Abstract
FIDO protocols enable online services to leverage native authenticators of end-user computing devices including fingerprint readers for authentication to replace or complement passwords. FIDO protocols also offer support for prompting a user to confirm a specific transaction. However, due to the lack of a trusted display module in most Authenticators, operating systems of user devices display transaction contents directly on the main screen. In the paper, we demonstrate an attack on FIDO transaction confirmation in which malicious applications leverage the disparity between the displayed and actual transaction contents to trick users into confirming falsified transactions. In addition, we propose a lightweight secure display mechanism for FIDO transaction confirmations on mobile devices by leveraging the ARM TrustZone technology.
| Original language | English (US) |
|---|---|
| Title of host publication | CODASPY 2018 - Proceedings of the 8th ACM Conference on Data and Application Security and Privacy |
| Publisher | Association for Computing Machinery, Inc |
| Pages | 155-157 |
| Number of pages | 3 |
| Volume | 2018-January |
| ISBN (Electronic) | 9781450356329 |
| DOIs | |
| State | Published - Mar 13 2018 |
| Event | 8th ACM Conference on Data and Application Security and Privacy, CODASPY 2018 - Tempe, United States Duration: Mar 19 2018 → Mar 21 2018 |
Other
| Other | 8th ACM Conference on Data and Application Security and Privacy, CODASPY 2018 |
|---|---|
| Country | United States |
| City | Tempe |
| Period | 3/19/18 → 3/21/18 |
Fingerprint
Keywords
- FIDO
- Secure Display
- Transaction Confirmation
ASJC Scopus subject areas
- Computer Science Applications
- Information Systems
- Software
Cite this
Secure display for FIDO transaction confirmation. / Zhang, Yongxian; Wang, Xinluo; Zhao, Ziming; Li, Hui.
CODASPY 2018 - Proceedings of the 8th ACM Conference on Data and Application Security and Privacy. Vol. 2018-January Association for Computing Machinery, Inc, 2018. p. 155-157.Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
}
TY - GEN
T1 - Secure display for FIDO transaction confirmation
AU - Zhang, Yongxian
AU - Wang, Xinluo
AU - Zhao, Ziming
AU - Li, Hui
PY - 2018/3/13
Y1 - 2018/3/13
N2 - FIDO protocols enable online services to leverage native authenticators of end-user computing devices including fingerprint readers for authentication to replace or complement passwords. FIDO protocols also offer support for prompting a user to confirm a specific transaction. However, due to the lack of a trusted display module in most Authenticators, operating systems of user devices display transaction contents directly on the main screen. In the paper, we demonstrate an attack on FIDO transaction confirmation in which malicious applications leverage the disparity between the displayed and actual transaction contents to trick users into confirming falsified transactions. In addition, we propose a lightweight secure display mechanism for FIDO transaction confirmations on mobile devices by leveraging the ARM TrustZone technology.
AB - FIDO protocols enable online services to leverage native authenticators of end-user computing devices including fingerprint readers for authentication to replace or complement passwords. FIDO protocols also offer support for prompting a user to confirm a specific transaction. However, due to the lack of a trusted display module in most Authenticators, operating systems of user devices display transaction contents directly on the main screen. In the paper, we demonstrate an attack on FIDO transaction confirmation in which malicious applications leverage the disparity between the displayed and actual transaction contents to trick users into confirming falsified transactions. In addition, we propose a lightweight secure display mechanism for FIDO transaction confirmations on mobile devices by leveraging the ARM TrustZone technology.
KW - FIDO
KW - Secure Display
KW - Transaction Confirmation
UR - http://www.scopus.com/inward/record.url?scp=85052012032&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85052012032&partnerID=8YFLogxK
U2 - 10.1145/3176258.3176946
DO - 10.1145/3176258.3176946
M3 - Conference contribution
AN - SCOPUS:85052012032
VL - 2018-January
SP - 155
EP - 157
BT - CODASPY 2018 - Proceedings of the 8th ACM Conference on Data and Application Security and Privacy
PB - Association for Computing Machinery, Inc
ER -