Smart buildings are socio-technical systems that bring together building systems, IoT technology and occupants. A multitude of embedded sensors continually collect and share building data on a large scale which is used to understand and streamline daily operations. Much of this data is highly influenced by the presence of building occupants and could be used to monitor and track their location and activities. The combination of open accessibility to smart building data and stringent data protection legislation such as the GDPR makes the privacy of smart building occupants a concern. Until now, little if any research exists on occupant privacy in work-based or commercial smart buildings. This paper begins to address this gap by reporting on a study conducted amongst occupants of a state-of-the-art commercial smart building to understand their privacy concerns and preferences. Our results show that the majority of the occupants are not familiar with the types of data being collected, that it is subtly related to them, nor the privacy risks associated with it. When we informed occupants about this data and the risks, they became more concerned and called for more transparency in the data collection process. The occupants were also largely averse to open accessibility of the collected data.

*Abstract:* Android defines not only an operating system / platform, but a complete ecosystem with more form factors than just smart phones. In this talk, we will look at the Android ecosystem mostly for mobile devices as well as security goals the platform tries to achieve. A specific example is the upcoming mobile driving license that relies on some of the hardware security guarantees modern mobile devices can give. Finally, verifying the security status of actual OEM devices in the lab or in the field is challenging, and we introduce a new project towards crowd-sourcing such data collection in a collaboration between Cambridge University and Johannes Kepler University Linz.

*Bio:* René Mayrhofer is currently heading the Institute of Networks and Security at Johannes Kepler University Linz (JKU), Austria. Between 2017 and 2019, he was the Director of Android Platform Security at Google in Mountain View (US) and helped make recent advances in usable, mobile security research available to the Billions of Android users. Since his return to Linz, he continues to be involved with Android security as a domain expert to foster exchange and collaboration between Android teams at Google and academic research groups.

Previously, he held a full professorship for Mobile Computing at Upper Austria University of Applied Sciences, Campus Hagenberg, a guest professorship for Mobile Computing at University of Vienna, and a Marie Curie Fellowship at Lancaster University, UK. His research interests include computer security, mobile devices, network communication, and machine learning, which he currently brings together in his research on securing mobile devices and digital identity. Within the scope of u'smile, the Josef Ressel Center for User-friendly Secure Mobile Environments, his research group looked into full-stack security of mobile devices from hardware through firmware up to user interaction aspect. One particular outcome was a prototype for a privacy conscious Austrian mobile Driving License (AmDL) on Android smartphones supported by tamper-resistant hardware.

In the Netherlands, the police and the Public Prosecution Service have developed the intervention Hack_Right as an alternative or additional criminal procedure for juvenile computer crime offenders.

Hack_Right aims to prevent recidivism among participants and provides frameworks in which participants can develop their IT talent in a legal manner. In order to achieve this goal, participants are linked to (cyber security) companies. At these companies, the youngsters complete assignments in which they reflect on their crime, learn about ethical hacking and make technical products.

Currently, 14 Hack_Right pilots have been completed. Our study aims to evaluate the Hack_Right intervention and the pilots that have been carried out so far, in order to identify effective and non-effective principles of the intervention. We interviewed 28 respondents involved in the 14 cases: ranging from the public prosecutors that assigned the intervention to the offenders to probation officers, mentors within the cybersecurity companies and the offenders their selves. Preliminary results will be discussed during the presentation.

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

At Graphika, intelligence analysts and computational researchers work together to investigate malicious disinformation campaigns and extremist groups online. Network science and mapping of complex online networks is central to this work. We recently developed a new multi–modal approach to explore the co-evolution of ideas and communities on Twitter during the COVID–19 pandemic. We will describe our methodology and how it employs network science, topic modeling, and statistical analysis to detect the convergence of online communities around specific topical narratives. We will then elaborate how our results lead to new insights about the spread of health mis- and disinformation within conspiratorial communities in the spring and early summer of 2020.

Related Links:

blog: https://graphika.com/posts/q-tips-measuring-the-mainstreaming-of-qanon-during-the-pandemic/

paper: https://arxiv.org/ftp/arxiv/papers/2007/2007.03443.pdf

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

This talk presents novel and practical algorithms to identify the software and hardware components on mobile devices.

* We develop a novel Android library fingerprinting tool, LibID, to reliably identify specific versions of in-app third-party libraries against code obfuscation. We demonstrate the utility of LibID by detecting the use of vulnerable OkHttp libraries in nearly 10% of the 3,958 popular apps on Google Play.

* We present a new type of device fingerprinting, the factory calibration fingerprinting, that recovers embedded per-device factory calibration data from motion sensors in a smartphone.

* We show the calibration fingerprint is fast to generate, does not change over time or after a factory reset, can be obtained without any special user permissions, and is very likely to be globally unique for iOS devices and recent Google Pixel devices. Following our disclosures, Apple deployed a fix in iOS 12.2 and Google in Android 11.

