Hackable software in the driver’s seat

The Parallax  

2017-12-08

Car manufacturers are doing more than they used to, but still not enough, says Stefan Savage, a 2017 MacArthur Foundation “Genius” grant recipient and a professor at University of California at San Diego who specializes in car hacking. That could put drivers and pedestrians at risk of injury or even death, he says. And in the meantime, it impacts drivers’ privacy...

view more

Stefan Savage receives prestigious MacArthur Foundation fellowship

University of California  

2017-10-11

Stefan Savage, a renowned cybersecurity expert and professor of computer science at the University of California. San Diego, has been awarded a fellowship by the MacArthur Foundation. Perhaps better known as the MacArthur “genius” award, the prestigious no-strings attached five-year fellowship awards a total of $625,000 to each recipient...

view more

For fighting cybercrime and boosting internet security, UCSD's Stefan Savage wins a MacArthur award

L.A. Times  

2017-10-10

“Instead of just saying those are emails to block, or attacks to defend against, we spend a lot of time looking at a problem from the attacker’s standpoint,” he said. That includes asking questions such as: How is an adversary making money? What does their supply chain look like? What can be done to make an economically motivated attack unprofitable? “If you don’t actually understand the back end of the criminal process, then you don’t really know if whatever intervention you are using is actually the most cost-effective place to get in there and do something,” he said. The MacArthur Foundation praised Savage for his “deep insights into internet security” and his “commitment to tackling problems of immediate, real-world importance.”...

view more

In Planning Digital Defenses, the Biggest Obstacle Is Human Ingenuity

New York Times  print

2011-12-05

Security is at its heart a human issue. It is about conflict, and computers are merely a medium by which conflict can be expressed. The future of computer security, then, is less about the future of technology than it is about the future of human relations.

view more

Cars’ Computer Systems Called at Risk to Hackers

New York Times  print

2010-05-14

Automobiles, which will be increasingly connected to the Internet in the near future, could be vulnerable to hackers just as computers are now, two teams of computer scientists are warning in a paper to be presented next week. The scientists say that they were able to remotely control braking and other functions, and that the car industry was running the risk of repeating the security mistakes of the PC industry. “We demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on,” they wrote in the report, “Experimental Security Analysis of a Modern Automobile.” In the paper, which will be presented at a computer security conference next week in Oakland, Calif., computer security specialists at the University of Washington and the University of California, San Diego, report that while modern cars have extensive safety engineering in the design of their computer control systems, little thought has been given to the potential threat of hackers who may want to take over the networks that increasingly control modern cars.

view more

Stefan Savage research interests

Stefan Savage is part of the Systems & Networking and Security research groups in the Department of Computer Science and Engineering at UC San Diego. His research interests are diverse, ranging from the economics of e-crime, to automotive and aviation systems to routing protocols and data center virtualization and back again.

view more

Detecting network misuse

8,509.086

2013-08-13

Thomas Anderson, David Wetherall and Stefan Savage

Detecting public network attacks using signatures and fast content analysis

8,296,842

2012-10-23

Sumeet Singh, George Varghese, Cristian Estan and Stefan Savage

Independent detection and filtering of undesirable packets

8,271,678

2012-09-18

David Wetherall, Stefan Savage and Thomas Anderson

Detecting public network attacks using signatures and fast content analysis

7996658

2011-06-21

Sumeet Singh, George Varghese, Cristian Estan and Stefan Savage

Distributed service level management for network traffic

7475141

2009-01-06

David Wetherall, Stefan Savage and Thomas Anderson

II-New: A Dual-Purpose Data Analytics Laboratory

NSF $548,000

PI Alex Snoeren, co-PIs Kirill Levchenko, George Porter and Geoff Voelker

Foundations of Security Cyber-Physical Systems of Systems

NSF $560,000

PI Kirill Levchenko, co-PIs Ranjit Jhala and Alex Snoeren

Large-scale Characterization of DNS Abuse

NSF $1.2M

co-PI’s Geoff Voelker and Kirill Levchenko

Lawful Device Access without Mass Surveillance Risk: A Technical Design Discussion

Stefan Savage

2018 This paper proposes a systems-oriented design for supporting court-ordered data access to locked" devices with system-encrypted storage, while explicitly resisting large-scale surveillance use. We describe a design that focuses entirely on passcode self-escrow (i.e., storing a copy of the user passcode into a write-only component on the device) and thus does not require any changes to underlying cryptographic algorithms. Further, by predicating any lawful access on extended-duration physical seizure, we foreclose mass-surveillance use cases while still supporting reasonable investigatory interests. Moreover, by couching per-device authorization protocols with the device manufacturer, this design avoids creating new trusted authorities or organizations while providing particularity (i.e., no "master keys" exist). Finally, by providing a concrete description of one such approach, we hope to encourage further technical consideration of the possibilities and limitations of trade-offs in this design space.

