Abstract

With the rapid growth of online services, the number of online accounts proliferates. The security of a single user account no longer depends merely on its own service provider but also the accounts on other service platforms (We refer to this online account environment as Online Account Ecosystem). In this paper, we first uncover the vulnerability of Online Account Ecosystem, which stems from the defective multi-factor authentication (MFA), specifically the ones with SMS-based verification, and dependencies among accounts on different platforms. We propose Chain Reaction Attack that exploits the weakest point in Online Account Ecosystem and can ultimately compromise the most secure platform. Furthermore, we design and implement ActFort, a systematic approach to detect the vulnerability of Online Account Ecosystem by analyzing the authentication credential factors and sensitive personal information as …

Date

2021

Authors

Weizhao Jin, Xiaoyu Ji, Ruiwen He, Zhou Zhuang, Wenyuan Xu, Yuan Tian

Conference

2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W)

Pages

7-14

Publisher

IEEE