Something You Know

Something you know is a method which a supplicant uses what they remember to prove their identity. In other words, the user would use what is stored in their memory to prove that they are really who they claim to be. A good example for this authentication method is a password or a PIN code for a cash point.

In a simple view, something-you-know authentication process works in two parts as follows: The first is the registration phase. The second is the authentication phase. During the registration, a supplicant or a user chooses a password of their choice. The password is then stored in a password database, which marks the end of the registration. Note that there may be some processing done to the password before storing. However, for the sake of simplicity, this process will be ignored and will be explained in detail in Chapter 4.

In the authentication stage, the supplicant enters their password. The comparison is then made between the entered password and the previously stored password. If they match, an access to the system or resources is granted. Otherwise, the access is denied. This process is depicted in Figure 3-3.

Some have asked whether or not a username or an email address is a something-you-know factor of authentication since they have to be memorized and entered into a system when logging in. The answer is no. Usernames and email addresses are not considered as a factor of authentication. They are simply used to claim an identity of the user or supplicant, which is known as identification. A password or a PIN code is the element used to prove the ownership of the identity. Hence, it is a something-you-know factor of authentication.

Something You Have

The second factor of authentication requires that a supplicant has a physical item in their possession. This includes smart cards and authentication tokens. An authentication token is a small device, usually in the form of a key ring, with a screen to display a set of numbers. The numbers on the token’s screen is used as a passcode for the authentication process. An authentication token can be either synchronous or asynchronous. A synchronous token is synchronized with an authenticator or an authentication server. They use the time to generate a number that will be entered during the user login phase. That is, the token has a function f() that takes the current time t as an input and computes a password PWD_t for that particular moment. In simple terms, this can be expressed as PWD_t = f(t). When a user would like to log into a system, they enter a username together with the number displayed on the token.

For the verification process, the authentication server carries out the same process. That is, the authentication server also uses the function f(), which takes the current time t as its input, to compute the password PWD_t . The computed and received passwords are compared. If they match, the supplicant is allowed to enter the system, or is successfully authenticated. The authentication process of a typical synchronous authentication token is illustrated in Figure 3-4.

Asynchronous authentication token is the second type of token which works in a slightly different way from the synchronous one. With this type, the token and server do not have to be time-synchronized. When a user would like to log in, an authentication server will send the user a random sequence of digits, which will then be entered into the token. The authentication token computes a passcode from the entered numerical sequence as a response. To complete the login process, the user enters the passcode into the system to gain access.

In other words, when logging into a system, the challenge x generated by the authentication server is used as an input into a function f(), usually a hash function, on the token. The password PWD_x = f(x) is then computed and transmitted to the authentication server by the token. On the authenticator side, the verification process is carried out by also computing the PWD_x = f(x), which is then compared with the received password. If they match, the authentication is a success, else the process fails. The authentication process of a typical asynchronous authentication token is illustrated in Figure 3-5.

The main advantage of using an authentication token, either synchronous or asynchronous, is that the user’s password changes every time they log in. This is also known as time-based one-time password or TOTP for the synchronous token and hash-based one-time password or HOTP for the asynchronous token. Both of them reduce the risk of passwords being guessed by attackers.

Something You Are

The third authentication factor deals with the characteristics of the supplicant. This is a process of using body measurements, known as biometrics. Simply put, the something-you-are factor of authentication requires that the authenticator authenticates the supplicant by using biometric information. Commonly used biometrics for authentication purposes include fingerprint, palm print, hand geometry, face, iris and retina. However, only fingerprint, retina and iris are considered truly unique. With today’s technology, other types of biometrics include signature dynamics and keyboard typing pattern.

This method of authentication can be thought of as a traditional identification and authentication method. For example, when a person enters a bank, they are asked to show a photo ID. The person is then identified and authenticated based on their biometric parameters. That is, the bank matches the face of the person with the face on the ID card. This is a form of facial recognition and can be analogous with today’s biometric authentication method.

The process of biometric authentication works in two main parts. The first is the registration or enrollment. The second is authentication. In the registration phase, biometric data is captured by a biometric sensing device, such as a fingerprint scanner for fingerprint data or a camera for facial data. The captured data is then processed in order to extract and transform it into a biometric template. The obtained biometric template is stored in a database where an authentication process can be made later.

The authentication process begins when the biometric data of the supplicant is captured and processed for the extraction and transformation to obtain the person’s biometric information. It is then compared with the biometric template which is stored in the database. If they match, the authentication process is a success. Otherwise, the authentication process fails. This process is summarized in Figure 3-6.

