Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented.

Specifically, is there a way (or has it been done) that you can create a setup that will only allow access if a certain "tempo" is kept? More importantly, if this certain "tempo" (just a rhythm to the keystrokes) isn't kept up is there a way for this program to search the other users system for the MAC address to ban it from the network? (I just feel like banning an IP isn't good enough)

If the latter part is something that would be illegal let me know, not trying to break the law in making this program work.

share|improve this question
What would be a better way to ban an unauthorized user from the network or system? Also, is there a way to make a system or program recognize a DOS attack and stop it by complying and sending the would be attacker an overload of data that would essentially crash their system? Again, if this is illegal/unethical let me know. – William Jan 28 '12 at 20:29
1  
Is this in a private network or public network? Either way it's a bad idea, and you'll end up more likely crashing your network than helping it. – neil Jan 28 '12 at 20:47

3 Answers

up vote 4 down vote

Keystroke Dynamics has been suggested in various forms since World War 2. More recently, there was a paper published on continuous keystroke dynamic authentication (end of 2011) so I'll link to it when I find it.

Your second part is unethical/illegal and also pointless - it is trivial to change MAC addresses so it would not be a good way to build a black list.

share|improve this answer
I was under the impression that MAc addresses were static and couldn't be changed. I guess you can't take what a teacher tells you at face value though. Thank you for the info. – William Jan 28 '12 at 20:26
@William: you can't even guarantee that two machines don't have the same MAC Address; while they're supposed to be globally unique, they're not always. And on top of that, as Rory said above, they are trivial to change to boot. Anything involving a MAC address should be treated as subject at best. – Reid Jan 28 '12 at 21:51
up vote 1 down vote

Why do you think banning a MAC address is better than banning an IP address? Both are at best naïve methods to implement security, both can be changed at attacker's will.

Also Keystroke rhythm method is also demonstrably ineffective. 1) it can be easily simulated 2) it is highly user-unfriendly. 3) someone can actually cause a denial of service attack by injecting pauses or by forcing a different rhythm.

share|improve this answer
This is something new that I am getting into so don't know a whole heck of a lot. The MAc address thing was something our teacher tried to tell us was a constant and would never change, unlike an IP address. I can see he was wrong, but that's as far as I knew. The DOS attacks I was keeping in mind but needed to know a few more things before I asked more about it. Maybe this should be in a discussion type forum instead of me asking questions here. – William Jan 28 '12 at 20:33
Fair enough :-) ... a note about keystroke dynamics: KD is a biometric method and the number of sensors required to be certain about the identity of the user is high: Using a system that is continuously monitoring a user would be highly noisy. Using something that is repeatable is less likely to be noisy (for example a user can be asked to type a particular random sentence). However there are more effective biometric authentication systems. Can you explain your use case a bit more? – Ahmed Masud Jan 28 '12 at 20:49
I pretty much want to have a cycling set of different tempos, enough that you can cycle one every 6 hrs of every day for a few months but randomly cycle them. It's a point of securing any system or network from attacks or intrusions. I might have to look a little more into how systems are hacked and what not. You guys can close this question if you see it as necessary, I really haven't done my homewwork... – William Jan 28 '12 at 21:27
up vote 0 down vote

I don't know if I'm fulling understanding the scope of the problem at hand here, but I think what you're looking for is a type of hybrid-portknocking like tariq. But then again, this depends on your user base, and what you're trying to accomplish.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.