Credential theft is a network intrusion vector that subverts traditional defenses of a campus network, with a malicious login being the act of an attacker using those stolen credentials to access the target network. Historically, this approach is simple for an attacker to conduct and hard for a defender to detect. Alternative mitigation strategies require an in depth view of the network hosts, an untenable proposition in a campus network. We introduce a method of spatial augmentation of login events, creating a user and source IP trajectory for each event. These location mappings, built using user wireless activity and network state information, provide features needed for login classification. From this, we design and build a real time data collection, augmentation, and classification system for generating alerts on malicious events. With a relational database for data processing and a trained weighted random forests ensemble classifier, generated alerts are both timely and few enough to allow human analyst review of all generated events. We evaluate this design for three levels of attacker ability with a defined threat model. We evaluate our approach with a proof of concept system on weeks of live data collected from the Virginia Tech campus, under an IRB approved research protocol. / Master of Science / For a computer network, a common mode of access is a login; the entering of a valid username and password for authentication. Attackers use a variety of methods to steal user login credentials and several of these approaches are unnoticeable by network defenders. Providing further complications, a higher educational campus network, such as Virginia Tech, inherently has less information about the state of the network, since students and teachers bring their privately owned devices. To prevent this attack method, we determine the class, authorized or unauthorized, of login events using data that can be consistently provided by a campus network. After classification, alerts are generated for security analysts, helping to further defend the network. Spatial augmentation is a process we introduce to allow login classification with machine learning algorithms. For every login event at the campus, a history of user locations and source event locations can be provided, using data collected from the campus network infrastructure. Location data provides stronger classification of login events, since studies show attackers inherently have a physical distance between the normal user of an account when performing an unauthorized login. For evaluation, we build a system to augment and classify login events, while limiting the number of false alerts to a useable level.

Due to low computation cost and convenient portability, smart cards are usually adopted to store the personal secret information of users for remote authentication. Although many remote authentication schemes using smart cards have been introduced in the literatures, they still suffer from some possible attacks or cannot guarantee the quality of performance for smart cards. In this thesis, we classify the security criteria of remote authentication and propose a new remote login scheme using smart cards to satisfy all of these criteria. Not only does the proposed scheme achieve the low computation requirement for smart cards, but it can withstand the replay and the off-line dictionary attacks as well. Moreover, our scheme requires neither any password table for verification nor clock synchronization between each user and the server while providing both mutual authentication and the uniqueness of valid cards.

Gemeinsamer Workshop von Universitaetsrechenzentrum und Professur Rechnernetze und verteilte Systeme der Fakultaet fuer Informatik der TU Chemnitz. Es werden Varianten gezeigt, wie neue Studenten der TU-Chemnitz Ihr Benutzerkennzeichen für URZ-Dienste selbst anlegen können.

Accessing websites using social networking credentials, also known as social login, is becoming increasingly popular as users do not need to create and maintain accounts on each and every website they access. During these social logins, the private information of users is shared with third-party websites from their social profile, and much of this happens behind the scenes which is abstracted from the user. However, as social logins are widespread, it is essential to understand the users’ views and appreciation towards the information being shared in the background. There is also a possibility of data leak or misuse when information is exchanged between a website and social networking site. Accordingly, the purpose of this study is to explore the perception of users towards their awareness and trust in social login. In addition, based on users’ needs and desires, the study aims to formulate suggestions for improving the awareness and trust of social login. Semi-structured interviews were conducted with 6 students from Linnaeus University of Sweden to collect data. These interviews were transcribed and analyzed using thematic analysis. The findings revealed that users are conscious of their personal attributes being shared but are not aware that they can control, revise and revoke information sharing permissions. It was also found that users trust third parties to some extent but not the social networking sites. The study also suggested some improvement ideas for enhancing the awareness and trust of web users in social logins. In addition to contributing to the field of social login, the outcomes of this study also benefit users and web companies by helping to understand and increase the awareness and trust of web users on social logins.

