Assignment 3: Authentication PDF

Name : Ioan-Radu Bocu Student number : s1104958 Exercise 2.1 You can authenticate in the following ways : by something you know, by something you are, by something you have. Something you know : Advantage : Convenient, just inputting the username and password and you are logg...

Name : Ioan-Radu Bocu Student number : s1104958 Exercise 2.1 You can authenticate in the following ways : by something you know, by something you are, by something you have. Something you know : Advantage : Convenient, just inputting the username and password and you are logged in straight away Disadvantage : Forgetting passwords is really annoying and because nowadays people  have a lot of accounts where they need to authenticate themselves, they need to keep in mind a lot of passwords, so it could result in the situation that an user will use the same password (repetitively) for all his/her accounts (Maybe with small changes). It can be the case that passwords can leak which would result in loss of access to the user’ accounts (loss of privacy) Something you are : Advantage : You don’t need to keep anything in mind or learn something by heart, again it is even more convenient than using passwords. The biometrics are not something that can be guessed or reproduced if the hardware that checks them is reliable. Disadvantage : You actually need to trust the sensor/camera. Meaning that, there are not 2 ngerprints that can unlock my phone, or the situation that someone else could unlock my phone via face recognition. In case of ngerprint, there can be also the situation that I cut my nger and then I am not able to unlock my phone anymore. Something you have : Advantage : Unlike passwords , which can be guessed, phished, or exposed through database breaches, physical tokens or devices cannot be exploited in these ways. Disadvantage : Losing the authenticating device/token could result in not being able to authenticate till the device is found or replaced. There could also be the situation that the device is found by someone and that someone uses it for impersonating you Exercise 2.2 Something you know When authenticating into the OS, by simply inputting the username and password When rebooting the system (or other similar operations), when the OS gets a new update, or when some settings of the OS are modi ed (for instance, for MacOS, there is a setting that you need to change in case you download apps that are outside of App Store, and authentication is required when changing this setting) Something you are : It could be used in a 2-factor authentication when accessing sensitive accounts or les When accessing something very frequently (for example, I can unlock my MacBook using just my ngerprint which is faster than using my password Something you have: When accessing high critical infrastructure , such as corporate servers or administrative controls Using it as part of multi-factor authentication system for securing OS-level administrative accounts Exercise 2.3 fi fi fi fi fi fi  Something you know : An attack that would work in this case is phishing. The rst step of conducting this attacks is the following : the attacker sends an e-mail/SMS to the victim containing a malicious link. The e- mail contains also bait like “You are the winner of the big prize, you won x amount of money, click the following link in order to receive the prize”. The user clicks the link and reaches on a form where he/she is asked to introduce personal data and submit the form. When the link was clicked , usually malicious software that records data/credentials is installed on the machine of the user. This is how sensitive data of the user is captured. Something you are : We have seen in the lecture that iris scan of the Samsung galaxy s8 was tricked by contact lens. An attack would be : the attacker gets contact lens similar to the iris of the user and then tries to authenticate while the user is away (leaving the account/device unattended). This is biometric spoo ng Something you have : The most representative of this category is the card. The ATMs in some countries are insecure in the sense that the attacker could insert into the ATM devices that read the chip of the card and steals the information from this chip every time people insert their card into such compromised ATMs ,such that cards having the exact information (credentials) could be cloned afterwards. Exercise 2.4 Something you know : Introducing the 2-authentication factor here is useless, as the essence of this attack is given by the lack of authentication of the site where the malicious link found in the mail leads to. So, in order to avoid such an attack , the browser of the user should authenticate the websites. This is why TLS certi cates are used, in order for the user to see if there are any risks on the site he is navigating. Something you are : In this case, introducing a 2-factor authentication would work, in order to prevent the attack mentioned earlier. A second authentication factor could be a passphrase or a password, or answering a personal question (“What is the name of your rst dog?” or something like this). In this situation , the attack would become harder to conduct as just imitating the iris of the user would not be su cient anymore. This would lead to the attacker getting stuck at the second authentication factor when conducting this attack. Something you have : In this introducing a second authentication factor would not change the situation at all. The essence of this attack is the lack of authentication of the ATMs (e.g are they safe to use or not?). This kind of attack could be prevented by simply validating all the ATMS in the respective country by checking then internally and determining what kind of hardware they contain. fi fi ffi fi fi Exercise 3 3.1 1) The requirements that need to be met are the following : Maintaining a remote RDP session active with Windows 10 1803 or newer system or Windows Server 2019 The RDP Automatic Reconnection on RDP servers should be enabled The user locks the remote desktop session from the RDP client The connection is interrupted because of a network issue The RDP client tries to reconnect to the remote session After doing these steps, it will be seen that the remote session reaches into an unlocked state, bypassing so the authentication  2) The main aw that leads to this attacks is the automatic reconnection of the RDP protocol. As mentioned in the article, this option of automatic reconnection should be disabled, and , in general, one should not lock a session and rather disconnect from the session such that the contact with the remote server is lost. 3) It could be the scenario, that I am working remotely, and I need some important documents from my superior who is on holiday and cannot send me the documents on mail or via an encrypted channel. In this situation , I need to access his remote desktop via RDP, from an operating system Windows 10 1803. After I obtain the documents that I need I do not immediately interrupt the connection and I keep it running till an abnormal disconnection happens because of a network issue. At this point, the automatic reconnection takes place and the attacker has also access to the desktop of my superior and can see the sensitive data. 4) It is the exactly same scenario as above, but in this case , I have learnt about the RDP vulnerability and I disabled the RDP automatic reconnection option. So, if a network issue takes place , I am not reconnected to the remote server and so, the authentication cannot be bypassed. 