Related URLs:
https://www.cl.cam.ac.uk/~jz448/
https://sensorid.cl.cam.ac.uk/

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

Schedule:

* Tom Holt: "A Crime Script Analysis of the Online Illicit Market for Identity Documents"

* Alice Hutchings: "The evolution of a cybercrime market through setup, stable and covid eras"

* Anita Lavorgna: "To wear or not to wear? Unpacking the #NoMask discourses and conversations on Twitter"

* Simon Parkin, TU Delft: "Refining the Blunt Instruments of Cybersecurity: A Framework to Coordinate Prevention and Preservation of Behaviours"

* Elissa Redmiles, "Responsibly Encouraging Adoption of Contact Tracing Apps"

* Bruce Schneier: "Security and privacy of COVID apps – contact tracing and immunity passports"

This talk covers eavesdropping attacks targeting satellite broadband networks commonly used in maritime, industrial, and aviation contexts. We discuss a series of real-world experiments intercepting radio signals from 18 satellites in geostationary orbit using inexpensive home-television hardware. The result of these experiments uncovered severe security and privacy vulnerabilities impacting a variety of applications ranging from superyachts to wind turbines. The talk also considers the underlying technical and business drivers of these issues and promising approaches for their remediation. While it touches on some technical aspects, no background in wireless communications, cryptography, or satellite networking is required to understand the presentation.

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

Many modern processors expose privileged software interfaces to dynamically modify the frequency and voltage. These interfaces were introduced to cope with the ever-growing power consumption of modern computers. In this talk we show how these privileged interfaces can be exploited to undermine the system’s security. We present the Plundervolt attack – demonstrating how we can corrupt the integrity of Intel SGX computations.

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While this enabled us to train large-scale neural networks in datacenters and deploy them on edge devices, the focus so far is on average-case performance. In this work, we introduce a novel threat vector against neural networks whose energy consumption or decision latency are critical. We show how adversaries can exploit carefully crafted , which are inputs designed to maximise energy consumption and latency.

We mount two variants of this attack on established vision and language models, increasing energy consumption by a factor of 10 to 200. Our attacks can also be used to delay decisions where a network has critical real-time performance, such as in perception for autonomous vehicles. We demonstrate the portability of our malicious inputs across CPUs and a variety of hardware accelerator chips including GPUs, and an ASIC simulator. We conclude by proposing a defense strategy which mitigates our attack by shifting the analysis of energy consumption in hardware from an average-case to a worst-case perspective.

https://arxiv.org/abs/2006.03463

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

After a plethora of high-profile RowHammer attacks, CPU and
DRAM vendors scrambled to deliver what was meant to be the definitive
hardware solution against the RowHammer problem: Target Row Refresh
(TRR). A common belief among practitioners is that, for the latest
generation of DDR4 systems that are protected by TRR, RowHammer is no
longer an issue in practice. However, in reality, very little is known
about TRR. How does TRR exactly prevent RowHammer? Which parts of a
system are responsible for operating the TRR mechanism? Does TRR
completely solve the RowHammer problem or does it have weaknesses?

In this paper, we demystify the inner workings of TRR and debunk its
security guarantees. We show that what is advertised as a single
mitigation mechanism is actually a series of different solutions
coalesced under the umbrella term Target Row Refresh. We inspect and
disclose, via a deep analysis, different existing TRR solutions and
demonstrate that modern implementations operate entirely inside DRAM
chips. Despite the difficulties of analyzing in-DRAM mitigations, we
describe novel techniques for gaining insights into the operation of
these mitigation mechanisms. These insights allow us to build TRRespass,
a scalable black-box RowHammer fuzzer that we evaluate on 42 recent DDR4
modules.

TRRespass shows that even the latest generation DDR4 chips with in-DRAM
TRR, immune to all known RowHammer attacks, are often still vulnerable
to new TRR-aware variants of RowHammer that we develop. In particular,
TRRespass finds that, on present-day DDR4 modules, RowHammer is still
possible when many aggressor rows are used (as many as 19 in some
cases), with a method we generally refer to as Many-sided RowHammer.
Overall, our analysis shows that 13 out of the 42 modules from all three
major DRAM vendors (i.e., Samsung, Micron, and Hynix) are vulnerable to
our TRR-aware RowHammer access patterns, and thus one can still mount
existing state-of-the-art system-level RowHammer attacks. In addition to
DDR4, we also experiment with LPDDR4(X) chips and show that they are
susceptible to RowHammer bit flips too. Our results provide concrete
evidence that the pursuit of better RowHammer mitigations must continue.

