A broad range of research areas including Internet measurement, privacy, and network security rely on lists of target domains to be analysed; researchers make use of target lists for reasons of necessity or efficiency. The popular Alexa list of one million domains is a widely used example. Despite their prevalence in research papers, the soundness of top lists has seldom been questioned by the community: little is known about the lists' creation, representativity, potential biases, stability, or overlap between lists. In this study we survey the extent, nature, and evolution of top lists used by research communities. We assess the structure and stability of these lists, and show that rank manipulation is possible for some lists. We also reproduce the results of several scientific studies to assess the impact of using a top list at all, which list specifically, and the date of list creation. We find that (i) top lists generally overestimate results compared to the general population by a significant margin, often even an order of magnitude, and (ii) some top lists have surprising change characteristics, causing high day-to-day fluctuation and leading to result instability. We conclude our paper with specific recommendations on the use of top lists, and how to interpret results based on top lists with caution.

https://dl.acm.org/doi/pdf/10.1145/3278532.3278574

A Long Way to the Top: Significance, Structure, and Stability of Internet Top Lists

A broad range of research areas including Internet measurement, privacy, and network security rely on lists of target domains to be analysed; researchers make use of target lists for reasons of necessity or efficiency. The popular Alexa list of one million domains is a widely used example. Despite their prevalence in research papers, the soundness of top lists has seldom been questioned by the community: little is known about the lists' creation, representativity, potential biases, stability, or overlap between lists. 
In this study we survey the extent, nature, and evolution of top lists used by research communities. We assess the structure and stability of these lists, and show that rank manipulation is possible for some lists. We also reproduce the results of several scientific studies to assess the impact of using a top list at all, which list specifically, and the date of list creation. We find that (i) top lists generally overestimate results compared to the general population by a significant margin, often even an order of magnitude, and (ii) some top lists have surprising change characteristics, causing high day-to-day fluctuation and leading to result instability. We conclude our paper with specific recommendations on the use of top lists, and how to interpret results based on top lists with caution.

Nowadays, the serious security threat of industrial control system and sensors has become a major challenge with the rapid development of Industrial Internet of Things (IIoT). Man-in-the-middle (MITM) attack is a very common intrusion method, which will make a great security threat in the application of IIoT. In IIoT scenario, the lightweight safety certification can play a very important role in the development of data-intensive and decentralized applications running on billions of sensors and devices, preserving their security. Therefore, in this paper, a low-latency high-reliability security mechanism is proposed to avoid the MITM attack in IIoT scenario. First, combining the radio frequency fingerprint (RFF) technology with IIoT applications, a lightweight IIoT security architecture is proposed. Based on the proposed IIoT security architecture, the process of device access authentication and communication service is illustrated. Second, according to the requirement of IIoT identification method, an access authentication method of the device is proposed based on the RFF. The method of feature extraction, classifier designing, and the access authentication process is discussed in detail. Finally, the simulation results show that the identification rate of devices can reach 95% under SNR = 6 dB, and can nearly reach 100% under SNR = 15 dB. Through the new process of access authentication, the access authentication rate can reach 95% under SNR = 15 dB. Therefore, according to the simulation results, the new security mechanisms based on RFF can be used to avoid the MITM attack in IIoT scenario.

New Security Mechanisms of High-Reliability IoT Communication Based on Radio Frequency Fingerprint

IoT device usually has an associated application to facilitate customers' interactions with the device, and customers need to register an account to use this application as well. Due to the popularity of mobile phone, a customer is encouraged to register an account with his own mobile phone number. After binding the device to his account, the customer can control his device remotely with his smartphone. When a customer forgets his password, he can use his mobile phone to receive a verification code that is sent by the Short Message Service (SMS) to authenticate and reset his password. If an attacker gains this code, he can steal the victim's account (reset password or login directly) to control the IoT device. Although IoT device vendors have already deployed a set of security countermeasures to protect account such as setting expiration time for SMS authentication code, HTTP encryption, and application packing, this paper shows that existing IoT account password reset via SMS authentication code are still vulnerable to brute-force attacks. In particular, we present an automatic brute-force attack to bypass current protections and then crack IoT device user account. Our preliminary study on popular IoT devices such as smart lock, smart watch, smart router, and sharing car has discovered six account login zero-day vulnerabilities.

Cracking IoT Device User Account via Brute-force Attack to SMS Authentication Code

Two factor authentication (2FA) schemes provide strong user authentication guarantees and increase the security of a wide range of web services. However, 2FA schemes still largely remain vulnerable to phishing attacks in which attackers also phish users' second factor (e.g., their OTP tokens). We propose 2FA-PP, a phishing detection scheme that protects users' 2nd authentication factor from phishing attacks. 2FA-PP uses novel browser APIs that support direct communication between browsers and external devices (e.g., mobile phones) and enables the user's phone to check the domain to which the user is connected. The second factor is then only made available to the user if he is accessing the correct domain. 2FA-PP can be combined with different 2FA schemes, both interactive, based on OTP, QR codes and non-interactive, based on device pairing or proximity.

2FA-PP: 2nd factor phishing prevention

We present the password reset MitM (PRMitM) attack and show how it can be used to take over user accounts. The PRMitM attack exploits the similarity of the registration and password reset processes to launch a man in the middle (MitM) attack at the application level. The attacker initiates a password reset process with a website and forwards every challenge to the victim who either wishes to register in the attacking site or to access a particular resource on it. The attack has several variants, including exploitation of a password reset process that relies on the victim's mobile phone, using either SMS or phone call. We evaluated the PRMitM attacks on Google and Facebook users in several experiments, and found that their password reset process is vulnerable to the PRMitM attack. Other websites and some popular mobile applications are vulnerable as well. Although solutions seem trivial in some cases, our experiments show that the straightforward solutions are not as effective as expected. We designed and evaluated two secure password reset processes and evaluated them on users of Google and Facebook. Our results indicate a significant improvement in the security. Since millions of accounts are currently vulnerable to the PRMitM attack, we also present a list of recommendations for implementing and auditing the password reset process.

/pdf/the-password-reset-mitm-attack-2elbh5vi57.pdf

Senia Kalma

Papers

The Password Reset MitM Attack