Ev Even Turing Sho Shoul uld So Sometimes No Not Be Be Ab Able - - PowerPoint PPT Presentation

▶
ev even turing sho shoul uld so sometimes no not be be ab
SMART_READER_LITE
LIVE PREVIEW

Ev Even Turing Sho Shoul uld So Sometimes No Not Be Be Ab Able - - PowerPoint PPT Presentation

Sep 04, 2022 209 likes •794 views

Ev Even Turing Sho Shoul uld So Sometimes No Not Be Be Ab Able To To Te Tell: Mi Mimicking Hu Humanoid Us Usage Be Behav avior or fo for Ex Expl ploratory St Stud udies of of On Online e Ser ervices es Stephan Wiefling 1 ,

slide-1
SLIDE 1

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ev Even Turing Sho Shoul uld So Sometimes No Not Be Be Ab Able To To Te Tell: Mi Mimicking Hu Humanoid Us Usage Be Behav avior

  • r fo

for Ex Expl ploratory St Stud udies of

  • f On

Online e Ser ervices es

Stephan Wiefling1, Nils Gruschka2, Luigi Lo Iacono1

1 TH Köln – University of Applied Sciences 2 University of Oslo

1
slide-2
SLIDE 2

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Mo Motiva tivatio tion

2
slide-3
SLIDE 3

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Mo Motiva tivatio tion

§ Algorithms impact our society § Technical aspects hidden behind user interfaces § Data availability needed for reliable research

3
slide-4
SLIDE 4

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Mo Motiva tivatio tion

§ Most online services are black boxes § Lack of transparency hinders research § Reverse engineering needed

4

?

slide-5
SLIDE 5

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Re Reve verse en engi gineer eering is is co complicat cated…

5
slide-6
SLIDE 6

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Re Reve verse en engi gineer eering is is co complicat cated…

§ No unique path to conduct such an analysis § Services implement countermeasures

6
slide-7
SLIDE 7

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Re Reve verse en engi gineer eering is is co complicat cated…

§ No unique path to conduct such an analysis § Services implement countermeasures àCamouflage measures needed

7
slide-8
SLIDE 8

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

8

HOSIT

slide-9
SLIDE 9

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

9

Humanoid Online Service Inspection Tool

HOSIT

slide-10
SLIDE 10

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ov Over erview ew

1.

  • 1. Tool

Tool

  • 2. Proof of Concept
  • 3. Conclusion
10
slide-11
SLIDE 11

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

§ Simulates human-like browsing behavior

  • n online services

§ All actions have to be predefined by the researchers § Reliable and reproducible research § Based on Puppeteer API

11

HOSIT

slide-12
SLIDE 12

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

12

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

slide-13
SLIDE 13

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

Vi Virtua ual Identities

§ Define properties § Typing, clicking behavior § Interests § …

13
slide-14
SLIDE 14

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

Tr Training Pr Procedures

§ New accounts are considered suspicious § Need to create valid behavior first § Takes time

14
slide-15
SLIDE 15

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

Tr Training Pr Procedures

§ Define activities to be performed on online service § and other online services (tracking) § Executed multiple times

15
slide-16
SLIDE 16

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

Tr Training Pr Procedures

§ Let the service learn “normal” behavior § Get tracked on other websites by the service § Desired result: § Get labeled as “normal” user

16
slide-17
SLIDE 17

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Virtual Identities Training Procedures Inspection Procedures

Study Conductor

In Insp spectio ion Pr Procedures

§ Create unusual behavior at online service § Analyze services’ reaction to unusual behavior

17
slide-18
SLIDE 18

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

18

Log API

HOSIT Framework

Human User Imitation API Virtual Identities Training Procedures Inspection Procedures

Study Conductor

slide-19
SLIDE 19

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

19

Log API

HOSIT Framework

Human User Imitation API Virtual Identities Training Procedures Inspection Procedures

Study Conductor

§ Executes the actions § Adds human-imitating behavior to function calls § Properties of virtual identity

slide-20
SLIDE 20

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

20

Log API

HOSIT Framework

Human User Imitation API Virtual Identities Training Procedures Inspection Procedures

Study Conductor

§ Logs all actions with screenshots § Reproducibility

slide-21
SLIDE 21

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

In Insp spectio ion To Tool

21

Log API Virtual Identities Training Procedures Inspection Procedures

HOSIT Framework Inspected Service

Human User Imitation API

Study Conductor

slide-22
SLIDE 22

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

22

Why do we need another browser automation tool?

slide-23
SLIDE 23

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Cl Click Be Behavio ior

23

Pu Puppeteer 0. 0.13. 13.0 HO HOSIT IT

* Komandur et al.: Relation between mouse button click duration and muscle contraction time. In: EMBC '08. (Aug 2008)

*

slide-24
SLIDE 24

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Typ Typing Sp Speed

24

Pu Puppeteer 0. 0.13. 13.0 HO HOSIT IT t t Constant delay Randomized variations*

* Drury, C.G., Hoffmann, E.R.: A model for movement time on data-entry keyboards. Ergonomics 35(2) (Feb 1992)

slide-25
SLIDE 25

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Bo Bot De Detection Pr Prote tectio tion

25

Pu Puppeteer 0. 0.13. 13.0 HO HOSIT IT

slide-26
SLIDE 26

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Br Browsin ing Be Behavio ior Cha Chang nges

26

Pe Persona A Pe Persona B

slide-27
SLIDE 27

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Mo More Fu Func nctions

  • ns
27

§ Common workflows integrated § Search query generator § CAPTCHA solving § Scrolling § Select tabs

slide-28
SLIDE 28

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ex Examp mple Sc Scrip ipt

28

§ Opens a search engine § Clicks on image search § Types random search query covered in the media § Scrolls to bottom of results

slide-29
SLIDE 29

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ex Examp mple Sc Scrip ipt

29

§ Video recorded at October 22nd, 2019

slide-30
SLIDE 30

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ov Over erview ew

  • 1. Tool

2.