On the whole, biometric authentication works by comparing the user’s actual characteristic with the stored data in order to determine if the user is really they are claiming to be. Biometric authentication comes with an issue, which is the fact that it is possible for human characteristics to change over time. This is due to aging, illness or injury. Therefore, fallback or failsafe authentication mechanisms should be created just in case.

Something You Process

This type of authentication factor is based on the ability of a supplicant to process things. The something-you-process factor works with human cognitive level of authentication. In other words, instead of asking the supplicant to enter their password, the system asks them to perform a mathematical or logical task. Typically, these tasks involve some secrets known to the user as well as some variable values provided by the system. The output of the process done by the user will form a new code or a new pass that will be used in this particular authentication session between the user and the system. This authentication method provides a different outcome each time the supplicant processes the given task. It means that the value used to authenticate the supplicant by the authenticator differs from session to session.

Figure 3-7 shows a simple example of an authentication mechanism based on the something you process. During the formula registration phase, the user must memorize the positions in the given grid, the mathematical operations or their choice, and the constant number, if any. These will form their personal mathematical formula. For example, the mathematical formula from the grid formed during the registration phase could be aa ∗ 1 + bb + 3, where aa and bb are examples of grid positions in the intersections of row a with column a and row b with column b, respectively. This is something that the user has to memorize.

During the login session, the user is presented with a grid with a random value in each cell. In order to log in, they have to compute the outcome of the formula chosen in the registration stage.

Carrying on with the same example in Figure 3-7, the value in the cell aa is 7. The value in the cell bb is 7. Therefore, the result of the mathematical formula aa ∗ 1 + bb + 3 is 7 ∗ 1 + 7 + 3 = 17, which is entered as the passcode for this particular login session.

Although the one-time passcode, as noted previously, produced by the user’s computational process is a positive point, this something-you-process authentication is time consuming and cognitively demanding. This is due to the process of recalling the mathematical formula and the process of computing the outcome during the login session. This is one of the reasons why this type of authentication factor is not as commonly used as the ones mentioned earlier .

Somewhere You Are

The somewhere-you-are factor of authentication , although not as well-known as the others, has been proposed since the 1990s. Somewhere you are concerns with the physical location of the supplicant. Some may even call it the location-based authentication. The implementation of the somewhere you are is currently limited in online systems. However, there are several methods that can be used to achieve this.

Firstly, an IP address can be used to detect the location of the supplicant. Suppose that the supplicant would like to use a service that requires a geolocation security check. When they register to use the service, they state that they live in the Kingdom of Thailand. That means if someone attempts to log in to this particular account from an IP address located in the United States, the service will either notify the supplicant that an attempt from outside of Thailand has been made or it will terminate the session thinking that it is an adversary trying to log in. The use of an IP address is useful in making an effort to protect the account from an adversary.

Some financial institutions use this particular method to detect payment frauds. For instance, if the last known location of a user was in the Kingdom of Thailand, however, a few minutes later, the same account is logged in or the credit card associated to this account is used in China, this could indicate an unusual activity.

Another method of using the somewhere-you-are factor is mobile based and also used by financial institutions. This method suggests that the geolocation of the user’s mobile device is proximate to that computer being used for the current session or transactions. Based on the result, the banking system can make a decision whether to accept or reject the transactions. This process of the authentication using the somewhere-you-are factor is shown in Figure 3-8.

The preceding authentication procedure has the following advantage: Suppose a user walks away from their computer without logging out, leaving the current session open. In a normal situation, any other user can utilize this opened session to try to impersonate this user. The somewhere-you-are factor can reduce the risk by authenticating the user’s mobile device’s geolocation. The session can remain active if the locations of the mobile device and the computer are identical. However, if there is enough error on the location, the session can automatically be closed. Thus, no other users should be able to come in and use the user’s session.

Somebody You Know

The somebody-you-know factor of authentication works based on the human social relationship. The somebody-you-know authentication method was designed for an emergency situation where an authentication token is not available to the user. When the token is not available, there must be another means for the user to utilize in order to log into a computer system. This is where the relationship between users comes in. The process works as follows.

In the enrollment stage, the relationship between two users, say Alice and Bob, is recorded by the server as an asker and a helper. When Alice, the asker, who has lost the ability to use her authentication token, wants to log into the system, she contacts Bob, the helper. The channel of contact can be either over a telephone or face to face in order to make it easy for Bob to authenticate Alice, either by voice recognition over the phone or face recognition during face-to-face contact, respectively.

