Open Sesame! Web Authentication Cracking via Mobile App Analysis

摘要：

　　Web authentication security can be undermined by flawed mobile web implementations.Mobile web implementations may use less secure transport channel and enforce less strict brute-force-proof measures,making web authentication services vulnerable to typical attacks such as password cracking.This paper presents an in-depth penetration testing based on a comprehensive dynamic app analysis focusing on vulnerable authentication implementations of Android apps.An analysis of Top 200 apps from China Android Market and Top 100 apps from Google Play Market is conducted.The result shows that 71.3% apps we analyze fails to protect userspassword appropriately.And an experiment carried out among 20 volunteers indicates that 84.4% passwords can be cracked with the knowledge of password transformation process.

关键词： Android apps Web authentication Password cracking

作者: Hui Liu Yuanyuan Zhang Juanru Li Hui Wang Dawu Gu

作者单位: Computer Science and Engineering Department,Shanghai Jiao Tong University,Shanghai,China

会议类型: 国际会议

会议名称: International Asia-Pacific Web Conference(第18届国际亚太互联网大会)

会议地点: 苏州

会议语种:英文

页码: 483-487

在线出版日期: 2016-09-23（万方平台首次上网日期，不代表论文的发表时间）