Revisiting Defenses against Large-Scale Online Password Guessing Attacks

ABSTRACT:
Brute force and dictionary attacks on password-only remote login services are now widespread and ever increasing. Enabling convenient login for legitimate users while preventing such attacks is a difficult problem. Automated Turing Tests (ATTs) continue to be an effective, easy-to-deploy approach to identify automated malicious login attempts with reasonable cost of inconvenience to users. In this paper, we discuss the inadequacy of existing and proposed login protocols designed to address large scale online dictionary attacks (e.g., from a botnet of hundreds of thousands of nodes). We propose a new Password Guessing Resistant Protocol (PGRP), derived upon revisiting prior proposals designed to restrict such attacks. While PGRP limits the total number of login attempts from unknown remote hosts to as low as a single attempt per username, legitimate users in most cases (e.g., when attempts are made from known, frequently-used machines) can make several failed login attempts before being challenged with an ATT. We analyze the performance of PGRP with two real-world data sets and find it more promising than existing proposals.

EXISTING SYSTEM:

Wire Sniffing: Most of the time when we talk of passive online attack we consider it as sniffing the password on wired or wireless networks. The password is captured during authentication phase and then compared to dictionary file or word list.

The majority of Sniffer tools are ideally suited to sniff data in hub environment. These tools are also known as passive sniffers as they passively wait for data to be sent before capturing the information. User account passwords are commonly hashed or encrypted when sent on the network to prevent unauthorized access and use. In such cases hacker uses his special tools to crack password.

Brute Force: The most time-consuming type of attack is a brute-force attack, which tries every possible combination of uppercase and lowercase letters, numbers, and symbols.

A brute-force attack is the slowest of the three types of attacks because of the many possible combination of characters in the password. However, brute force is effective; given enough time and processing power, all passwords can eventually be identified.

During these attacks user can’t find the attackers.



PROPOSED SYSTEM:

Our method of protection against online password-guessing attacks and re-lated denial-of-service attacks, the owner and the users granted administrative privileges are referred to as administrators. Only the owner registers with the application provider other user accounts are created by administrators using a Web interface.

Each user logs in with three credentials rather than the usual two:

o   The application instance name, which is considered a secret shared by the users of the application instance. The instance name can be changed by the owner.

o   A user ID, which is known only to the user and the administrators. The user ID is chosen by the administrator who creates the user account, and can be changed by an administrator (by any administrator if the user has no administrative privileges, by the owner if the user is herself an administrator).

o   A password, known only to the user.

After a certain number of consecutive bad guesses against a password, the user is locked out. Bad guesses are considered to be consecutive if there is no intervening successfully completed login to the user's account. All the consecutive bad guesses must be against the same password; counting starts over if the password is changed.
A user who has been locked out is allowed to log in again once her password has been reset.
When the user changes her password, she is not allowed to select as the new password a password that has previously been used as a perma-nent or temporary password on her user account.
This method provides protection against online guessing attacks and related denial-of-service attacks, including attacks by ex-users, and other security benefits.
MODULES:
1.     Pass Points Module.
2.     Cued Click Points Module.
3.     Persuasive Cued Click- Points Module.

MODULES DESCRIPTION:

Pass Points Module:
Based on Blonder’s original idea, Pass Points (PP) is a click-based graphical password system where a password consists of an ordered sequence of five click-points on a pixel-based image. To log in, a user must click within some system-defined tolerance region for each click-point. The image acts as a cue to help users remember their password click-points.

Cued Click Points Module:

Cued Click Points (CCP) was developed as an alternative click based graphical password scheme where users select one point per image for five images. The interface displays only one image at a time; the image is replaced by the next image as soon as a user selects a click point. The system determines the next image to display based on the user’s click-point on the current image. The next image displayed to users is based on a deterministic function of the point which is currently selected. It now presents a one to-one cued recall scenario where each image triggers the user’s memory of the one click-point on that image. Secondly, if a user enters an incorrect click-point during login, the next image displayed will also be incorrect. Legitimate users who see an unrecognized image know that they made an error with their previous click-point. Conversely, this implicit feedback is not helpful to an attacker who does not know the expected sequence of images.

Persuasive Cued Click- Points Module:
To address the issue of hotspots, Persuasive Cued Click Points (PCCP) was proposed. As with CCP, a password consists of five click points, one on each of five images. During password creation, most of the image is dimmed except for a small view port area that is randomly positioned on the image. Users must select a click-point within the view port. If they are unable or unwilling to select a point in the current view port, they may press the Shuffle button to randomly reposition the view port. The view port guides users to select more random passwords that are less likely to include hotspots. A user who is determined to reach a certain click-point may still shuffle until the view port moves to the specific location, but this is a time consuming and more tedious process.
HARDWARE REQUIREMENTS

•                     SYSTEM             : Pentium IV 2.4 GHz
•                     HARD DISK        : 40 GB
•                     FLOPPY DRIVE  : 1.44 MB
•                     MONITOR           : 15 VGA colour
•                     MOUSE               : Logitech.
•                     RAM                    : 256 MB
•                     KEYBOARD       : 110 keys enhanced.

SOFTWARE REQUIREMENTS

•                     Operating system           :-  Windows XP Professional
•                     Front End             :-  Microsoft Visual Studio .Net 2008
•                     Coding Language : - C# .NET.
•                     Database              :- SQL Server 2005

REFERENCE:
Mansour Alsaleh, Mohammad Mannan, and P.C. van Oorschot, Member, IEEE, “Revisiting Defenses against Large-Scale Online Password Guessing Attacks”, IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 9, NO. 1, JANUARY/FEBRUARY 2012.