Savage is a professor at UC San Diego’s Department of Computer Science and Engineering and an affiliated faculty member at the School. His research interests are diverse, ranging from the economics of e-crime, to automotive and aviation systems to routing protocols and data center virtualization and back again.
He currently serves as director of UC San Diego's Center for Network Systems (CNS) and as co-director for the Cooperative Center for Internet Epidemiology and Defenses (CCIED), a joint effort between UC San Diego and the International Computer Science Institute.
Areas of Expertise (4)
University of Washington: Ph.D.
- UC San Diego's Center for Network Systems (CNS)
- Cooperative Center for Internet Epidemiology and Defenses (CCIED)
- ACM CCS Steering Committee, 2015-present
- USENIX Enigma Steering Committee, 2016-present
Media Appearances (5)
Hackable software in the driver’s seat
Car manufacturers are doing more than they used to, but still not enough, says Stefan Savage, a 2017 MacArthur Foundation “Genius” grant recipient and a professor at University of California at San Diego who specializes in car hacking. That could put drivers and pedestrians at risk of injury or even death, he says. And in the meantime, it impacts drivers’ privacy...
Stefan Savage receives prestigious MacArthur Foundation fellowship
University of California
Stefan Savage, a renowned cybersecurity expert and professor of computer science at the University of California. San Diego, has been awarded a fellowship by the MacArthur Foundation. Perhaps better known as the MacArthur “genius” award, the prestigious no-strings attached five-year fellowship awards a total of $625,000 to each recipient...
For fighting cybercrime and boosting internet security, UCSD's Stefan Savage wins a MacArthur award
“Instead of just saying those are emails to block, or attacks to defend against, we spend a lot of time looking at a problem from the attacker’s standpoint,” he said.
That includes asking questions such as: How is an adversary making money? What does their supply chain look like? What can be done to make an economically motivated attack unprofitable?
“If you don’t actually understand the back end of the criminal process, then you don’t really know if whatever intervention you are using is actually the most cost-effective place to get in there and do something,” he said.
The MacArthur Foundation praised Savage for his “deep insights into internet security” and his “commitment to tackling problems of immediate, real-world importance.”...
In Planning Digital Defenses, the Biggest Obstacle Is Human Ingenuity
New York Times print
Security is at its heart a human issue. It is about conflict, and computers are merely a medium by which conflict can be expressed. The future of computer security, then, is less about the future of technology than it is about the future of human relations.
Cars’ Computer Systems Called at Risk to Hackers
New York Times print
Automobiles, which will be increasingly connected to the Internet in the near future, could be vulnerable to hackers just as computers are now, two teams of computer scientists are warning in a paper to be presented next week.
The scientists say that they were able to remotely control braking and other functions, and that the car industry was running the risk of repeating the security mistakes of the PC industry.
“We demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on,” they wrote in the report, “Experimental Security Analysis of a Modern Automobile.”
In the paper, which will be presented at a computer security conference next week in Oakland, Calif., computer security specialists at the University of Washington and the University of California, San Diego, report that while modern cars have extensive safety engineering in the design of their computer control systems, little thought has been given to the potential threat of hackers who may want to take over the networks that increasingly control modern cars.
Research Focus (1)
Stefan Savage research interests
Stefan Savage is part of the Systems & Networking and Security research groups in the Department of Computer Science and Engineering at UC San Diego. His research interests are diverse, ranging from the economics of e-crime, to automotive and aviation systems to routing protocols and data center virtualization and back again.
Detecting network misuse
Thomas Anderson, David Wetherall and Stefan Savage
Detecting public network attacks using signatures and fast content analysis
Sumeet Singh, George Varghese, Cristian Estan and Stefan Savage
Independent detection and filtering of undesirable packets
David Wetherall, Stefan Savage and Thomas Anderson
Detecting public network attacks using signatures and fast content analysis
Sumeet Singh, George Varghese, Cristian Estan and Stefan Savage
Distributed service level management for network traffic
David Wetherall, Stefan Savage and Thomas Anderson
Research Grants (3)
II-New: A Dual-Purpose Data Analytics Laboratory
PI Alex Snoeren, co-PIs Kirill Levchenko, George Porter and Geoff Voelker
Foundations of Security Cyber-Physical Systems of Systems
PI Kirill Levchenko, co-PIs Ranjit Jhala and Alex Snoeren
Large-scale Characterization of DNS Abuse
co-PI’s Geoff Voelker and Kirill Levchenko
This paper proposes a systems-oriented design for supporting court-ordered data access to locked" devices with system-encrypted storage, while explicitly resisting large-scale surveillance use. We describe a design that focuses entirely on passcode self-escrow (i.e., storing a copy of the user passcode into a write-only component on the device) and thus does not require any changes to underlying cryptographic algorithms. Further, by predicating any lawful access on extended-duration physical seizure, we foreclose mass-surveillance use cases while still supporting reasonable investigatory interests. Moreover, by couching per-device authorization protocols with the device manufacturer, this design avoids creating new trusted authorities or organizations while providing particularity (i.e., no "master keys" exist). Finally, by providing a concrete description of one such approach, we hope to encourage further technical consideration of the possibilities and limitations of trade-offs in this design space.