Gemeinsamer Workshop von Universitaetsrechenzentrum und Professur Rechnernetze und verteilte Systeme der Fakultaet fuer Informatik der TU Chemnitz. Es werden Varianten gezeigt, wie neue Studenten der TU-Chemnitz Ihr Benutzerkennzeichen für URZ-Dienste selbst anlegen können.

Single Sign-On (SSO) är en autentiseringsprocess som tillåter en utvecklare att delegera autentiseringsansvaret till en dedikerad tjänst. OAuth 2.0 är ett auktoriseringsramverk som ofta står som grund för ett autentiseringslager som i sin tur möjliggör SSO. En identitetsleverantör är tjänsten som står för hantering av användaruppgifterna och autentiseringen, två vanliga identitetsleverantörer är Google och Facebook som i sin tur implementerar SSO med hjälp utav autentiseringslagren OpenID Connect respektive Facebooks egna autentiseringslager. Det har visat sig att många klienter som ska utnyttja SSO med OAuth 2.0 implementerar det fel så att säkerhetsbrister uppstår, studier har utförts med förslag till lösningar men många bristande implementationer fortsätter produceras och existera. Att skapa diverse verktyg för att främja säkerhet i dessa sammanhang är en metod där OAuthGuard utvecklats med visionen att även kunna skydda användaren, direkt från en webbläsare. OAuthGuard har även tidigare använts för att analysera säkerheten med Google SSO och visat att 50% av undersökta klienter har brister, men motsvarande studie eller verktyg saknas för Facebook SSO. Denna studie gjorde en motsvarande undersökning för Facebook SSO-klienter med en vidareutvecklad version av OAuthGuard och fann att de lider av brister med liknande trend som tidigare studies resultat mot Google-SSO-klienter, men att färre Facebook- SSO-klienter har brister i jämförelse. Vid vidareutvecklingen av OAuthGuard upptäcktes ett antal svårigheter och framtiden för denna typ av verktyg behöver vidare analyseras. Vidare analys behöver även göras för att bedöma om Facebook-SSO kan vara att föredra över Google-SSO ur säkerhetsperspektiv samt vidare utforskande av nya säkerhetsfrämjande metoder behöver utföras. / Single Sign-On (SSO) is an authentication process that allows a developer to delegate the authentication responsibility to a dedicated service. OAuth 2.0 is an authorization framework that often serves as a base for authentication layers to be built upon that in turn allows for SSO. An identity provider is the service that is responsible for handling user credentials and the authentication, two common identity providers are Google and Facebook that implement SSO with the authentication layers OpenID Connect respectively Facebooks own authentication layer. It has been shown that many clients using OAuth 2.0 as base for SSO make faulty implementations leading to security issues, a number of studies has proposed solutions to these issues but faulty implementations are continually being made. To create various tools to promote security in these contexts is a method where OAuthGuard has been developed with the vision to also directly protect the common website user directly from the browser. OAuthGuard has been used in an earlier study to analyze the security of clients using Google SSO and discovered that 50% of the analyzed clients had flaws, no comparable study has been done for clients using Facebook SSO, which is the second largest third party log in variant. This study made a comparable investigation for Facebook SSO clients with a further developed version of OAuthGuard and found that these clients suffer from flaws with a similar trend as the previous study with Google-SSO clients, although fewer Facebook-SSO clients suffer from these flaws. When further developing OAuthGuard a dumber of difficulties was discovered and the future of these kind of tools needs to be investigated. Further analysis needs to be done to assess if Facebook-SSO should be recommended over Google-SSO from a security perspective and also further exploration of new methods to promote security needs to be done.