Once Bob is certain that the asker is really Alice, he uses his own client machine to carry out his authentication with the server, who also verifies the asker–helper relationship of Alice and Bob. If the relationship verification is successful, Bob receives a vouchcode from the server, who marks that there is an ongoing helping session between Alice and Bob.

Bob, the helper, then gives the vouchcode to Alice, the asker. This can be done orally in the case of telephone communication or as a written value in the case of face-to-face contact .

At this stage, Alice enters her username, password, and the newly received vouchcode to the server. The server then verifies Alice’s password and vouchcode and makes the decision to either accept or reject the authentication attempt.

If the authentication succeeds, the server provides the asker, Alice, with a temporary password. Subsequently, Alice can carry out an authentication process with the server using her password together with this temporary password, which will usually be valid for one or two days.

The vouching and authentication process based on the relationship between the asker and helper is summarized in Figure 3-9.

It is important to note that this authentication process only works if and only if the relationship between the asker and helper is valid and successfully verified by the server. This implies that it is necessary for a user to know someone if they would like to carry out an authentication process without the availability of their authentication token. There is one disadvantage to this somebody-you-know method. That is, the helper must have an access to the Internet. Otherwise, they will not be able to request and obtain the vouchcode for the asker. However, it is the process that can assist the asker in an emergency situation as explained .

Default Passwords

A default password is a predefined and preconfigured password for a piece of software or a device. Default passwords are commonly used for network equipment such as routers, switches, wireless access points, as well as Internet of Things (IoT) devices. Typical examples of a default password include admin, password, attack, and 1234. Default passwords represent one of the major issues to authentication mechanisms and are very often overlooked.

In many cases, system engineers and developers are so busy working on the implementation of functionality of the systems that they forget about the default passwords. If the default passwords remain unchanged, it can cause a serious problem in that an adversary can easily find a default password for any devices or software on the Internet. Once the password is obtained, the attacker can then log into the device or system and often has the privilege of an administrator. The problem becomes more severe in the case of the IoT environment where many devices’ make and brand can be readily seen by anyone. Hence, a default password can also be comfortably found.

Fortunately, there are ways to counteract the security of default passwords. Firstly, the vendor of software and hardware can employ more secure and unique default passwords. Secondly, the software and hardware vendor can design their devices or systems in such a way that the users are forced to change the password when the default password is used for the first time. Thirdly, on users’ responsibility, the users or device owners must change the default password to a stronger password when they first enter the system or the device .

Eavesdropping

Eavesdropping or sniffing is basically an act of listening to private communications of others without their permission. Therefore, eavesdropping is an easy method to obtain a supplicant’s password as well as other credentials from the traffic on a computer network.

Many applications, devices, and systems transmit information, including passwords and other credentials over the network in an unencrypted format. Typical examples include FTP and HTTP. In their default configurations, these protocols do not encrypt any messages and packets. That means if an adversary wants to eavesdrop or sniff packets off the network, using such application as Wireshark, they will be able to easily obtain passwords in the plaintext format.

In order to protect users’ passwords and credentials, encryption techniques such as AES-128 and AES-256 can be applied. This way, even if the information is sniffed by an attacker, they will still not be able to read it in a meaningful way, making it more secure.

Replay Attacks

A replay attack is another popular way to attack authentication mechanisms. To carry out this attack, it is required that an attacker has an access to the network between two communicating principals. This type of attack can still work even though the attacker does not have an access to the plaintext format of users’ credentials.

The replay attack is done by the attacker copying an entity’s password or credential and using it to carry out authentication with the other entity. The purpose is to impersonate the user whose password or credential is copied. Put it simply, the attacker copies the message or credentials and then sends this same message to an authenticator, hoping that they will be successfully verified.

Timestamping is when the sender of the message records and includes the time that the message is constructed and transmitted. When the message is received, the recipient can check whether the time on the message is current or has already past. It is, therefore, a mechanism that can be used to prevent this type of attack.

