Why don't websites and devices offer fake logins for hackers?

Question

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details and tries to log in to a website (for example) the website will show that you have successfully logged in but will show dummy data that is completely fake.

That way the hacker won't know if they have got the login details correct or not. It will also protect people in a security situation. For instance, imagine a criminal has stolen someones phone and realises he can't access it. He then points a gun at the owner who then types in part of their details correct but some of them incorrectly. The device unlocks in fake mode, and the criminal then thinks they have access and they decide not to shoot the person because they have complied with their wishes. But the criminal never knows that what they see is just a fake login.

Has anyone implemented something like this? It seems like quite a good idea to me.

Answer 1

That way the hacker won't know if they have got the login details correct or not.

If the information presented after login has no relationship to the person who the login should be for, then most hackers will quickly recognize that the login is probably not the real one.

But, in order to show information which looks like it fits the user, considerable effort could be needed. It also needs to be created specifically for each user and show some true information about the user so it does not look fake but not too much so no important information is leaked.

You cannot expect your provider to do this for you but you might try to do this yourself in many cases, i.e. add another email account, another facebook account etc.

Answer 2

The concept you're describing is called Plausible Deniability and methods to provide it have indeed been implemented in some software, VeraCrypt being one example.

One problem with implementing it in websites, as you suggest, is that it's very hard for the website developer to come up with fake data that is realistic enough to fool an attacker while not giving away any sensitive data about the user. In encryption software like VeraCrypt, that task is shifted to the user, who is obviously in a much better position to do that.

Answer 3

Because hackers don't attack login forms

The flaw is that you assume hackers get into accounts by brute-forcing credentials against remote services. But that's futile anyway.

Any website with decent security (the ones without decent security wouldn't care about your idea either) will have a limit imposed on how many failed login attempts can be made in a certain timeframe per IP address, usually something like 5 failed attempts every 6 hours. If security is a bit stronger, accounts might also need action from the owner after a number of failed attempts, and/or the owner might be notified of failed login attempts or even all logins from new devices.

So while brute-force attacks may well be feasible against plain data (such as password hashes exposed in a breach), they are nowhere near feasible against any service with even a bit of security.

For attackers, it is thus much easier to go phishing, or better yet set up a genuine free service themselves and work on the assumption of password reuse:

Answer 4

I have never heard of any service or device implementing this either.

The case where an attacker is present and forcing you to login is pretty unlikely. They are more likely to just take your $1000 iPhone and run.

However, it is very plausible for this to happen if the "attacker" is a security guard/TSA officer at an airport security checkpoint. Especially if you are in a foreign country. (There was a PHENOMENAL Defcon talk on this subject a few years back.)

Websites

It probably wouldn't make much sense to implement this on a website. If you (the admin) are certain that someone who is attempting to access an account is a hacker, just block them/lock the account. Problem solved.

If the attacker is trying to access multiple accounts, they will probably know something is fishy if they are able to "successfully" login to multiple accounts on the first or second try.

Phones

While phones don't allow fake logins (?), but you can set them to lock after the password isn't entered correctly n times.

Attacker/TSA agent tells you to unlock phone. You intentionally enter wrong password on 1st try.

"Oh, oops, wrong password..."

You enter the wrong password again on the 2nd try.

"Sorry, my hands get sweaty when I am nervous..."

You enter wrong password on 3rd try. Phone is now locked for 30 minutes!

This of course will not work if you are reciting the password to the attacker, and they are entering it in the phone. And I think most phone lockouts only last for 30 minutes (?), during which time the attacker/TSA agent will do their best to "convince" you to remember the password in a back room.

Laptops

Your suggestion would be relatively easy to implement on a laptop...

Create 2 or more user profiles.

The first profile you name after yourself (first and last name). You set a picture of yourself as the profile picture. This will be your "fake" account. Set the password as something simple and easy to remember. Put some "personal stuff" in the account (music, pictures of your pet, "work" documents, etc).

The second account you give a generic family member name ("hubby", "the kids", "honey", etc). Keep the default profile picture. Set a strong password. This will be the account with admin privileges on the laptop, and the account which you will use for your important/confidential work.

Now imagine a scenario in which you are forced to login...

You are in an airport in Oceania, about to fly home to Eurasia. Airport security stop you on your way through the terminal.

Security: "Give us your passport and laptop!"

You hand them the laptop and passport. They turn on laptop, and try to login to the account which you named after yourself. Upon seeing they need a password, they demand you tell them the password.

You: "The password is opensea. No spaces."

The airport security enter the password, and successfully enter your fake account.

After looking around for a few minutes and not finding anything that interests them, they log out and try to login to your real account.

Security: "Whose account is this? What is the password?"

You: "That is my kids' account. The password is 123dogs."

They enter the password, but are unable to login.

Security: "That password is wrong! Tell us the correct password!"

You act surprised, and ask them to give you the laptop so you can attempt to login. They hand you the laptop, and you start typing in bogus passwords.

