Lecture 23, May 22

Reading: §12
Due: Homework #4, due May 24, 2013 at 11:55pm

Discussion Problem. Dr. Roger Moore directs the Vulnerabilities Project in the Computer Security Corporation. Dr. Moore is nicknamed “007” by his managerial colleagues, because of his ability to get things done (and his name); but he’s not very knowledgeable technically, which led his technical staff to nickname him “003½”. His latest idea has them talking.

Dr. Moore has decided to establish a set of corporate sponsorships for the lab. When a vulnerability is discovered, he will take exactly the following steps:

1. All corporate sponsors will be notified at once, immediately.
2. After two months, the incident response teams making up FIRST (such as CERT and CIAC) will be notified.
3. The vulnerability will be released on a wider scale no earlier than 2 months after the FIRST teams are notified.

Lecture outline.

1. Passwords
   1. Problem: common passwords
   2. May be pass phrases: goal is to make search space as large as possible, distribution as uniform as possible
   3. Other ways to force good password selection: random, pronounceable, computer-aided selection
2. Password Storage
   1. In the clear; Multics story
   2. Enciphered; key must be kept available
   3. Hashed; show UNIX versions, including salt
3. Attacks
   1. Exhaustive search: password is 1 to 8 chars, say 96 possibles; it’s about 7×10¹⁶
   2. Inspired guessing: think of what people would like (see above)
   3. Random guessing: can’t defend against it; bad login messages aid it
   4. Scavenging: passwords often typed where they might be recorded as login name, in other contexts, etc.
   5. Ask the user: very common with some public access services
4. Password aging
   1. Pick age so when password is guessed, it’s no longer valid
   2. Implementation: track previous passwords vs. upper, lower time bounds
5. Ultimate in aging: One-Time Password
   1. Password is valid for only one use
   2. May work from list, or new password may be generated from old by a function
6. Challenge-response systems
   1. Computer issues challenge, user presents response to verify secret information known/item possessed
   2. Example operations: f(x) = x+1, random, string (for users without computers), time of day, computer sends E(x), you answer E(D(E(x))+1)
   3. Note: password never sent on wire or network
7. Biometrics
   1. Depend on physical characteristics
   2. Examples: pattern of typing (remarkably effective), retinal scans, etc.
8. Location
   1. Bind user to some location detection device (human, GPS)
   2. Authenticate by location of the device