Bio: Kaveh Razavi is an assistant professor in the Department of
Information Technology and Electrical Engineering at ETH Zurich where he
leads the COMSEC group. His research interests are in the area of
systems security and more broadly, computer systems. He regularly
publishes at top systems and security venues (e.g., S&P, USENIX
Security, SOSP/OSDI, etc.) and his research has won a prestigious VENI
personal grant as well as industry and academic awards including
multiple Pwnies and best papers.

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

We propose protocols to resolve the tension between anonymity and accountability in a peer-to-peer manner. Law enforcement can adopt this approach to solve crimes involving cryptocurrency and anonymization techniques. We illustrate how the protocols could apply to Monero rings and CoinJoin transactions in Bitcoin.

Paper draft on arxiv: https://arxiv.org/pdf/2005.03535.pdf

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

We analyse Stack Overflow (SO) to understand challenges and confusions developers face while dealing with privacy-related topics. We apply topic modelling techniques to 1,733 privacy-related questions to identify topics and then qualitatively analyse a random sample of 315 privacy-related questions. Identified topics include privacy policies, privacy concerns, access control, and version changes. Results show that developers do ask SO for support on privacy-related issues. We also find that platforms such as Apple and Google are defining privacy requirements for developers by specifying what “sensitive” in-formation is and what types of information developers need to communicate to users (e.g. privacy policies). We also examine the accepted answers in our sample and find that 28% of them link to official documentation and more than half are answered by SO users without references to any external resources.

https://groups.inf.ed.ac.uk/tulips/papers/tahaei2020SO.pdf

Earlier paper providing a survey of developer-centered security research:
https://groups.inf.ed.ac.uk/tulips/papers/A_Survey_on_Developer_Centred_Security.pdf

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

The use of data and algorithmic processes for decision-making is now a growing part of social life. Digitally monitoring, tracking, profiling and predicting human behaviour and social activities is what underpins the information order now frequently described as surveillance capitalism. Increasingly, it is also what helps determine decisions that are central to our ability to participate in society, such as welfare, education, crime, work, and if we can cross borders. How should we understand what is at stake with such developments? Often, we are dealt a simple binary that suggests that the issue is one of increased (state-)security and efficiency on the one hand and concerns with privacy and protection of personal data on the other. Recently, we have also seen a growing focus on questions of bias, discrimination and ‘fairness’ enter this debate. In this talk I will take stock of these concerns and present research that examines the implementation of data-driven systems in practice across pertinent sites of governance. I will make the case that we need to understand data systems as part of broader societal transformations, placing much greater emphasis on why these technologies are developed and implemented in the first place and how data practices relate to other social practices, rather than only focusing on the data system itself.

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

Technology connects people which can be both positive and sometimes negative. The problems arising from tech abuse more broadly and especially in the intimate partner violence setting are now becoming more apparent. Past investigations of these issues have largely been qualitative in nature and conducted by social scientists. Indeed, multiple studies have highlighted the harms caused by gendered tech abuse. However, we have little quantitative analysis of these issues. In this talk, I’ll highlight how our understanding of tech abuse in the intimate partner violence setting can be improved through the creation of data analysis pipelines, the challenges that arise in attempting to study these issues at scale, and some of the strategies that might mitigate these issues.

Related papers:

http://damonmccoy.com/papers/spyware.pdf

http://damonmccoy.com/papers/Creepware_SP.pdf

http://damonmccoy.com/papers/clinicalsec.pdf

Bio: Damon McCoy is an associate professor of Computer Science and Engineering at the New York University Tandon School of Engineering. He focuses on understanding the security and privacy issues at the intersection of society and technology. He received his Ph.D., MS, and BS in Computer Science from the University of Colorado, Boulder. McCoy is the recipient of an NSF CAREER award, former CRA/CCC Computer Innovation Fellow, IEEE Security and Privacy test of time and best practical paper awards, and an ACM MobiSys best paper award.

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

In this talk, I will report our recent work on decentralized e-auction. The paper has been published in IEEE TIFS and is publicly available at https://eprint.iacr.org/2019/1332. In this work, we show how to apply standard zero-knowledge proof primitives, combined with novel engineering techniques, to transform a simple Boolean-OR function to a complex MAX function. This results in decentralized e-auction protocols that are far better than any existing schemes in terms of computation and communication complexity. Our work shows, for the first time, that it is possible to securely and efficiently implement a Vickrey auction without involving any auctioneer, hence clearing a major obstacle of deploying Vickrey auctions in practice.

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

In this talk, we frame Trustable Hardware as a "Time of Check/Time of
Use" (TOCTOU) problem. The basic problem with receiving a package
containing "trusted hardware" is that the place of verification for
hardware is physically distant and administratively distinct from the
place of use. This is similar in nature to confirming the integrity of a
web object by checking its hash on the server, then downloading it and
running it.