  • 2. Pr

Proof f of

  • f Co

Concept ept

  • 3. Conclusion
30
slide-31
SLIDE 31

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Pr Proof f of

  • f Co

Conc ncept pt

§ Study on Risk-based Authentication* § Required human-like behavior from clients

31

* Wiefling et al.: Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild. In: IFIP SEC ’19. (Jun 2019)

slide-32
SLIDE 32

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

32

Username Password

Risk estimation Low Medium High Risk: IP address User agent ...

slide-33
SLIDE 33

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

33

Username Password

IP: Aalborg, DK Chrome Windows 10 ...

slide-34
SLIDE 34

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

34

„Same device as always“

Risk estimation Low risk

Username Password

IP: Aalborg, DK Chrome Windows 10 ...

slide-35
SLIDE 35

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

35

IP: Ber Berlin, n, DE Chrome An Andro roid 8 8.1 .1 ...

Username Password

slide-36
SLIDE 36

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

36

„There‘s something different here“

Risk estimation Medium risk Additional Authentication IP: Ber Berlin, n, DE Chrome An Andro roid 8 8.1 .1 ...

Username Password

slide-37
SLIDE 37

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

37

„There‘s something different here“

Risk estimation Medium risk Additional Authentication Proof for additional authentication IP: Ber Berlin, n, DE Chrome An Andro roid 8 8.1 .1 ...

Username Password

slide-38
SLIDE 38

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

38

IP: Ne New York, US* Ph PhantomJS Li Linux ...

Username Password

* Known spam IP address

slide-39
SLIDE 39

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

39

„Very likely a hacker“

Risk estimation High risk

Username Password

* Known spam IP address

IP: Ne New York, US* Ph PhantomJS Li Linux ...

slide-40
SLIDE 40

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ris Risk-ba based Au Authentic icatio ion

§ Recommended by NIST digital identity guidelines* § Used by large online services § However: Procedures not disclosed à Black-box testing eight popular online services

* Grassi et al.: Digital identity guidelines. Tech. Rep. NIST SP 800-63b (2017)

40
slide-41
SLIDE 41

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Pr Proof f of

  • f Co

Conc ncept pt*

§ Trained services with human-like behavior § Triggered RBA with behavior

41

* Wiefling et al.: Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild. In: IFIP SEC ’19. (Jun 2019)

slide-42
SLIDE 42

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

42
slide-43
SLIDE 43

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

?

43
slide-44
SLIDE 44

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

44

Lo Login IP IP ad addre ress Us User Ag Agent ... ...

?

slide-45
SLIDE 45

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

45

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ...

?

slide-46
SLIDE 46

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

46

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ...

?

slide-47
SLIDE 47

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

47

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ... 3 TH Köln Chrome ...

?

slide-48
SLIDE 48

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

48

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ... 3 TH Köln Chrome ... ... ... ... .... 20 TH Köln Chrome ...

?

slide-49
SLIDE 49

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

</>

49

Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ... 3 TH Köln Chrome ... ... ... ... .... 20 TH Köln Chrome ...

?

slide-50
SLIDE 50

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

50

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ... 3 TH Köln Chrome ... ... ... ... .... 20 TH Köln Chrome ... 21 Ot Other Co Country Chrome ...

</>

?

slide-51
SLIDE 51

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

51

Login Lo Login IP IP ad addre ress Us User Ag Agent ... ...

1 TH Köln Chrome ... 2 TH Köln Chrome ... 3 TH Köln Chrome ... ... ... ... .... 20 TH Köln Chrome ... 21 Ot Other Co Country Chrome ...

</>

?

  • r ?

,

slide-52
SLIDE 52

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

52

Identities 28x

slide-53
SLIDE 53

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

53

HOSIT

Log

RBA Testing Human User Imitation

Identities 28x

slide-54
SLIDE 54

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

54

Inspected Services HOSIT

Log

RBA Testing Human User Imitation

Identities 28x 224 User Accounts

slide-55
SLIDE 55

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Pr Proof f of

  • f Co

Conc ncept pt*

55

* Wiefling et al.: Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild. In: IFIP SEC ’19. (Jun 2019)

HOSIT

Log

Te Human User Imitation

Identities 28x

§ Results: § Internal features used for RBA § Estimation of services’ RBA procedures § Would not have been possible without HOSIT

slide-56
SLIDE 56

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Ov Over erview ew

  • 1. Tool
  • 2. Proof of Concept

3.

  • 3. Co

Conclus usio ion

56
slide-57
SLIDE 57

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Co Conc nclusion

§ HOSIT available as open source software* § Can be used for own studies of online services § Responsible service access for researchers?

* https://git.io/hosit

57
slide-58
SLIDE 58

Aalborg, Denmark | NordSec 2019 Stephan Wiefling, Nils Gruschka, Luigi Lo Iacono

Th Thank yo you

58

stephan.wiefling@th-koeln.de @swiefling riskbasedauthentication.org/hosit das.th-koeln.de