Department of Computer Science and Technology

Security Group

2020 seminars

Expand all Collapse all

If you can't find a talk you are looking for on this page, try the old archives.

View original pageView slides/notesRecording

02 June 14:00TRRespass: Exploiting the Many Sides of Target Row Refresh / Kaveh Razavi, ETH Zurich

Webinar

After a plethora of high-profile RowHammer attacks, CPU and
DRAM vendors scrambled to deliver what was meant to be the definitive
hardware solution against the RowHammer problem: Target Row Refresh
(TRR). A common belief among practitioners is that, for the latest
generation of DDR4 systems that are protected by TRR, RowHammer is no
longer an issue in practice. However, in reality, very little is known
about TRR. How does TRR exactly prevent RowHammer? Which parts of a
system are responsible for operating the TRR mechanism? Does TRR
completely solve the RowHammer problem or does it have weaknesses?

In this paper, we demystify the inner workings of TRR and debunk its
security guarantees. We show that what is advertised as a single
mitigation mechanism is actually a series of different solutions
coalesced under the umbrella term Target Row Refresh. We inspect and
disclose, via a deep analysis, different existing TRR solutions and
demonstrate that modern implementations operate entirely inside DRAM
chips. Despite the difficulties of analyzing in-DRAM mitigations, we
describe novel techniques for gaining insights into the operation of
these mitigation mechanisms. These insights allow us to build TRRespass,
a scalable black-box RowHammer fuzzer that we evaluate on 42 recent DDR4
modules.

TRRespass shows that even the latest generation DDR4 chips with in-DRAM
TRR, immune to all known RowHammer attacks, are often still vulnerable
to new TRR-aware variants of RowHammer that we develop. In particular,
TRRespass finds that, on present-day DDR4 modules, RowHammer is still
possible when many aggressor rows are used (as many as 19 in some
cases), with a method we generally refer to as Many-sided RowHammer.
Overall, our analysis shows that 13 out of the 42 modules from all three
major DRAM vendors (i.e., Samsung, Micron, and Hynix) are vulnerable to
our TRR-aware RowHammer access patterns, and thus one can still mount
existing state-of-the-art system-level RowHammer attacks. In addition to
DDR4, we also experiment with LPDDR4(X) chips and show that they are
susceptible to RowHammer bit flips too. Our results provide concrete
evidence that the pursuit of better RowHammer mitigations must continue.

Bio: Kaveh Razavi is an assistant professor in the Department of
Information Technology and Electrical Engineering at ETH Zurich where he
leads the COMSEC group. His research interests are in the area of
systems security and more broadly, computer systems. He regularly
publishes at top systems and security venues (e.g., S&P, USENIX
Security, SOSP/OSDI, etc.) and his research has won a prestigious VENI
personal grant as well as industry and academic awards including
multiple Pwnies and best papers.

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original pageView slides/notesRecording

26 May 14:00Collaborative Deanonymization / Rainer Böhme, University of Innsbruck

Webinar

We propose protocols to resolve the tension between anonymity and accountability in a peer-to-peer manner. Law enforcement can adopt this approach to solve crimes involving cryptocurrency and anonymization techniques. We illustrate how the protocols could apply to Monero rings and CoinJoin transactions in Bitcoin.

Paper draft on arxiv: https://arxiv.org/pdf/2005.03535.pdf

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original pageView slides/notesRecording

19 May 14:00Understanding Privacy-Related Questions on Stack Overflow / Kami Vaniea, University of Edinburgh

Webinar

We analyse Stack Overflow (SO) to understand challenges and confusions developers face while dealing with privacy-related topics. We apply topic modelling techniques to 1,733 privacy-related questions to identify topics and then qualitatively analyse a random sample of 315 privacy-related questions. Identified topics include privacy policies, privacy concerns, access control, and version changes. Results show that developers do ask SO for support on privacy-related issues. We also find that platforms such as Apple and Google are defining privacy requirements for developers by specifying what “sensitive” in-formation is and what types of information developers need to communicate to users (e.g. privacy policies). We also examine the accepted answers in our sample and find that 28% of them link to official documentation and more than half are answered by SO users without references to any external resources.

https://groups.inf.ed.ac.uk/tulips/papers/tahaei2020SO.pdf

Earlier paper providing a survey of developer-centered security research:
https://groups.inf.ed.ac.uk/tulips/papers/A_Survey_on_Developer_Centred_Security.pdf

RECORDING : Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY -NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original pageView slidesRecording

