Stealing Trust: Unraveling Blind Message Attacks in Web3 Authentication

• URL: http://arxiv.org/abs/2406.00523v4
• Date: Mon, 30 Sep 2024 19:03:11 GMT
• Title: Stealing Trust: Unraveling Blind Message Attacks in Web3 Authentication
• Authors: Kailun Yan, Xiaokuan Zhang, Wenrui Diao,
• Abstract summary: This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities.
• Score: 6.338839764436795
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As the field of Web3 continues its rapid expansion, the security of Web3 authentication, often the gateway to various Web3 applications, becomes increasingly crucial. Despite its widespread use as a login method by numerous Web3 applications, the security risks of Web3 authentication have not received much attention. This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages, thereby achieving unauthorized access to the target application. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities. Our evaluation of real-world Web3 applications shows that a staggering 75.8% (22/29) of Web3 authentication deployments are at risk of blind message attacks. In response to this alarming situation, we implemented Web3AuthGuard on the open-source wallet MetaMask to alert users of potential attacks. Our evaluation results show that Web3AuthGuard can successfully raise alerts in 80% of the tested Web3 authentications. We have responsibly reported our findings to vulnerable websites and have been assigned two CVE IDs.

Related papers

• User Profiles: The Achilles' Heel of Web Browsers [12.5263811476743]
  We show that, except for the Tor Browser, all modern browsers store sensitive data in home directories with little to no integrity or confidentiality controls. We show that security measures like password and cookie encryption can be easily bypassed. HTTPS can be fully bypassed with the deployment of custom potentially malicious root certificates.
  arXiv  Detail & Related papers  (2025-04-24T16:01:48Z)
• WAFFLED: Exploiting Parsing Discrepancies to Bypass Web Application Firewalls [4.051306574166042]
  Evading Web Application Firewalls (WAFs) can compromise defenses. We present an innovative approach to bypassing WAFs by uncovering parsing discrepancies. We identified and confirmed 1207 bypasses across 5 well-known WAFs.
  arXiv  Detail & Related papers  (2025-03-13T19:56:29Z)
• URL Inspection Tasks: Helping Users Detect Phishing Links in Emails [23.377429588655083]
  We develop a novel phishing defense mechanism based on URL inspection tasks. These tasks require users to interact with, and understand, the basic URL structure. Results show that these tasks significantly decrease the rate of successful phishing attempts.
  arXiv  Detail & Related papers  (2025-02-27T16:20:21Z)
• WAFBOOSTER: Automatic Boosting of WAF Security Against Mutated Malicious Payloads [11.845356035416383]
  Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. As web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. We have developed a novel learning-based framework called WAFBOOSTER, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security.
  arXiv  Detail & Related papers  (2025-01-23T16:44:43Z)
• Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems [9.046883991816571]
  We propose SE2FA, a vulnerability evaluation framework designed to detect vulnerabilities in 2FA systems. We analyze the security of 407 2FA systems across popular websites from the Tranco Top 10,000 list.
  arXiv  Detail & Related papers  (2024-11-18T13:08:56Z)
• FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks [45.65210717380502]
  Large language models (LLMs) have been widely deployed as the backbone with additional tools and text information for real-world applications. prompt injection attacks are particularly threatening, where malicious instructions injected in the external text information can exploit LLMs to generate answers as the attackers desire. This paper introduces a novel test-time defense strategy, named AuThentication with Hash-based tags (FATH)
  arXiv  Detail & Related papers  (2024-10-28T20:02:47Z)
• Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective [53.24281798458074]
  Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning)
  arXiv  Detail & Related papers  (2024-05-21T13:34:23Z)
• A Novel Protocol Using Captive Portals for FIDO2 Network Authentication [45.84205238554709]
  We introduce FIDO2CAP: FIDO2 Captive-portal Authentication Protocol. We develop a prototype of FIDO2CAP authentication in a mock scenario. This work makes the first systematic approach for adapting network authentication to the new authentication paradigm relying on FIDO2 authentication.
  arXiv  Detail & Related papers  (2024-02-20T09:55:20Z)
• Reducing Usefulness of Stolen Credentials in SSO Contexts [0.0]
  Multi-factor authentication (MFA) helps to thwart attacks that use valid credentials, but attackers still commonly breach systems by tricking users into accepting MFA step up requests. This paper proposes a token-based enrollment architecture that is less invasive to user devices than mobile device management.
  arXiv  Detail & Related papers  (2024-01-21T21:05:32Z)
• Architecture of Smart Certificates for Web3 Applications Against Cyberthreats in Financial Industry [2.795656498870966]
  This study addresses security challenges associated with the current internet, specifically focusing on emerging technologies as blockchain and decentralized storage. It also investigates the role of Web3 applications in shaping the future of the internet.
  arXiv  Detail & Related papers  (2023-11-03T14:51:24Z)
• Exposing and Addressing Security Vulnerabilities in Browser Text Input Fields [22.717150034358948]
  We perform a comprehensive analysis of the security of text input fields in web browsers. We find that browsers' coarse-grained permission model violates two security design principles. We uncover two vulnerabilities in input fields, including the alarming discovery of passwords in plaintext.
  arXiv  Detail & Related papers  (2023-08-30T21:02:48Z)
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection [64.67495502772866]
  Large Language Models (LLMs) are increasingly being integrated into various applications. We show how attackers can override original instructions and employed controls using Prompt Injection attacks. We derive a comprehensive taxonomy from a computer security perspective to systematically investigate impacts and vulnerabilities.
  arXiv  Detail & Related papers  (2023-02-23T17:14:38Z)
• Robust and Verifiable Information Embedding Attacks to Deep Neural Networks via Error-Correcting Codes [81.85509264573948]
  In the era of deep learning, a user often leverages a third-party machine learning tool to train a deep neural network (DNN) classifier. In an information embedding attack, an attacker is the provider of a malicious third-party machine learning tool. In this work, we aim to design information embedding attacks that are verifiable and robust against popular post-processing methods.
  arXiv  Detail & Related papers  (2020-10-26T17:42:42Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.