Special Edition is the blog for security testing business SE Labs. It explains how we test security products, reports on the internet threats we find and provides security tips for businesses, other organisations and home users.

Tuesday, 27 September 2016

Went The Day Well?


In The Great Escape, a Gestapo officer wishes Gordon Jackson's character "good luck" in English as he attempts to board a bus.

In A Book About a Thousand Things, George Stimpson says that during WWII, US guards used the word "lollapalooza" to spot Japanese spies amongst Pilipino allies.

Judges 12-6: "Then said they unto him, 'Say now Shibboleth' And he said Sibboleth, for he could not frame to pronounce it right. Then they took him, and slew him at the passages of Jordan".

These are all examples of shibboleths, named after the final example, in which a group of Gileadites identify an enemy Ephraimite from how he says a word.

Could subtle shibboleths also buy time until we can properly resolve the password reuse crisis? To answer that, we need a sprinkle of theory.

To log into a service, you must authenticate yourself by presenting certain bona fides. These fall into three broad categories:

  • Something you know
  • Something you have
  • Something you are
Passwords fall into the first category, as do your mother's maiden name, your first pet, and so on.

To shore up authentication, two factor authentication is becoming more popular, and usually involves a password backed by something you have, such as a mobile phone to receive a passcode. Something you have could also be a special device that generates a one-time code. Some banks insist on such devices being present when transferring money from accounts.

What about things you are? Biometrics are the best known examples, but gait recognition has also been examined as a method of identifying people. Early research focused on thwarting smartphone theft, but has since been used in other applications.

The trouble with all this is that everything beyond simple passwords make the user do something extra or use special hardware. Everyday users tend to resist being made to change their ways for someone else's convenience. There are also parts of the world where secondary authentication is impossible. Are we condemning those users to a second class, less secure internet. This is where shibboleths could help.

When your bank identifies rogue transactions, it's identifying shibboleths in normal spending patterns. If you've ever had a text asking you to confirm unusual payments after some toerag has cloned your card, you'll be thankful for this.

Think about this in terms of passwords. If a typical user types the same password for many years, he naturally falls into a predictable rhythm of key presses. If anyone else enters that password, the timing data will be different.

Encrypt the timing data before storing it, and it must be included in any password decryption effort. Remote brute force attacks would become impossibly difficult. Dumb phishing campaigns that don't collect timing data would also be rendered useless overnight, and God knows that'd be a good thing.

It's far from a perfect solution. You can probably think of a dozen difficulties (keyloggers, for example), but competent client-side shibboleth-spotting could at least buy the world time while someone clever creates a solution to password reuse that doesn't divide the internet into secure haves and insecure have-nots.

1 comment:

  1. Hmmm. I can see some difficulties. I have a password that I use to sign into Gmail, for instance. I use it on my PC, iPad and Android phone. Of these, only the PC has a proper keyboard. So my timing data would be different on all three devices. You'd perhaps need to use the MAC address as part of the encrypted hash- meaning, in effect, multiple sets of timing data for a single password.

    You'd also need a way to build in some fuzziness: there is a pattern to the way I enter a password, but the timings will only be consistent within certain limits.