Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

This paper concerns the problem of phishing attacks in ubiquitous computing environments. The embedding of ubiquitous services into our everyday environments may make fake services seem plausible but it also enables us to authenticate them with respect to those environments. We propose physical and virtual linkage as two types of authenticating evidence in ubiquitous environments and two protocols based on them. We describe an experiment to test hypotheses concerning user responses to physical and virtual linkage with respect to fake Wi-Fi hotspots. Based on our experience we derive an improved protocol for authenticating spontaneously accessed ubiquitous services.

REFERENCES

• 1: Balfanz, D., Smetters, D.K., Stewart, P., and Chi Wong, H. Talking to strangers: Authentication in ad--hoc wireless networks. In Proc. Network and Distributed Systems Security (NDSS 2002), (2002).
• 2: BBC News: Parking ticket leads to a virus. http://news.bbc.co.uk/2/hi/technology/7872299.stm.
• 3: Bugzilla@Mozilla -- MITM in-the-wild. https://bugzilla.mozilla.org/show_bug.cgi?id=460374.
• 4: Rachna Dhamija , J. D. Tygar , Marti Hearst, Why phishing works, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124861]
• 5: B. J. Fogg , Jonathan Grudin , Jakob Nielsen , Stuart Card, Persuasive Technology: Using Computers to Change What We Think and Do, Science & Technology Books, 2002
• 6: Gehrmann, C., Mitchell, J. and Nyberg, K. Manual authentication for wireless devices. RSA Cryptobytes 7(1), (2004), 29--37.
• 7: Tim Kindberg , Armando Fox, System Software for Ubiquitous Computing, IEEE Pervasive Computing, v.1 n.1, p.70-81, January 2002 [doi>10.1109/MPRV.2002.993146]
• 8: Tim Kindberg , Eamonn O'Neill , Chris Bevan , Vassilis Kostakos , Danaë Stanton Fraser , Tim Jay, Measuring trust in wi-fi hotspots, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357084]
• 9: Kindberg, T., Zhang, K., and Im, S. Evidently secure device associations. HP Labs tech report HPL-2005-40.
• 10: Jonathan M. McCune , Adrian Perrig , Michael K. Reiter, Seeing-Is-Believing: Using Camera Phones for Human-Verifiable Authentication, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.110-124, May 08-11, 2005 [doi>10.1109/SP.2005.19]
• 11: Jens Riegelsberger , Martina Angela Sasse, Trustbuilders and Trustbusters, Proceedings of the IFIP Conference on Towards The E-Society: E-Commerce, E-Business, E-Government, p.17-30, October 03-05, 2001
• 12: Ronald L. Rivest , Adi Shamir, How to expose an eavesdropper, Communications of the ACM, v.27 n.4, p.393-394, April 1984 [doi>10.1145/358027.358053]
• 13: Volker Roth , Wolfgang Polak , Eleanor Rieffel , Thea Turner, Simple and effective defense against evil twin access points, Proceedings of the first ACM conference on Wireless network security, March 31-April 02, 2008, Alexandria, VA, USA [doi>10.1145/1352533.1352569]
• 14: Nitesh Saxena , Jan-Erik Ekberg , Kari Kostiainen , N. Asokan, Secure Device Pairing based on a Visual Channel (Short Paper), Proceedings of the 2006 IEEE Symposium on Security and Privacy, p.306-313, May 21-24, 2006 [doi>10.1109/SP.2006.35]
• 15: Uzun, E., Karvonen, K., and Asokan, N. Usability analysis of secure pairing methods. In Financial Cryptography and Data Security, (2008), 307--324.
• 16: Vaudenay, S. Secure communications over insecure channels based on short authenticated strings. In Proc. Advances in Cryptology -- CRYPTO 2005, (2005), 309--326.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.m Miscellaneous

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Software psychology

General Terms:
Experimentation, Human Factors, Security

Keywords:
authentication, phishing, ubiquitous services, wi-fi