view more

Tripwire: Inferring internet site compromise

Joe DeBlasio, Stefan Savage, Geoffrey M Voelker, Alex C Snoeren

2017 Password reuse has been long understood as a problem: credentials stolen from one site may be leveraged to gain access to another site for which they share a password. Indeed, it is broadly understood that attackers exploit this fact and routinely leverage credentials extracted from a site they have breached to access high-value accounts at other sites (e.g., email accounts). However, as a consequence of such acts, this same phenomena of password reuse attacks can be harnessed to indirectly infer site compromises---even those that would otherwise be unknown. In this paper we describe such a measurement technique, in which unique honey accounts are registered with individual third-party websites, and thus access to an email account provides indirect evidence of credentials theft at the corresponding website. We describe a prototype system, called Tripwire, that implements this technique using an automated Web account registration system combined with email account access data from a major email provider. In a pilot study monitoring more than 2,300 sites over a year, we have detected 19 site compromises, including what appears to be a plaintext password compromise at an Alexa top-500 site with more than 45 million active users.

view more

How They Did It: An Analysis of Emission Defeat Devices in Modern Automobiles

Moritz Contag Guo Li Andre Pawlowski Felix Domke Kirill Levchenko Thorsten Holz Stefan Savage

Modern vehicles are required to comply with a range of environmental regulations limiting the level of emissions for various greenhouse gases, toxins and particulate matter. To ensure compliance, regulators test vehicles in controlled settings and empirically measure their emissions at the tailpipe. However, the black box nature of this testing and the standardization of its forms have created an opportunity for evasion. Using modern electronic engine controllers, manufacturers can programmatically infer when a car is undergoing an emission test and alter the behavior of the vehicle to comply with emission standards, while exceeding them during normal driving in favor of improved performance. While the use of such a defeat device by Volkswagen has brought the issue of emissions cheating to the public's attention, there have been few details about the precise nature of the defeat device, how it came to be, and its effect on vehicle behavior. In this paper, we present our analysis of two families of software defeat devices for diesel engines: one used by the Volkswagen Group to pass emissions tests in the US and Europe, and a second that we have found in Fiat Chrysler Automobiles. To carry out this analysis, we developed new static analysis firmware forensics techniques necessary to automatically identify known defeat devices and confirm their function. We tested about 900 firmware images and were able to detect a potential defeat device in more than 400 firmware images spanning eight years. We describe the precise conditions used by the firmware to detect a test cycle and how it affects engine behavior. This work frames the technical challenges faced by regulators going forward and highlights the important research agenda in providing focused software assurance in the presence of adversarial manufacturers.

Experimental Security Analysis of a Modern Automobile

Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, and Tadayoshi Kohno Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks. In this paper we experimentally evaluate these issues on a modern automobile and demonstrate the fragility of the underlying system structure. We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input— including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car’s two internal subnets. We also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car’s telematics unit and that will completely erase any evidence of its presence after a crash. Looking forward, we discuss the complex challenges in addressing these vulnerabilities while considering the existing automotive ecosystem.

view more

Comprehensive experimental analyses of automotive attack surfaces

Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno

2011-08-08

Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model— requiring prior physical access— has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them.

view more

Click Trajectories End-to-End Analysis of the Spam Value Chain

Kirill Levchenko∗ Andreas Pitsillidis∗ Neha Chachra∗ Brandon Enright∗ Mark F ´ elegyh ´ azi ´ ‡ Chris Grier† Tristan Halvorson∗ Chris Kanich∗ Christian Kreibich† He Liu∗ Damon McCoy∗ Nicholas Weaver† Vern Paxson† Geoffrey M. Voelker∗ Stefan Savage∗ ∗ Department of Computer Science and Engineering † Computer Science Division University of California, San Diego University of California, Berkeley  International Computer Science Institute ‡ Laboratory of Cryptography and System Security (CrySyS) Berkeley, CA Budapest University of Technology and Economics

Spam-based advertising is a business. While it has engendered both widespread antipathy and a multi-billion dollar anti-spam industry, it continues to exist because it fuels a profitable enterprise. We lack, however, a solid understanding of this enterprise’s full structure, and thus most anti-spam interventions focus on only one facet of the overall spam value chain (e.g., spam filtering, URL blacklisting, site takedown). In this paper we present a holistic analysis that quantifies the full set of resources employed to monetize spam email— including naming, hosting, payment and fulfillment—using extensive measurements of three months of diverse spam data, broad crawling of naming and hosting infrastructures, and over 100 purchases from spam-advertised sites. We relate these resources to the organizations who administer them and then use this data to characterize the relative prospects for defensive interventions at each link in the spam value chain. In particular, we provide the first strong evidence of payment bottlenecks in the spam value chain; 95% of spam-advertised pharmaceutical, replica and software products are monetized using merchant services from just a handful of banks.

view more

Priceless: The Role of Payments in Abuse-Advertised Goods

D. McCoy, H. Dharmdasani, C. Kreibich, G. M. Voelker, and S. Savage

2012-01-01

Large-scale abusive advertising is a profit-driven endeavor. Without consumers purchasing spam-advertised Viagra, search-advertised counterfeit software or malware-advertised fake anti-virus, these campaigns could not be economically justified. Thus, in addition to the numerous efforts focused on identifying and blocking individual abusive advertising mechanisms, a parallel research direction has emerged focused on undermining the associated means of monetization: payment networks. In this paper we explain the complex role of payment processing in monetizing the modern affiliate program ecosystem and characterize the dynamics of these banking relationships over two years within the counterfeit pharmaceutical and software sectors. By opportunistically combining our own active purchasing data with contemporary disruption efforts by brand-holders and payment card networks, we gather the first empirical dataset concerning this approach. We discuss how well such payment interventions work, how abusive merchants respond in kind and the role that the payments ecosystem is likely to play in the future.