12 May 14:00The politics of data-driven governance / Lina Dencik, Data Justice Lab, Cardiff University

Webinar

The use of data and algorithmic processes for decision-making is now a growing part of social life. Digitally monitoring, tracking, profiling and predicting human behaviour and social activities is what underpins the information order now frequently described as surveillance capitalism. Increasingly, it is also what helps determine decisions that are central to our ability to participate in society, such as welfare, education, crime, work, and if we can cross borders. How should we understand what is at stake with such developments? Often, we are dealt a simple binary that suggests that the issue is one of increased (state-)security and efficiency on the one hand and concerns with privacy and protection of personal data on the other. Recently, we have also seen a growing focus on questions of bias, discrimination and ‘fairness’ enter this debate. In this talk I will take stock of these concerns and present research that examines the implementation of data-driven systems in practice across pertinent sites of governance. I will make the case that we need to understand data systems as part of broader societal transformations, placing much greater emphasis on why these technologies are developed and implemented in the first place and how data practices relate to other social practices, rather than only focusing on the data system itself.

RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original pageView slidesRecording

05 May 14:00Tech Abuse in the Intimate Partner Violence Setting: Issues, Challenges, and Mitigations / Damon McCoy, New York University

Webinar

Technology connects people which can be both positive and sometimes negative. The problems arising from tech abuse more broadly and especially in the intimate partner violence setting are now becoming more apparent. Past investigations of these issues have largely been qualitative in nature and conducted by social scientists. Indeed, multiple studies have highlighted the harms caused by gendered tech abuse. However, we have little quantitative analysis of these issues. In this talk, I’ll highlight how our understanding of tech abuse in the intimate partner violence setting can be improved through the creation of data analysis pipelines, the challenges that arise in attempting to study these issues at scale, and some of the strategies that might mitigate these issues.


Related papers:

http://damonmccoy.com/papers/spyware.pdf

http://damonmccoy.com/papers/Creepware_SP.pdf

http://damonmccoy.com/papers/clinicalsec.pdf


Bio: Damon McCoy is an associate professor of Computer Science and Engineering at the New York University Tandon School of Engineering. He focuses on understanding the security and privacy issues at the intersection of society and technology. He received his Ph.D., MS, and BS in Computer Science from the University of Colorado, Boulder. McCoy is the recipient of an NSF CAREER award, former CRA/CCC Computer Innovation Fellow, IEEE Security and Privacy test of time and best practical paper awards, and an ACM MobiSys best paper award.


RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original pageRecording

28 April 14:00SEAL: sealed-bid auction without auctioneers / Feng Hao, Department of Computer Science, University of Warwick

Webinar

In this talk, I will report our recent work on decentralized e-auction. The paper has been published in IEEE TIFS and is publicly available at https://eprint.iacr.org/2019/1332. In this work, we show how to apply standard zero-knowledge proof primitives, combined with novel engineering techniques, to transform a simple Boolean-OR function to a complex MAX function. This results in decentralized e-auction protocols that are far better than any existing schemes in terms of computation and communication complexity. Our work shows, for the first time, that it is possible to securely and efficiently implement a Vickrey auction without involving any auctioneer, hence clearing a major obstacle of deploying Vickrey auctions in practice.


RECORDING: Please note, this event will be recorded and will be available after the event for an indeterminate period under a CC BY-NC-ND license. Audience members should bear this in mind before joining the webinar or asking questions.

View original page

21 April 14:00Trustable Hardware as a TOCTOU Problem: Overview and Potential Remedies / Dr. Andrew 'bunnie' Huang, Independent Researcher

Webinar

In this talk, we frame Trustable Hardware as a "Time of Check/Time of
Use" (TOCTOU) problem. The basic problem with receiving a package
containing "trusted hardware" is that the place of verification for
hardware is physically distant and administratively distinct from the
place of use. This is similar in nature to confirming the integrity of a
web object by checking its hash on the server, then downloading it and
running it.

The talk starts by exploring some of the potential attack vectors in the
supply chain, thus motivating the need for point-of-use verification. We
then use these constraints to formulate a system architecture that tries
to simplify the user verification problem, thus providing a method for
evidence-based trust in a given hardware artifact, as opposed to blind
faith in the supply chain.

View original page

25 February 14:00Product Design, Liability, and Insecurity Engineering / Marc Weber Tobias, School of Engineering, University of Pittsburgh

LT2, Computer Laboratory, William Gates Building

Insecurity engineering in product design can result in significant and costly ramification, including monetary damages, and even the loss of life. Case examples, in product analysis and investigations that have been worked by the presenter, are documented as to what went wrong in design and implementation by lock and security hardware manufacturers. These cases demonstrate the problems in product design and the lack of understanding by mechanical and electronic engineers in the analysis of bypass techniques in their products that can be utilized to defeat them.

Marc Weber Tobias and his team consult with the largest lock manufacturers in the world and run a Security Lab at the University of Pittsburgh School of Engineering. They are tasked with the reverse engineering of locks, safe, and alarm systems for security vulnerabilities, especially involving covert entry techniques. Marc has been issued thirteen patents, has written seven books on security and law, and has lectured throughout the world to law enforcement and professional security organizations.

