Impact Assessment of Password Reset PRMitM Attack with TwoFactor Authentication Two factor authentication is widely used, to send a confirmation message via Short Message Service (SMS). Two factor authentication is believed as more secure than a simple password authentication because it prevents intrusion even if your password was compromised. However, SMS is used not only for an authentication when registering an account but for resetting password, too. Hence, in 2017, Gelernter proposed the Password Reset Mininthe middle attack (PRMitM), which can take over a userxe2x80x99s account by using Two Factor Authentication via SMS. In this attack, a password reset request is sent via an SMS message instead of an expected authentication request, and the user enters a reset code at the malicious maninthemiddle website without recognizing that the code resets the password. Two factor authentication was believed to improve security, however, it makes the site more vulnerable than before. Even after their publication, not all vulnerable websites addressed the vulnerability. Hence, it is still not clear if these attempts were sufficient to prevent victims from being attacked. In this paper, we report the comprehensive analysis results of an investigation of vulnerable major websites to PRMitM attack. To identify the causes of vulnerabil ity, we conducted experiments with 180 subjects. The SMSmessage parameters were xe2x80x9cwithwithout warningxe2x80x9d, xe2x80x9cnumericalphanumeric codexe2x80x9d, and xe2x80x9conetwo messagesxe2x80x9d, and subjects were tested to see if they in put the reset code into the fake website. We show the successfulattack ratios and the typical behaviors of vulnerable subjects. Some of main results include that Vulnerable users do not remember whether they have registered accounts or not and users who frequently change their passwords are 11.6 times more vulnerable to users who do not change much.

User Authentication on Mobile Devices: Approaches, Threats and Trends Abstract   Mobile devices have brought a great convenience to us these years, which allow the users to enjoy the anytime and anywhere various applications such as the online shopping, Internet banking, navigation and mobile media. While the users enjoy the convenience and flexibility of the xe2x80x9dGo Mobilexe2x80x9d trend, their sensitive private information (e.g., name and credit card number) on the mobile devices could be disclosed. An adversary could access the sensitive private information stored on the mobile device by unlocking the mobile devices. Moreover, the userxe2x80x99s mobile services and applications are all exposed to security threats. For example, the adversary could utilize the userxe2x80x99s mobile device to conduct nonpermitted actions (e.g., making online transactions and installing malwares). The authentication on mobile devices plays a significant role to protect the userxe2x80x99s sensitive information on mobile devices and prevent any nonpermitted access to the mobile devices. This paper surveys the existing authentication methods on mobile devices. In particular, based on the basic authentication metrics (i.e., knowledge, ownership and biometrics) used in existing mobile authentication methods, we categorize them into four categories, including the knowledgebased authentication (e.g., passwords and lock patterns), physiological biometricbased authentication (e.g., fingerprint and iris), behavioral biometricsbased authentication (e.g., gait and hand gesture), and twomultifactor authentication. We compare the usability and security level of the existing authentication approaches among these categories. Moreover, we review the existing attacks to these authentication approaches to reveal their vulnerabilities. The paper points out that the trend of the authentication on mobile devices would be the multifactor authentication, which determines the userxe2x80x99s identity using the integration (not the simple combination) of more than one authentication metrics. For example, the userxe2x80x99s behavior biometrics (e.g., keystroke dynamics) could be extracted simultaneously when heshe inputs the knowledgebased secrets (e.g., PIN), which can provide the enhanced authentication as well as sparing the userxe2x80x99s trouble to conduct multiple inputs for different authentication metrics.