Alex Halderman will present his preFPO on Thursday, May
17 at 10 A.M. in CS 302. The members of his committee are: Ed Felten,
advisor; Andrew Appel and Avi Rubin (Johns Hopkins), readers; Adam Finkelstein
and Brian Kernighan, non-readers. Everyone is invited to attend his talk.
The abstract follows below.
-------------
Learning
from Security Failures in Non-Traditional Computing
Environments
Decades of bitter experience with security
failures in desktop computers and network environments have led to intuitions
and engineering practices that help us build more robust systems. However,
as computers are becoming smaller and cheaper, they are taking on new forms that
challenge our intuitions. >From RFID tags embedded in sneakers and
passports, to "smart" cell phones and car navigation systems, many new
applications occupy environments that look little like those with which
researchers are familiar, and the old rules increasingly do not apply.
When security fails in such environments, it often fails spectacularly, with
layers of vulnerabilities that, compounded, are costly or impossible to
repair. By studying such security disasters, and asking why they are
especially severe, we hope to develop new security techniques suitable for a
world of ubiquitous computing.
One traditional security
intuition that is now being challenged is the distinction between data and
software. When received from a trusted source, data files are considered a
lower risk than software, since only software can contain security bugs that
weaken the computer's defenses. Recent events cause us to question the
value of this distinction. In a widely-publicized incident, the record
label Sony-BMG sold several million music CDs (normally considered a data-only
medium) that contained undisclosed software intended to thwart copying. We
studied this software using a variety of analytical techniques and discovered
that it contained serious defects that threatened consumers' security and
privacy. Merely playing the CDs caused the installation of dangerous
software that provided several routes for attackers to subvert the computer's
security mechanisms. These problems were exacerbated by the
non-traditional environment of a hybrid music and software CD, which allowed the
discs to avoid scrutiny by the ecosystem of security software vendors that
monitor for deviant behavior.
Other security intuitions are
being challenged in the realm of embedded computers. Once, such systems
were though of as "dumb" appliances, protected from most security risks by their
simple designs and lack of network connectivity, but as they have grown
increasingly sophisticated, they have come to resemble full-blown computers,
together with the attendant security problems. We found evidence of this
trend in the United States' most widely used electronic voting machine, the
Diebold AccuVote-TS. Using reverse-engineering and novel software analysis
methods, we discovered that the machine suffers from many of the same security
problems as desktop PCs, including the potential for attackers to install
malicious software and spread viruses from machine to machine. Because of
its embedded nature, the machine has none of the protections that are now
standard on desktop computers. As a result, an attacker could exploit
these problems to steal votes undetectably on a wide scale.
In many ways, our approach to these and other examples can be compared
to the systematic disaster investigations conducted after major transportation
accidents or structural failures. We seek to learn what went wrong not
only in each particular case but also in the broader context that allowed the
problems to occur. Our findings highlight the need to extend existing
protections to non-traditional environments, as well as to develop new security
techniques that are suitable to these applications. We propose specific
remedies in each case, such as cryptographic privacy protection protocols for
camera phones, and efficient machine-assisted auditing techniques for
voting. We also apply our theories to predict problems that may be
discovered in the future: for instance, Internet worms that spread by exploiting
weaknesses in the new generation of networked videogame consoles. Finally,
we consider legislative and regulatory remedies, including policy measures that
have already gained momentum in the wake of our findings concerning the Sony-BMG
and Diebold systems.