IEEE Consumer Electronics Magazine - May 2018 - 52

Junsung
Y
name="rewardStarCount">8
name="E_FREQUENCY_MEMGRADE">M1
name="pushApplyYN">Y
name="isEfreqFirstVisit">false
name="STARBUCKS_APP_UDID_INFO_ID">c38bb3d8-8b95-494...
name="couponCount">0

LseTuIJOISi+w/R1GDrJtA==
Junsung Cho
Y
https://www.istarbucks.co.kr/interface/w...
name="E_FREQUENCY_BARCODE">9071000000001380
name="GCMID">APA91BFLecB3wz7wLVnhvG1545_oGPpAR1jwpj...
name="cardNo">6099000000002028
name="326">https://www.istarbucks.co.kr/interface/w...

GOROAD

FIGURE 3. A user credential file (com.starbucks.co_preferences.xml) in the Starbucks application. Some important fields are highlighted
in red boxes.

MOCI
We also performed a user credential cloning attack on the
MOCI application. Unlike the Starbucks application using the
Shared Preferences file, MOCI uses the SQLite
Databases file (moci.sqlite) to store the user credential
data for automatic login. The moci.sqlite file consists of
three tables. The user credential data are stored in the prefs
table, with 44 records. When we compared the prefs table
for D attacker with that for D victim, the specific eight records were
different only between those tables (see Table 1). Therefore,
when we replaced those records for D attacker with the ones
for D victim, we successfully performed the user credential
cloning attack.

Figure 5 displays the results before and after performing
our attack on the MOCI application. In this figure, we can
also see that different account information is displayed
according to which user credential data are used. Even
though the user credential attack works well by simply copying all of the eight changed records, we concluded, after carefully inspecting the differences between the eight D attacker and
D victim records, that only two (ar and as) are associated with
the user credential data.

USER CREDENTIAL CLONING ATTACK PREVENTION
In this section, we discuss five possible defense strategies to
mitigate user credential cloning attacks.

BINDING USER CREDENTIAL
DATA TO A SPECIFIC DEVICE

(a)

(b)

FIGURE 4. The results of a user credential cloning attack on the Starbucks application: (a) before and (b) after the attack.
52 IEEE Consumer Electronics Magazine

MAy 2018

Our first strategy is to bind user credential data
in the target application to a specific device to
prevent an attacker from reusing user credential
data for his or her own device. To achieve this, a
typical method is to use cryptographic primitives, such as encryption.
For example, we can store user credential
data in encrypted form so that only an authorized application (running on a specific device)
can access the plaintext user credential data
in that form. For this purpose, user credential
data are encrypted with a key that is generated at runtime by the application with devicespecific attributes. Such attributes may include
the device model, operating system, International Mobile Equipment Identity (IMEI),
mobile equipment identifier, International

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May 2018