Joe DeBlasio, Stefan Savage, Geoffrey M Voelker, Alex C Snoeren
Password reuse has been long understood as a problem: credentials stolen from one site may be leveraged to gain access to another site for which they share a password. Indeed, it is broadly understood that attackers exploit this fact and routinely leverage credentials extracted from a site they have breached to access high-value accounts at other sites (e.g., email accounts). However, as a consequence of such acts, this same phenomena of password reuse attacks can be harnessed to indirectly infer site compromises---even those that would otherwise be unknown. In this paper we describe such a measurement technique, in which unique honey accounts are registered with individual third-party websites, and thus access to an email account provides indirect evidence of credentials theft at the corresponding website. We describe a prototype system, called Tripwire, that implements this technique using an automated Web account registration system combined with email account access data from a major email provider. In a pilot study monitoring more than 2,300 sites over a year, we have detected 19 site compromises, including what appears to be a plaintext password compromise at an Alexa top-500 site with more than 45 million active users.
Moritz Contag Guo Li Andre Pawlowski Felix Domke Kirill Levchenko Thorsten Holz Stefan Savage
Modern vehicles are required to comply with a range of environmental regulations limiting the level of emissions for various greenhouse gases, toxins and particulate matter. To ensure compliance, regulators test vehicles in controlled settings and empirically measure their emissions at the tailpipe. However, the black box nature of this testing and the standardization of its forms have created an opportunity for evasion. Using modern electronic engine controllers, manufacturers can programmatically infer when a car is undergoing an emission test and alter the behavior of the vehicle to comply with emission standards, while exceeding them during normal driving in favor of improved performance. While the use of such a defeat device by Volkswagen has brought the issue of emissions cheating to the public's attention, there have been few details about the precise nature of the defeat device, how it came to be, and its effect on vehicle behavior. In this paper, we present our analysis of two families of software defeat devices for diesel engines: one used by the Volkswagen Group to pass emissions tests in the US and Europe, and a second that we have found in Fiat Chrysler Automobiles. To carry out this analysis, we developed new static analysis firmware forensics techniques necessary to automatically identify known defeat devices and confirm their function. We tested about 900 firmware images and were able to detect a potential defeat device in more than 400 firmware images spanning eight years. We describe the precise conditions used by the firmware to detect a test cycle and how it affects engine behavior. This work frames the technical challenges faced by regulators going forward and highlights the important research agenda in providing focused software assurance in the presence of adversarial manufacturers.
Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, and Tadayoshi Kohno Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage
Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks. In this paper we experimentally evaluate these issues on a modern automobile and demonstrate the fragility of the underlying system structure. We demonstrate that an attacker who is able to infiltrate virtually any Electronic Control Unit (ECU) can leverage this ability to completely circumvent a broad array of safety-critical systems. Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input— including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car’s two internal subnets. We also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car’s telematics unit and that will completely erase any evidence of its presence after a crash. Looking forward, we discuss the complex challenges in addressing these vulnerabilities while considering the existing automotive ecosystem.
Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno
Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model— requiring prior physical access— has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them.
Kirill Levchenko∗ Andreas Pitsillidis∗ Neha Chachra∗ Brandon Enright∗ Mark F ´ elegyh ´ azi ´ ‡ Chris Grier† Tristan Halvorson∗ Chris Kanich∗ Christian Kreibich† He Liu∗ Damon McCoy∗ Nicholas Weaver† Vern Paxson† Geoffrey M. Voelker∗ Stefan Savage∗ ∗ Department of Computer Science and Engineering † Computer Science Division University of California, San Diego University of California, Berkeley International Computer Science Institute ‡ Laboratory of Cryptography and System Security (CrySyS) Berkeley, CA Budapest University of Technology and Economics
Spam-based advertising is a business. While it has engendered both widespread antipathy and a multi-billion dollar anti-spam industry, it continues to exist because it fuels a profitable enterprise. We lack, however, a solid understanding of this enterprise’s full structure, and thus most anti-spam interventions focus on only one facet of the overall spam value chain (e.g., spam filtering, URL blacklisting, site takedown). In this paper we present a holistic analysis that quantifies the full set of resources employed to monetize spam email— including naming, hosting, payment and fulfillment—using extensive measurements of three months of diverse spam data, broad crawling of naming and hosting infrastructures, and over 100 purchases from spam-advertised sites. We relate these resources to the organizations who administer them and then use this data to characterize the relative prospects for defensive interventions at each link in the spam value chain. In particular, we provide the first strong evidence of payment bottlenecks in the spam value chain; 95% of spam-advertised pharmaceutical, replica and software products are monetized using merchant services from just a handful of banks.
