passwords and the evolution of imperfect authenticationCommunications of the ACM, 2015
- A Large-Scale Evaluation of High-Impact Password Strength MetersACM Transactions on Information and System Security, 2015
- Statistics on Password Re-use and Adaptive Strength for Financial AccountsLecture Notes in Computer Science, 2014
- The Tangled Web of Password ReusePublished by Internet Society ,2014
- Electronic Authentication GuidelinePublished by National Institute of Standards and Technology (NIST) ,2013
- Does my password go up to eleven?Published by Association for Computing Machinery (ACM) ,2013
- The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million PasswordsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2012