In a typical challenge-and-response mechanism, an authenticator generates a random string called a nonce (or number used once) and presents it as a challenge to the supplicant. The supplicant will then manipulate the challenge in some predefined way such as encrypting it or hashing it before sending the result back to the authenticator as the response. Next, the authenticator verifies the received response. The strength of the challenge-and-response mechanism depends on the randomness of the challenge. It should be noted that the challenge has to be freshly generated each time the authentication session takes place. A simple view of the challenge and response is as follows:

Man-in-the-Middle Attacks

Man-in-the-middle or MitM attacks occur when an adversary comes in between two hosts, whether they are a supplicant and an authenticator or a customer and a website, and all messages and communications go through them. By being in between two entities, the attacker can receive and send messages to both parties. That means the attacker can impersonate both entities, making one believe that the attacker is the other. Moreover, not only receiving and transmitting messages from the involving entities, the attacker can also alter and even delete portions of those messages. Thus, an attack on authentication can be carried out as follows.

Provided that the attacker is in between the supplicant and the authenticator usually by acting as a legitimate wireless access point, they can intercept authentication messages, which may include the username and password of the supplicant. The intercepted information can then be relayed by the attacker to the authenticator, making the authenticator believe that the attacker is the supplicant.

In order to reduce the risk of this type of attack, strong encryption is recommended. Another method that can help prevent the attack is the application of a virtual private network or VPN. Both of these methods ensure that the attacker cannot decipher the messages being transmitted during the authentication session.

Password Guessing

Since the beginning of information technology, entity authentication is usually done with a username and a password. Therefore, password guessing is when an adversary tries to guess the username and password and then authenticate as the legitimate user. Obtaining usernames is not difficult for an attacker. This is because a username is frequently just an email address of that user or the attacker might know the naming convention used by that particular organization. Sometimes the attacker even has an access to the directory containing all the usernames of an organization. This is especially the case for an internal attacker. For the password guessing attack, the attacker simply guesses one or more passwords that are likely to be the one used by the user.

The first method that an adversary can use to guess a password is a brute-force attack , which is also known as an exhaustive search. This is an attack where the attacker tries to generate all possible combinations of a password and attempts to authenticate to the system using the username with different combinations of password. The amount of time taken to carry out this attack depends on the size of the password. In simple terms, if the size of the password is 8 characters, which is 64 bits, the total number of password combinations will be 2⁶⁴. With today’s technology, the number of different guesses per second by an ordinary computer is approximately 100,000,000 guesses. That means it would take a normal computer around 184,467,440,737 seconds or 5,850 years.

It is clear that password brute-force attack is very time consuming due to the large number of password combinations. Therefore, to decrease the time required to guess the password, a dictionary attack can be carried out. A dictionary attack is a method an attacker uses to breach a password-protected authentication mechanism by attempting each word in a dictionary as a password. It is possible for this attack to be successful because many users tend to use word in a dictionary as their password. However, the dictionary attack becomes more complicated when users choose longer and stronger passwords. As a result, a new variety of the dictionary attack, known as password dictionary attack, has been formed.

A password dictionary attack is still considered a brute-force attack and also a dictionary attack. This time an attacker tries to guess a user’s password by using a dictionary of commonly used passwords. Over a period of time, an attacker or a community of attackers has collected a lot of data containing passwords that are thought to have been chosen by users. The data in the database can then be used as password guesses when attempting to compromise the authentication system. In addition, these commonly used passwords can lead to an attack called password spraying attack.

A password spraying attack is a type of attack that relies on a few popular passwords that are used by users. These passwords are used to attempt to access a large number of accounts. In other words, a password spraying attack is when an attacker takes a large number of accounts or usernames and tries to authenticate them with one or a very small number of passwords. It is done with the hope that they will be successfully authenticated by the authenticator, hence being able to impersonate the legitimate user.

All the password guessing attacks can be prevented by asking users to select a strong password and to stop password reuse in different password-protected systems. More detail on passwords and password-based authentication will be provided in the next chapter.

Credential Stuffing

Credential stuffing is actually another form of password guessing attack. This type of password attack has become more widespread in recent years. Credential stuffing is an attack that takes advantage of the users’ failure to select different passwords for different accounts. In other words, credential stuffing works because users reuse their password for various accounts, and statistically more than 73% of passwords are reused.

The way the attacker carries out credential stuffing is as follows: First, the attacker tries to acquire a password or credential of a user by breaching a system or from a leaked-password directory that may be available on the Internet. A compromised password is then used in an attempt to log into various other accounts or systems of the same user.

There are several suggestions made by OWASP for preventing credential stuffing attack. They include the use of different passwords for different accounts, the use of a CAPTCHA, and the use of multi-factor authentication (MFA) which will be explained in detail in Chapter 6.