The talk starts by exploring some of the potential attack vectors in the
supply chain, thus motivating the need for point-of-use verification. We
then use these constraints to formulate a system architecture that tries
to simplify the user verification problem, thus providing a method for
evidence-based trust in a given hardware artifact, as opposed to blind
faith in the supply chain.

Insecurity engineering in product design can result in significant and costly ramification, including monetary damages, and even the loss of life. Case examples, in product analysis and investigations that have been worked by the presenter, are documented as to what went wrong in design and implementation by lock and security hardware manufacturers. These cases demonstrate the problems in product design and the lack of understanding by mechanical and electronic engineers in the analysis of bypass techniques in their products that can be utilized to defeat them.

Marc Weber Tobias and his team consult with the largest lock manufacturers in the world and run a Security Lab at the University of Pittsburgh School of Engineering. They are tasked with the reverse engineering of locks, safe, and alarm systems for security vulnerabilities, especially involving covert entry techniques. Marc has been issued thirteen patents, has written seven books on security and law, and has lectured throughout the world to law enforcement and professional security organizations.

In the past ten years, there has been an explosion in the number of cryptocurrencies developed. This rise in cryptocurrencies has induced a rise in assorted fraud associated with the vast array of largely indistinguishable currencies. First I will examine the dynamics of coin creation, competition, and destruction in the cryptocurrency industry. I then investigate the growing trend of cryptocurrency pump and dump scams, a method of price manipulation. Finally, I analyze the role of cryptocurrency exchanges in perpetuating this sort of fraud.

Bio:

Marie Vasek is a Lecturer in Information Security at the UCL Department of Computer Science. Before joining UCL, she was an assistant professor in the computer science department at the University of New Mexico. She co-directs StopBadware, an anti-malware organization for which she started working in 2011. Her research focuses on cybercrime measurement, particularly web-based malware and abuse using cryptocurrencies. She received a PhD from the University of Tulsa, an MS from Southern Methodist University, and a BA from Wellesley College, all in computer science.

Recent advances in adversarial attacks have shown that machine learning classifiers based on static analysis are vulnerable to adversarial attacks. However, real-world antivirus systems do not rely only on static classifiers, thus many of these static evasions get detected by dynamic analysis whenever the malware runs. The real question is to what extent these adversarial attacks are actually harmful to the real users? In this paper, we propose a systematic framework to create and evaluate realistic adversarial malware to evade real-world systems. We propose new adversarial attacks against real-world antivirus systems based on code randomization and binary manipulation and use our framework to perform the attacks on 1000 malware samples and test 4 commercial antivirus software and 1 open-source classifier. We demonstrate that the static detectors of real-world antivirus can be evaded by changing only 1 byte in some malware samples and that many of the adversarial attacks are transferable between different antivirus. We also tested the efficacy of the complete (i.e. static + dynamic) classifiers in protecting users. While most of the commercial antivirus use their dynamic engines to protect the users’ device when the static classifiers are evaded, we are the first to demonstrate that for one commercial antivirus, static evasions can also evade the offline dynamic detectors and infect users’ machines. We discover a new attack surface for adversarial examples that can cause harm to real users.

Bio:

Sadia Afroz is a research scientist at the International Computer Science Institute (ICSI) and Avast Software. Her work focuses on anti-censorship, anonymity, and adversarial learning. Her work on adversarial authorship attribution received the 2013 Privacy Enhancing Technology (PET) award, the best student paper award at the 2012 Privacy Enhancing Technology Symposium (PETS), and the 2014 ACM SIGSAC dissertation award (runner-up). More about her research can be found: http://www1.icsi.berkeley.edu/~sadia/

Security policy-makers (influencers) in an organization set security policies that embody intended behaviours for employees (as decision-makers) to follow. Employees will have limited resources for identifying optimal security-related choices, and must consider options alongside other workplace pressures. Reconciling traditional economics and behavioural economics can identify misalignments - current approaches to security behaviour provisioning mirror rational-agent economics, even where behavioural economics is encapsulated in the promotion of security behaviours. We present a framework for ‘good enough’ decisions about security-related behaviours, to support the bounded security decision-making of employees. The capacity of the framework to identify sustainable security behaviours is also discussed, to consider policy concordance (negotiation of workable behaviours) and 'no blame' security cultures. The framework is also considered in the context of provisioning for employees in smaller businesses, and home user security.

The Decentralised Web (DW) has recently seen a renewed momentum, with a number of DW platforms like Mastodon and PeerTube gaining increasing traction. These offer alternatives to traditional 'centralised' social networks like Twitter and YouTube by enabling the operation of web infrastructure and services without centralised ownership or control. They do, however, raise a number of key challenges related to performance, security and resilience. In this seminar, I will present a measurement study of the DW, and discuss our empirical exploration of some of the key challenges in this area. The presentation is based on a ACM Internet Measurement Conference 2019.