| Title | Attacks and vulnerability analysis of e-mail as a password reset point |
| Publication Type | Conference Paper |
| Year of Publication | 2018 |
| Authors | Routh, Caleb, DeCrescenzo, Brandon, Roy, Swapnoneel |
| Conference Name | 2018 Fourth International Conference on Mobile and Secure Services (MobiSecServ) |
| Keywords | authorisation, brute force attacks, brute-force attack, Collaboration, Computer hacking, e-mail servers, Electronic mail, Email, emails, human factors, Internet, middle attack, mobile devices, Mobile handsets, password, Password Reset, personal Email account, policy-based governance, Protocols, pubcrawl, public knowledge attainable, security analysis, security questions, self-service password reset point, social engineering attack, social media, vulnerability analysis |
| Abstract | In this work, we perform security analysis of using an e-mail as a self-service password reset point, and exploit some of the vulnerabilities of e-mail servers' forgotten password reset paths. We perform and illustrate three different attacks on a personal Email account, using a variety of tools such as: public knowledge attainable through social media or public records to answer security questions and execute a social engineering attack, hardware available to the public to perform a man in the middle attack, and free software to perform a brute-force attack on the login of the email account. Our results expose some of the inherent vulnerabilities in using emails as password reset points. The findings are extremely relevant to the security of mobile devices since users' trend has leaned towards usage of mobile devices over desktops for Internet access. |
| DOI | 10.1109/MOBISECSERV.2018.8311443 |
| Citation Key | routh_attacks_2018 |
Attacks and vulnerability analysis of e-mail as a password reset point