Informatics scientists' ‘active cookies’ put bite on cyber crooks

Dec 07, 2006

Researchers at the Indiana University School of Informatics and RSA Laboratories have written a recipe to protect Internet users from identity theft and other kinds of cyber attacks.

Whereas regular computer cookies, which are often used for authentication purposes, can easily be stolen from the computers where they belong, active cookies resist such attacks. This helps keep identifying information secret, which in turns stops cyber attacks.

Cookies are coded pieces of information stored on a user's computer. The cookies identify that computer, and therefore also its user, during the current and subsequent visits to a Web site. Active cookies can be used in exactly the same general manner, but are resistant to attacks by identity thieves and hackers.

"Normal computer cookies can be stolen in many ways," said Markus Jakobsson, associate professor of informatics and co-inventor of active cookies. "One way is for the attacker to interfere with what is called the domain lookup, a process when an Internet address, such as a well-known lending institution, is translated to an Internet Protocol address, which is the real address computers use to communicate."

This attack is called Domain Name System poisoning, commonly referred to as pharming, and it allows any users' cookies to be stolen. The attacker could simply target one of the many machines a computer interacts with when its users browse the Web, including a home router.

"But active cookies cannot be stolen like this, even if an attacker interferes with the DNS translation," said Jakobsson. "The reason is simple: Active cookies use one step that requires no translation."

Jakobsson and Sid Stamm, a computer science doctoral student at the School of Informatics, worked on the project with Ariel Juels of RSA Laboratories in Massachusetts. Jakobsson and Juels also are co-founders of RavenWhite, a private company developing cookie technology to protect users from on-line threats.

Stamm said that if an attacker successfully interferes with the translation, then the attacker still cannot obtain all the secret information he needs to impersonate the victim.

"This allows your bank to check that you are you," said Stamm, "or at least that the person who knows your username and password also uses your computer. This could really make a difference in terms of the threat of phishing."

The reason is simple: While a cyber crook might trick a user into revealing their PIN number or password, as is commonly done in some scams, it is not enough to gain access to the user's account; they would need to steal a person's personal computer where the active cookies are stored.

The researchers claim, for example, that a user's bank can put active cookies on their clients' home and work computers.

"And you can still log in if you travel, you might just have to provide some additional identifying information then, or your bank can compare your login location with the location of your last ATM withdrawal," Jakobsson said. "Or the active cookies system used by banks can flag suspicious login transactions and see whether they result in strange transfers. Then the bank could put a hold on these transactions and verify them with their customers."

The researchers' work will be presented in February at the 14th Annual Network & Distributed System Security Symposium in San Diego, Calif.

Source: Indiana University

Explore further: Ant colonies help evacuees in disaster zones

add to favorites email to friend print save as pdf

Related Stories

At tech fest: 3D printers, bitcoin and 'Titanfall'

Mar 11, 2014

Bitcoin, 3-D printed candy and George Takei, the Star Trek-actor-turned-Facebook-phenomenon, are among the attractions this week at the South By Southwest festival in Austin, Texas, where the geek set is ...

New Quantum Strategy Keeps Web Searches Private

Jun 27, 2008

When an Internet user types a word or phrase into a search engine, the Web server has the ability to find out that inquiry. As more people and businesses are becoming concerned about privacy, researchers are developing new ...

Recommended for you

'Chief Yahoo' David Filo returns to board

23 minutes ago

Yahoo announced the nomination of three new board members, including company co-founder David Filo, who earned the nickname and formal job title of "Chief Yahoo."

Fired Yahoo exec gets $58M for 15 months of work

33 minutes ago

Yahoo's recently fired chief operating officer, Henrique de Castro, left the Internet company with a severance package of $58 million even though he lasted just 15 months on the job.

Simplicity is key to co-operative robots

8 hours ago

A way of making hundreds—or even thousands—of tiny robots cluster to carry out tasks without using any memory or processing power has been developed by engineers at the University of Sheffield, UK.

Freight train industry to miss safety deadline

9 hours ago

The U.S. freight railroad industry says only one-fifth of its track will be equipped with mandatory safety technology to prevent most collisions and derailments by the deadline set by Congress.

User comments : 0

More news stories

Simplicity is key to co-operative robots

A way of making hundreds—or even thousands—of tiny robots cluster to carry out tasks without using any memory or processing power has been developed by engineers at the University of Sheffield, UK.

Microsoft CEO is driving data-culture mindset

(Phys.org) —Microsoft's future strategy: is all about leveraging data, from different sources, coming together using one cohesive Microsoft architecture. Microsoft CEO Satya Nadella on Tuesday, both in ...

Floating nuclear plants could ride out tsunamis

When an earthquake and tsunami struck the Fukushima Daiichi nuclear plant complex in 2011, neither the quake nor the inundation caused the ensuing contamination. Rather, it was the aftereffects—specifically, ...

New clinical trial launched for advance lung cancer

Cancer Research UK is partnering with pharmaceutical companies AstraZeneca and Pfizer to create a pioneering clinical trial for patients with advanced lung cancer – marking a new era of research into personalised medicines ...

More vets turn to prosthetics to help legless pets

A 9-month-old boxer pup named Duncan barreled down a beach in Oregon, running full tilt on soft sand into YouTube history and showing more than 4 million viewers that he can revel in a good romp despite lacking ...