You: "Those darn kids, I told them NOT to change the password! I'm sorry, they were only supposed to use that account for their stupid video games!"

The airport security confer with each other, and then let you go on your way. You safely return to Eurasia without having the confidential information on your laptop compromised.

Answer 5

It's not exactly the context you had in mind but there are in fact systems which implemented this idea. I used to work at a (somewhat sensitive) facility where each employee had two codes to disable the alarm system: The regular one and a duress code. If you used the duress code, the system would be disabled so as to not put you in danger but a silent alarm would go off at the monitoring centre. I am reading on Wikipedia that this was also considered for bank ATM in the US but ultimately ruled out.

Another similar concept is the “honeypot“. Some of them might in fact accept any credentials or serve dummy data when attacked, to be able to record what an attacker does next or otherwise exploit the situation (e.g. capture the payload of a worm).

As to why it's not more common in consumer products, online services, etc. there is simply a trade-off between the benefits (how likely a particular attack is, whether it would effectively deter criminals or just prompt them to slightly alter their technique) and the costs (more complex systems to develop, maintain and certify - which also means increased attack surface that could afford an attacker with an actual entry point, bandwidth and operating costs to serve the dummy data to all botnets constantly attacking online services, effort to create credible dummy data to fool more sophisticated attacks).

Answer 6

This is called 'Deception Technology' in the cyber world where the solution deceives cyber foes (attackers) with turn-key decoys (traps) that “imitate” your true assets. Hundreds or thousands of traps can be deployed with little effort, creating a virtual mine field for cyber attacks, alerting you to any malicious activity with actionable intelligence immediately. The traps would carry login details, dummy data, dummy system, etc to deceive the attacker by intimating like actual system.

Deception technology is an emerging category of cyber security defense. Deception technology products can detect, analyze, and defend against zero-day (where the attack type/procedure is not known before) and advanced attacks, often in real time. They are automated, accurate, and provide insight into malicious activity within internal networks which may be unseen by other types of cyber defense. Deception technology enables a more proactive security posture by seeking to deceive the attackers, detect them and then defeat them, allowing the enterprise to return to normal operations.

You may refer below link for some solution providers: https://www.firecompass.com/blog/top-5-emerging-deception-technology-vendors-at-rsa-conference-2017/

Answer 7

This has been done in the past, rather successfully, but depends a lot on what the system is.

At one point it was not uncommon for paid access websites to auto detect when an account was logging in from too many IP addresses or with other suspicious patterns and redirect those users to a version of the site that was primarily ads and affiliate links to other sites. If done well the sharing of stolen login credentials could become a revenue center.

There are also websites that direct users to different versions based on IP address or other criteria; the simplest version of this is targeted advertising.

For shell access it's possible to direct a login to a chrooted jail that has only a small section of disk and specially provisioned binaries, which may not necessarily be the same as the general system.

Answer 8

First off, I wouldn't call the attacker in this scenario a hacker. A hacker is trying to get around the security that the website offers, in your scenario the attacker doesn't care how secure your services are, he cares how easily the user is intimidated and possibly what to do with the body afterwards.

Secondly, alternate credentials that change your access has been done, but if it does more than present a restricted view of the truth, is a lot of work and of limited utility.

The reason it is of limited utility, is because your users know about it, you must presume that any attacker knows about it as well. Suppose you did this for an ATM card so that it showed a balance that was less than a hundred dollars in order to limit your loss. Either the attacker asks for both (in which case the victim has at best a 50% chance of not loosing more) or simply includes as part of his demands that it produces more than that -- "if I don't get at least 200 you're dead".

It's not totally useless, but is only effective against an ignorant attacker. Relying upon the attacker not knowing something is called security through obscurity, aka "they got it".

Answer 9

For web and a remote attack, as many folks here stated before, appart from the difficulty of creating fake user's content , there is the problem of : how do you know it's a compromised login?

I mean, if you assume there is some sort of suspicious activity , like a brute-force attack, you can just block the login for that IP and maybe for that account itself for a while (until the real owner somehow validates its identity)

The only usefull cases are forced logins, that's another story and a pretty cleaver idea. Here is the implementation I imagine for a social network:

1. The user creates himself an account with dummy data, and set it as his dummy account.
2. When there is a forced login going on, like you jelous gf or bf extorting you to login , then you put the dummy password and there is! you are logged in your beautiful self created dummy account.

BUT Its not a perfect solution either. The attacker probably would know you and, if it's your crazy ex for instance, she may just check her chatlog with you and will know you just logged on the bogus account.

This is specially relevant because it will be a public well known feature of the platform you are , so anybody who forces you would be able to check wheter are you or not.

For banks or other sites, it's a pretty good idea.

Answer 10

The problem is that your users have to know about it, thus you must presume that any attacker knows about it as well.

Answer 11

To me, this sounds as if you were inviting the attacker to dance with you.

"Hey attacker, you want to hack my website? Well here is a fake login web site for you!"

You certainly do not want to invite the attacker to dance with you because he might find it amusing and challenging which would give him even more motivation to try to hack into your website.