DIVINA: Discovering Vulnerabilities of Internet Accounts

Ziad Ismail (1) , Danai Symeonidou (2) , Fabian M. Suchanek (3)

1 EDF R&D MRI - Management des Risques Industriels
2 LRI - Laboratoire de Recherche en Informatique
3 LTCI - Laboratoire Traitement et Communication de l'Information

Internet users typically have several online accounts – such as mail accounts, cloud storage accounts, or social media accounts. The security of these accounts is often intricately linked: The password of one account can be reset by sending an email to another account; the data of one account can be backed up on another account; one account can only be accessed by two-factor authentication through a second account ; and so forth. This poses three challenges: First, if a user loses one or several of his passwords, can he still access his data? Second, how many passwords does an attacker need in order to access the data? And finally, how many passwords does an attacker need in order to irreversibly delete the user's data? In this paper, we model the dependencies of online accounts in order to help the user discover security weaknesses. We have implemented our system and invite users to try it out on their real accounts.

Domains: Web; Databases [cs.DB]

Ziad Ismail, Danai Symeonidou, Fabian M. Suchanek. DIVINA: Discovering Vulnerabilities of Internet Accounts. 24th International Conference on World Wide Web Conference, May 2015, Florence, Italy. 1 562 p., ⟨10.1145/2740908.2742836⟩. ⟨hal-01699871⟩