5) Process : RDP client trying to access the remote server via RDP Veri er : The remote server Claimant : The person/entity controlling the RDP client Claim : The person/entity controlling the RDP client is authorized to access the remote sever remotely by the administrator of the remote server. Convincing : Introduce the credentials of the remote sever and check. 6) Process : RDP client trying to access the remote server via RDP Veri er : The RDP client Claimant : The person/entity wanting to access the RDP client Claim : The person wanting to access the RDP client is indeed the legitimate owner of the RDP client (the legitimate person that will conduct the remote control) Convincing : Introduce the credentials of the RDP client and check. 7) I would argue that “RDP sessions should be disconnected instead of locked” is a better mitigation because the network disconnection cannot cause any harm anymore. As the session is disconnected, the contact with the remote server is lost, so the authentication process on the remote sever cannot be bypassed anymore. In the other scenario, the network disconnection can still cause harm, which can make a MITM(who is able to bypass the authentication on the RDP client) still able to access the remote system. fi fi fl  Exercise 3.2 1) Process: The user tries access to the data on the hard disk Veri er : The Operating System Claimant : The person inputting the passphrase for deriving the key for decryption Claim : The claimant is the legitimate owner of the data stored on the hard disk or has authorization from the hard disk owner to access the data stored there method of convincing : Inputting the passphrase and check if the passphrase is the correct one degree of certainty : The passphrase has not been leaked 2) Process: The user tries access to the data on the hard disk Veri er : The Operating System Claimant : The person making use of biometrics or other authentication means in order to authenticate Claim : The claimant is the legitimate owner of the data stored on the hard disk or has fi fi  authorization from the hard disk owner to access the data stored there method of convincing : The user needs to prove his/her identity in a di erent way via biometrics, smart card or other means which are veri ed in order to obtain the decryption key degree of certainty :Depending on how the above means of authentication are implemented Exercise 3.3 1) The default settings regarding to failed log in attempts are : unlock_time (the lockout time which is by default set to 10 minutes in seconds), fail_interval (the period of time in which the maximum number of mistakes in password typing can lead to a lock, set to 15 minutes in seconds) and deny (the number of mistakes allowed in terms of inputting the password, by default set to 3). 2) The reason for this settings is to make the brute-force attacks less possible. If people actually mistake in typing the password (giving the impression that they brute-force it), the number of attempts should be relaxed. 3) It is meant that the root user (highest-privilege user on a system) is not locked out after multiple failed logins. Imagine that you have a buildings in re and no one is allowed to approach to it for safety reasons, not even re ghters that came to extinguish the re. If the root user were to be locked by an attacker (or even an honest mistake), then there will be nobody available to repair the mess that has been caused in the system. 4) This default con guration might just piss o the employee because he/she would be too frustrated by calling every time the IT department to unlock the accounts, or If their intervention is not needed then the productivity will be lost due to these waiting times. 5) Because of mistyping and distraction from other family members the user may end locking his personal account. It could be the case, that another family member (kids for example) would try to lock in the system leading to the user being locked. 6) If the system is too secure, it becomes unusable. fi fi fi ff fi fi fi ff 1) Two advantages are : I would say that managing user accounts becomes easier as there no that many problems to solve by the IT department (advantage for organisations). Another advantage : in this way, an user can access at work his own personal settings and les from his/her Microsoft account (advantage for user). 2) Authentication means proving your identity, proving that you are indeed who you claim to be by a certain amount of certainty, while the authorization is just granting the permission that a certain action can be conducted. The di erence is that authorization can be granted even by an attacker if he previously managed to authenticate somehow into the system. So, authorization should come after authentication. Exercise 4.2 1) No authentication , just authorization we have in this exercise, Tom is not authorized by the OS to run the script 2) We have authentication because Felix logs into the student’s account as he received the username from the student. He sent the SSH key to the student, which was added into a folder where authorized keys are kept. This means that the student granted authorization to Felix to connect to the student’s laptop as Felix’s key is recognized by the student’s machine. 3) It is about 2-factor authentication. First factor id given by password inputting and the second factor is the sms-code sent on Bob’s phone. 4) Decrypt the lecture slides with the code - authentication Calling Pol to get the code for you - authorization Open Bernard’s o ce with the master key - authentication , you are indeed an authorized person to open the o ce. Showing the University Employee Badge to the Management Assistant - authentication ffi ffi ff fi 5) Ciske entering the password for running “sudo nd / -name “ le”” is authentication , he proves he is the root user so he can run commands with administrator privileges. 6) Ciske being asked to input the passphrase in the prompt in order to get his private SSH key - authentication. Because Ciske is authenticated with the key, he may be AUTHORIZED to see material from other courses from Radboud University - authorization. Example for Authentication : I want to connect to my outlook account. This is a 3-factor authentication , rst I am asked to introduce my credentials ( rst factor of the authentication). After successfuly introducing the credentials (correct credentials), a number is displayed on the screen of my laptop. I need to unlock my phone rst using my ngerprint (second factor of authentication). After unlocking my phone, I open the Authenticator app from Microsoft and introduce the number displayed on the screen into the app (third factor of authentication). After this, I have access to my Outlook account. Example of authorization : I want to send my contribution to my friend for the party we are organizing next week. First, I unlock my phone using my ngerprint (an authentication step). After this I open my mobile banking app and I am asked to introduce my pin-code (another authentication step to prove that I am the legitimate account holder). After introducing my pin, I formulate a transaction of 20 euros that I want to send to my friend. Then when, I press the “Submit” button, I am asked to introduce my pin again (here, I authorize the transaction to proceed(authorization), this is not authentication as I am already authenticated in the app). After pressing the button, I exit the app and lock my phone. fi fi fi fi fi fi fi