Fake Server Authentication for Stolen Credential Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyberattacks involving stolen login credentials remain vulnerable until users change their passwords, as existing countermeasures are ineffective in preventing unauthorized access and tracking malicious actors.
Innovation Solution
A user authentication process that redirects users with flagged credentials to a fake server, collecting metadata and prompting multi-factor authentication, while injecting tracking cookies to monitor and blacklist IP addresses, and displaying warning messages to deter further unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If forced password change processes are implemented, then user account security is improved, but user accounts remain vulnerable prior to countermeasures being implemented
Solution Approach 1:
The system performs preliminary actions by detecting stolen credentials and redirecting users to a fake server before the actual password change process occurs. This preliminary detection and redirection happens at the authentication stage, collecting metadata and warning users before they can successfully use stolen credentials, thereby reducing the vulnerability period without requiring immediate password changes.
Solution Approach 2:
A fake server acts as an intermediary between the primary server and unauthorized users. This intermediary captures metadata, displays warning messages, and prevents stolen credentials from reaching the primary server, thereby protecting user accounts during the time between credential theft and password changes.
2Measurement precision
If metadata collection and tracking are implemented, then malicious actor identification is improved, but system complexity increases
Solution Approach 1:
The system extracts only the necessary metadata (IP address, user agent, timestamp) from authentication requests on the fake server, rather than collecting all possible system data. This selective extraction provides sufficient information for identifying malicious actors while minimizing the complexity of the tracking system.
Solution Approach 2:
The fake server creates a simplified copy of the authentication interface that collects essential metadata without requiring the full complexity of the primary server's authentication system. This copying approach enables tracking functionality with reduced system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A user authentication process is initiated by a software application executing on a primary server. The user authentication process prompts a user to enter, via a graphical user interface, login credentials. Thereafter, it is determined that the login credentials have been flagged. The user is then directed from the primary server to a fake server (i.e., a second server) mimicking the software application executing on the primary server. Thereafter, the fake server obtains metadata associated with the user interacting with the fake server that characterizes the user. This obtained metadata can later be provided (e.g., displayed, loaded into memory, stored in physical persistence, transmitted to a remote computing system, etc.). Related apparatus, systems, techniques and articles are also described.