Social Engineering

Social engineering is considered a very powerful approach to attacking user authentication. Social engineering techniques usually involve the use of personal and interpersonal skills, but very often without the need of information technology. When carrying out social engineering, what an adversary does is to try to trick a user into believing that they are required to provide some specific information or even perform a specific action. In the context of information security, social engineering is normally carried out with an aim of having the user disclose their confidential information.

For example, a social engineer might act as a system administrator, ring a user, and inform them that their user account needs an immediate fix. The user, being worried and scared as well as believing that this is a genuine request, provides the attacker with their username and password. The attacker can now log into the user’s account and accomplish their goal of impersonating the user.

Nowadays, social engineering comes in three different shapes and forms. They are in-person social engineering, phone social engineering, and digital social engineering.

Digital Social Engineering

Digital is another social engineering technique that is gaining popularity these days. Many tactics have been employed by an attacker, including pretexting, device leave behind, broad-based phishing, and spear phishing.

Pretexting is when an attacker sends an email with a trustworthy-looking domain. The email is made to look like it is from an executive-level employee or a known contact. For example, Figure 3-10 shows an email that is sent from a fake domain sut.co.th, which looks very similar to the legitimate one of sut.ac.th. It is also sent with a real name of a known contact, Sirapat Boonkrong.

Once an attention is received from the recipient, the attachment might be clicked and the malware is installed on the target’s computer, which can allow an attacker to monitor or gain access to the machine.

The device leave behind tactic is another example of digital social engineering. This is when an attacker intentionally leaves behind a USB flash drive, an external hard disk, or any type of storage device around an office. The adversary often writes a tempting label on such device, such as salary records or secret documents. Anyone who falls for this trap and uses the device can be infected by malicious software once the device is plugged into their computer. Again, if the machine is infected, the adversary will be able to access it. Hence, confidential information can be obtained by the attacker.

The next tactic in the digital social engineering is phishing. A phishing attack uses email, social media, or instant messaging application to trick victims into providing confidential information or visiting malicious websites. Statistically, a phishing attack can successfully compromise around 1 in 20 people.

A typical phishing attack aims at compromising a generic group of users, which sometimes can be called broad-based phishing. The broad-based phishing technique begins with an attacker trying to acquire a list of email addresses. The attacker designs an email that looks relevant to a broad group of users, such as from Google. The phish email is then distributed. The adversary waits and sees whether any users fall for their trick. If so, some secret credentials will be collected by the attacker and will be used to access the users’ accounts. Figure 3-11 illustrates an example of a broad-based phishing email.

Another form of phishing is known as spear phishing. Spear phishing usually requires more time and research for designing a more specific email for a more specific group of target users. The email may be from a university or a bank so that the email looks more personal, which plays on emotions such as fear and curiosity. The aim of spear phishing is the same as the broad-based phishing, which is to gain confidential information, especially users’ login credentials. The way spear phishing is carried out is that an adversary picks their targets and starts designing an email which looks legitimate. The victim, who believes that the email is really from a trusted source, provides secret credentials. The attacker can then use them to access sensitive data. An example of a spear phishing email is shown in Figure 3-12.

It should be noted and understood that in phishing attacks, when a phishing email appears to be from or to be targeting the executive-level employees in an organization or a government agency, the phishing attack becomes a whaling attack . Of course, the aim of the attack is to steal sensitive information or to gain access to a computer system.

Since it is easier to hack humans than machines, there needs to be a way to prevent social engineering. A better way to reduce the risk of being attacked by social engineering is to educate users so that they become more aware of the risk. Another way is for users to be more cautious. That is, when an email is received, the users should look more carefully at the domain of the sender’s email. In some cases, if unsure of the email or the actions asked to be carried out, the users can always check with the source, such as their university or their bank. Moreover, in the case of in-person social engineering, users should be careful not to give out any confidential information to strangers.

In order to make the different types of threat and their countermeasures more intuitive and accessible, they are summarized in Table 3-1 as follows.

Table 3-1

Potential Threats to Authentication and Countermeasures

Potential Threats to Authentication	Possible Countermeasures
1. Default Passwords	- Use unique default passwords - Force users to change the default passwords
2. Eavesdropping	- Use strong encryption
3. Replay Attacks	- Apply a challenge-and-response mechanism
4. Man-in-the-Middle Attacks	- Use strong encryption - Use a virtual private network (VPN)
5. Password Guessing	- Create strong passwords - Stop password reuse
6. Credential Stuffing	- Use different passwords for different accounts - Apply multi-factor authentication
7. Social Engineering	- Increase user awareness