view more

Spamalytics: An Empirical Analysis of Spam Marketing Conversion

Chris Kanich∗ Christian Kreibich† Kirill Levchenko∗ Brandon Enright∗ Geoffrey M. Voelker∗ Vern Paxson† Stefan Savage∗

2008-01-01

The “conversion rate” of spam — the probability that an unsolicited e-mail will ultimately elicit a “sale” — underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet’s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing on-line pharmaceuticals. For nearly a half billion spam e-mails we identify the number that are successfully delivered, the number that pass through popular anti-spam filters, the number that elicit user visits to the advertised sites, and the number of “sales” and “infections” produced.

view more

An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants∗

Jason Franklin Carnegie Mellon University jfrankli@cs.cmu.edu Vern Paxson ICSI vern@icsi.berkeley.edu Adrian Perrig Cylab/CMU perrig@cmu.edu Stefan Savage UC San Diego savage@cs.ucsd.edu

2007-11-02

This paper studies an active underground economy which specializes in the commoditization of activities such as credit card fraud, identity theft, spamming, phishing, online credential theft, and the sale of compromised hosts. Using a seven month trace of logs collected from an active underground market operating on public Internet chat networks, we measure how the shift from “hacking for fun” to “hacking for profit” has given birth to a societal substrate mature enough to steal wealth into the millions of dollars in less than one year.

view more

Re: CAPTCHAs – Understanding CAPTCHA-Solving Services in an Economic Context

Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M. Voelker and Stefan Savage University of California, San Diego

2009-01-01

Reverse Turing tests, or CAPTCHAs, have become an ubiquitous defense used to protect open Web resources from being exploited at scale. An effective CAPTCHA resists existing mechanistic software solving, yet can be solved with high probability by a human being. In response, a robust solving ecosystem has emerged, reselling both automated solving technology and realtime human labor to bypass these protections. Thus, CAPTCHAs can increasingly be understood and evaluated in purely economic terms; the market price of a solution vs the monetizable value of the asset being protected. We examine the market-side of this question in depth, analyzing the behavior and dynamics of CAPTCHA-solving service providers, their price performance, and the underlying labor markets driving this economy.

view more

Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds

Thomas Ristenpart∗ Eran Tromer† Hovav Shacham∗ Stefan Savage∗

2009-11-09

Third-party cloud computing represents the promise of outsourcing as applied to computation. Services, such as Microsoft’s Azure and Amazon’s EC2, allow users to instantiate virtual machines (VMs) on demand and thus purchase precisely the capacity they require when they require it. In turn, the use of virtualization allows third-party cloud providers to maximize the utilization of their sunk capital costs by multiplexing many customer VMs across a shared physical infrastructure. However, in this paper, we show that this approach can also introduce new vulnerabilities. Using the Amazon EC2 service as a case study, we show that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target. We explore how such placement can then be used to mount cross-VM side-channel attacks to extract information from a target VM on the same machine.

view more

Inferring Internet Denial-of-Service Activity

David Moore Geoffrey M. Voelker and Stefan Savage

2006-01-01

In this paper, we seek to answer a simple question: “How prevalent are denial-of-service attacks in the Internet today?”. Our motivation is to understand quantitatively the nature of the current threat as well as to enable longerterm analyses of trends and recurring patterns of attacks. We present a new technique, called “backscatter analysis”, that provides an estimate of worldwide denial-ofservice activity. We use this approach on three week-long datasets to assess the number, duration and focus of attacks, and to characterize their behavior. During this period, we observe more than 12,000 attacks against more than 5,000 distinct targets, ranging from well known ecommerce companies such as Amazon and Hotmail to small foreign ISPs and dial-up connections. We believe that our work is the only publically available data quantifying denial-of-service activity in the Internet.

view more

A Fistful of Bitcoins: Characterizing Payments Among Men with No Names

Sarah Meiklejohn Marjori Pomarole Grant Jordan Kirill Levchenko Damon McCoy† Geoffrey M. Voelker Stefan Savage

2013-10-23

Bitcoin is a purely online virtual currency, unbacked by either physical commodities or sovereign obligation; instead, it relies on a combination of cryptographic protection and a peer-to-peer protocol for witnessing settlements. Consequently, Bitcoin has the unintuitive property that while the ownership of money is implicitly anonymous, its flow is globally visible. In this paper we explore this unique characteristic further, using heuristic clustering to group Bitcoin wallets based on evidence of shared authority, and then using re-identification attacks (i.e., empirical purchasing of goods and services) to classify the operators of those clusters. From this analysis, we characterize longitudinal changes in the Bitcoin market, the stresses these changes are placing on the system, and the challenges for those seeking to use Bitcoin for criminal or fraudulent purposes at scale.

view more