Approved for public release; distribution in unlimited. / Complex multilevel secure (MLS) architectures are emerging that require user identification and authentication services not only from multilevel connections, but from pre-existing single level networks. The XTS-400 can be used as a server in such environments. Trusted devices are required for user login via multilevel connections; however, single level remote login facilities do not require such client-side devices. Instead, a more lightweight mechanism is possible. Remote login capabilities do not exist on the XTS-400 for use over the single level networks and this capability is a desired feature for use in complex multilevel architectures. OpenSSH is an application, developed for OpenBSD, that uses the SSH protocol to provide secure remote logins and an interactive command interface. A secure remote login application, OpenSSH, was ported to the XTS-400 in order to provide remote login capabilities. The porting process identified differences between the original development platform for OpenSSH and the XTS- 400. Solutions, in the form of source code modifications, were made to overcome problems resulting from the compatibility differences encountered during the port. Testing was conducted to ensure that the port was successful and did not violate any security policies enforced by the XTS-400. / Civilian, Naval Postgraduate School

User interface design should provide meaningful and relevant experiences to the user. Users have different expectations on quality factors in services of different domains of usage. Aesthetics are more than just decoration of a user interface and could have significant impact on the continuous user experience, and colors could be a determining factor in the way that users interact with a user interface. This thesis presents an investigation into the user perception of trust, reliability and communicated soft values in the user interface design of the login flow in the Duo application. The Duo application is a second screen interaction application, combining public service television with interactive cross-program entertainment. The study followed the Double Diamond framework for innovation in design work. A pre-study was done consisting of a literature review, state of the art, and sending out a survey. This was followed by designing and iteration of prototypes and then conducting user tests and evaluation of the final iteration of prototypes. The findings from the pre-study identified characteristics for what users perceived of different interfaces in regards to soft values, as well as experiences with login. The characteristics were incorporated in the prototypes that were evaluated through user testing. After that, the evaluation of characteristics of the design of the login user interfaces were discussed and concluded to be valid and was finally delivered as design recommendations. Overall, the study points to there being a demand from users for clear identification of the publisher of the service for increased reliability and trustworthiness, through aesthetic means such as color and shape but mainly through logotypes or text. / Design av användargränssnitt ska ge meningsfulla och relevanta upplevelser för användaren. Användare har olika förväntningar på kvalitetsfaktorer i tjänster inom olika användningsområden. Estetik är mer än bara dekoration av ett användargränssnitt och kan ha betydande inverkan på den kontinuerliga användarupplevelsen, och färger kan vara en avgörande faktor för hur användarna interagerar med ett användargränssnitt. Detta examensarbete presenterar en undersökning av användarens uppfattning om trovärdighet, pålitlighet och kommunicerade mjuka värden i användargränssnittet av inloggningsflödet i Duo-appen. Duo-appen är en applikation med “second screen interaction“, som kombinerar public service-tv med interaktiv programöverskridande underhållning. Studien följde Double Diamondmodellen för innovation i designarbete. En förstudie gjordes bestående av en litteraturgenomgång, state of the art och utskick av en enkät. Detta följdes av designarbete och iteration av prototyper för att sedan genomföra användartester och utvärdering av den slutliga iterationen av prototyper. Resultaten från förstudien identifierade egenskaper för vad användarna uppfattade om olika gränssnitt när det gäller mjuka värden, såväl som erfarenheter av inloggning. Egenskaperna införlivades i prototyperna som utvärderades genom användartester. Efter detta diskuterades utvärderingen av egenskaperna hos designen av användargränssnitten för inloggning varvid det landade i att de var rimliga resultat

Inhalt:Übersicht neu beschaffter Hardware, Neuer Mailbox-Server mailbox.hrz.tu-chemnitz.de, Login-Server login.hrz.tu-chemnitz.de, E-Mail per WWW: WebMail mit IMP, CLICK - Chemnitzer Linux Cluster Konzept, Was ist ein Beowulf? GNOME - ein neuer Desktop unter Linux, Linux-Anwendungssoftware, X Gnuplot Front End (XGFE)

Inhalt:Übersicht neu beschaffter Hardware, Neuer Mailbox-Server mailbox.hrz.tu-chemnitz.de, Login-Server login.hrz.tu-chemnitz.de, E-Mail per WWW: WebMail mit IMP, CLICK - Chemnitzer Linux Cluster Konzept, Was ist ein Beowulf? GNOME - ein neuer Desktop unter Linux, Linux-Anwendungssoftware, X Gnuplot Front End (XGFE)