Hacking in the Blind: (Almost) Invisible Runtime User Interface - PowerPoint PPT Presentation

Hacking in the Blind: (Almost) Invisible Runtime User Interface Attacks Luka Malisa , Kari Kostiainen, Thomas Knell, David Sommer, and Srdjan Capkun {firstname.lastname}@inf.ethz.ch knellt@student.ethz.ch

User Interfaces • Consists of input and output User Interface Input Computer System Output • Used for daily and critical tasks 2

User Interface Attacks UI Attacks are often possible 1. Brief and non-invasive 2. Bypass security features Input Output App … App Computer System 3

Existing Command Injection Attacks 1. New Keyboard 2. New Mouse • Drawbacks - Registers new peripherals - Installs malware - Assume user not present 4

Limitations • Observations 1. Hardened devices 2. Malware installation not possible 3. Damaging attacks possible only when user is present Can we attack without installing malware? 5

Our Attack 1. Click Blocked 1. Click Blocked 2. Inject Events 2. Inject Events 3. Heart rate = 1000 !!! Heart rate = 100 • Benefits + Does not install new peripherals + Does not install malware + Assume user is present 6

Our Attack !!! 7

Attack Demonstration 8

Attack Overview 9

Mouse Location Estimator Mouse Events: Mouse Events: Mouse Events: Up 10px Up 100px Right 150px Left 10px Left 100px Down 150px 10

State Tracking Username: John Doe Password: ****** Login Cancel 11

State Tracking State 0 Login Cancel 1 Click outside 3 Click “Cancel” 2 Click “Login” State 0 State 1 State 2 OK Cancel Button 1 Button 2 12

State Tracking • Maintain all possible options Login Cancel • Strategies to assign probabilities 1. Both buttons are equally likely 2. “Cancel” is more likely (more area) 3. “Login” is more likely (clicked more often) • Introduce expert knowledge through assumptions on probabilities 13

Attack Overview 14

User Interface Models Full Model Application Partial Model Text E-Banking UI Text Pay to: Amount: Button Submit Cancel Button 15

Attack Applicability UI unique? Yes No Partial model App simple? Yes No Full model Not applicable 16

Evaluation State Estimation Accuracy: 90% after 10 clicks Attack Success Rate: >90% Simulated Pacemaker Programmer 17

Evaluation Attack Success Rate: >90% Processing Delay: 40ms 18 E-Banking

Countermeasures • Preventing our attack 1. Trusted path 2. Biometrics 3. Randomized UIs (See paper for others) 19

Discussion • No signs of attacks in the wild , but hardware exists • Attack device easy to minimize • Small footprint 20

Conclusion • Hacking-in-the-Blind • A novel UI attack • Easy to deploy • Invisible to malware detection • Accurate and stealthy Thank you! 21