View original page

18 February 14:00Measuring Cryptocurrency Fraud / Marie Vasek, Department of Computer Science, UCL

LT2, Computer Laboratory, William Gates Building

In the past ten years, there has been an explosion in the number of cryptocurrencies developed. This rise in cryptocurrencies has induced a rise in assorted fraud associated with the vast array of largely indistinguishable currencies. First I will examine the dynamics of coin creation, competition, and destruction in the cryptocurrency industry. I then investigate the growing trend of cryptocurrency pump and dump scams, a method of price manipulation. Finally, I analyze the role of cryptocurrency exchanges in perpetuating this sort of fraud.

Bio:

Marie Vasek is a Lecturer in Information Security at the UCL Department of Computer Science. Before joining UCL, she was an assistant professor in the computer science department at the University of New Mexico. She co-directs StopBadware, an anti-malware organization for which she started working in 2011. Her research focuses on cybercrime measurement, particularly web-based malware and abuse using cryptocurrencies. She received a PhD from the University of Tulsa, an MS from Southern Methodist University, and a BA from Wellesley College, all in computer science.

View original page

17 February 13:00On the Effectiveness of Generating Adversarial Examples for Evading Blackbox Malware Classifiers / Dr Sadia Afroz, ICSI, UC Berkeley, Avast

LT2, Computer Laboratory, William Gates Building

Recent advances in adversarial attacks have shown that machine learning classifiers based on static analysis are vulnerable to adversarial attacks. However, real-world antivirus systems do not rely only on static classifiers, thus many of these static evasions get detected by dynamic analysis whenever the malware runs. The real question is to what extent these adversarial attacks are actually harmful to the real users? In this paper, we propose a systematic framework to create and evaluate realistic adversarial malware to evade real-world systems. We propose new adversarial attacks against real-world antivirus systems based on code randomization and binary manipulation and use our framework to perform the attacks on 1000 malware samples and test 4 commercial antivirus software and 1 open-source classifier. We demonstrate that the static detectors of real-world antivirus can be evaded by changing only 1 byte in some malware samples and that many of the adversarial attacks are transferable between different antivirus. We also tested the efficacy of the complete (i.e. static + dynamic) classifiers in protecting users. While most of the commercial antivirus use their dynamic engines to protect the users’ device when the static classifiers are evaded, we are the first to demonstrate that for one commercial antivirus, static evasions can also evade the offline dynamic detectors and infect users’ machines. We discover a new attack surface for adversarial examples that can cause harm to real users.

Bio:

Sadia Afroz is a research scientist at the International Computer Science Institute (ICSI) and Avast Software. Her work focuses on anti-censorship, anonymity, and adversarial learning. Her work on adversarial authorship attribution received the 2013 Privacy Enhancing Technology (PET) award, the best student paper award at the 2012 Privacy Enhancing Technology Symposium (PETS), and the 2014 ACM SIGSAC dissertation award (runner-up). More about her research can be found: http://www1.icsi.berkeley.edu/~sadia/

View original page

28 January 14:00Security economics to inform behaviour change support / Simon Parkin, Information Security Group, University College London

LT2, Computer Laboratory, William Gates Building

Security policy-makers (influencers) in an organization set security policies that embody intended behaviours for employees (as decision-makers) to follow. Employees will have limited resources for identifying optimal security-related choices, and must consider options alongside other workplace pressures. Reconciling traditional economics and behavioural economics can identify misalignments - current approaches to security behaviour provisioning mirror rational-agent economics, even where behavioural economics is encapsulated in the promotion of security behaviours. We present a framework for ‘good enough’ decisions about security-related behaviours, to support the bounded security decision-making of employees. The capacity of the framework to identify sustainable security behaviours is also discussed, to consider policy concordance (negotiation of workable behaviours) and 'no blame' security cultures. The framework is also considered in the context of provisioning for employees in smaller businesses, and home user security.

View original page

21 January 14:00It's Damn Hard to Decentralise the Web / Gareth Tyson, School of Electronic Engineering and Computer Science, Queen Mary University of London

LT2, Computer Laboratory, William Gates Building

The Decentralised Web (DW) has recently seen a renewed momentum, with a number of DW platforms like Mastodon and PeerTube gaining increasing traction. These offer alternatives to traditional 'centralised' social networks like Twitter and YouTube by enabling the operation of web infrastructure and services without centralised ownership or control. They do, however, raise a number of key challenges related to performance, security and resilience. In this seminar, I will present a measurement study of the DW, and discuss our empirical exploration of some of the key challenges in this area. The presentation is based on a ACM Internet Measurement Conference 2019.