D. McCoy, H. Dharmdasani, C. Kreibich, G. M. Voelker, and S. Savage
Large-scale abusive advertising is a profit-driven endeavor. Without consumers purchasing spam-advertised Viagra, search-advertised counterfeit software or malware-advertised fake anti-virus, these campaigns could not be economically justified. Thus, in addition to the numerous efforts focused on identifying and blocking individual abusive advertising mechanisms, a parallel research direction has emerged focused on undermining the associated means of monetization: payment networks. In this paper we explain the complex role of payment processing in monetizing the modern affiliate program ecosystem and characterize the dynamics of these banking relationships over two years within the counterfeit pharmaceutical and software sectors. By opportunistically combining our own active purchasing data with contemporary disruption efforts by brand-holders and payment card networks, we gather the first empirical dataset concerning this approach. We discuss how well such payment interventions work, how abusive merchants respond in kind and the role that the payments ecosystem is likely to play in the future.
Chris Kanich∗ Christian Kreibich† Kirill Levchenko∗ Brandon Enright∗ Geoffrey M. Voelker∗ Vern Paxson† Stefan Savage∗
The “conversion rate” of spam — the probability that an unsolicited e-mail will ultimately elicit a “sale” — underlies the entire spam value proposition. However, our understanding of this critical behavior is quite limited, and the literature lacks any quantitative study concerning its true value. In this paper we present a methodology for measuring the conversion rate of spam. Using a parasitic infiltration of an existing botnet’s infrastructure, we analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing on-line pharmaceuticals. For nearly a half billion spam e-mails we identify the number that are successfully delivered, the number that pass through popular anti-spam filters, the number that elicit user visits to the advertised sites, and the number of “sales” and “infections” produced.
Jason Franklin Carnegie Mellon University email@example.com Vern Paxson ICSI firstname.lastname@example.org Adrian Perrig Cylab/CMU email@example.com Stefan Savage UC San Diego firstname.lastname@example.org
This paper studies an active underground economy which specializes in the commoditization of activities such as credit card fraud, identity theft, spamming, phishing, online credential theft, and the sale of compromised hosts. Using a seven month trace of logs collected from an active underground market operating on public Internet chat networks, we measure how the shift from “hacking for fun” to “hacking for profit” has given birth to a societal substrate mature enough to steal wealth into the millions of dollars in less than one year.
Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M. Voelker and Stefan Savage University of California, San Diego
Reverse Turing tests, or CAPTCHAs, have become an ubiquitous defense used to protect open Web resources from being exploited at scale. An effective CAPTCHA resists existing mechanistic software solving, yet can be solved with high probability by a human being. In response, a robust solving ecosystem has emerged, reselling both automated solving technology and realtime human labor to bypass these protections. Thus, CAPTCHAs can increasingly be understood and evaluated in purely economic terms; the market price of a solution vs the monetizable value of the asset being protected. We examine the market-side of this question in depth, analyzing the behavior and dynamics of CAPTCHA-solving service providers, their price performance, and the underlying labor markets driving this economy.
Thomas Ristenpart∗ Eran Tromer† Hovav Shacham∗ Stefan Savage∗
Third-party cloud computing represents the promise of outsourcing as applied to computation. Services, such as Microsoft’s Azure and Amazon’s EC2, allow users to instantiate virtual machines (VMs) on demand and thus purchase precisely the capacity they require when they require it. In turn, the use of virtualization allows third-party cloud providers to maximize the utilization of their sunk capital costs by multiplexing many customer VMs across a shared physical infrastructure. However, in this paper, we show that this approach can also introduce new vulnerabilities. Using the Amazon EC2 service as a case study, we show that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target. We explore how such placement can then be used to mount cross-VM side-channel attacks to extract information from a target VM on the same machine.
David Moore Geoffrey M. Voelker and Stefan Savage
In this paper, we seek to answer a simple question: “How prevalent are denial-of-service attacks in the Internet today?”. Our motivation is to understand quantitatively the nature of the current threat as well as to enable longerterm analyses of trends and recurring patterns of attacks. We present a new technique, called “backscatter analysis”, that provides an estimate of worldwide denial-ofservice activity. We use this approach on three week-long datasets to assess the number, duration and focus of attacks, and to characterize their behavior. During this period, we observe more than 12,000 attacks against more than 5,000 distinct targets, ranging from well known ecommerce companies such as Amazon and Hotmail to small foreign ISPs and dial-up connections. We believe that our work is the only publically available data quantifying denial-of-service activity in the Internet.
Sarah Meiklejohn Marjori Pomarole Grant Jordan Kirill Levchenko Damon McCoy† Geoffrey M. Voelker Stefan Savage
Bitcoin is a purely online virtual currency, unbacked by either physical commodities or sovereign obligation; instead, it relies on a combination of cryptographic protection and a peer-to-peer protocol for witnessing settlements. Consequently, Bitcoin has the unintuitive property that while the ownership of money is implicitly anonymous, its flow is globally visible. In this paper we explore this unique characteristic further, using heuristic clustering to group Bitcoin wallets based on evidence of shared authority, and then using re-identification attacks (i.e., empirical purchasing of goods and services) to classify the operators of those clusters. From this analysis, we characterize longitudinal changes in the Bitcoin market, the stresses these changes are placing on the system, and the challenges for those seeking to use Bitcoin for criminal or fraudulent purposes at scale.