Schedule

Friday, February 23, 2018

Saturday, February 24, 2018

Speakers

Keynote Address: Ashish Kundu, ACM Distinguished Speaker

Ashish Kundu is a Master Inventor, and Research Scientist in  Security Research at the IBM T J Watson Research Center, Yorktown Heights, New York. He received Ph.D. in Computer Science from Purdue University in 2010 prior to joining IBM Research. His research interests are in Security, Privacy, Compliance and AI Ethics for cloud, blockchain, mobile/IoT and regulatory computing environments. He is leading the security and compliance research efforts for IBM Watson Health Cloud. The long-term vision of Dr. Kundu's research is: "How to weave security, privacy, compliance, and ethics requirements with the functionality." He is currently the Associate Editor for IEEE Transactions on Dependable and Secure Computing, and Guest Editor, IEEE Internet Computing Special Issue on Healthcare Informatics and Privacy. He is a IEEE Senior Member. Dr. Kundu has been a member of ACM for over decade; during this period, he has participated in several ACM conferences and acted as reviewer for many journals. Read more.

Energy Attacks on Mobile and IoT Devices

All mobile devices are energy-constrained. They use batteries that allow using the device for a limited amount of time. In general, energy attacks on mobile devices are denial of service (DoS) type of attacks. While previous studies have analyzed the energy attacks in servers, no existing work has analyzed the energy attacks on mobile devices. As such, in this paper, we present the first systematic study on how to exploit the energy attacks on smartphones.

In particular, we explore energy attacks from the following aspect: hardware components, software resources, and network communications through the design and implementation of concrete malicious apps, and malicious web pages. We quantitatively show how quickly we can drain the battery through each individual attack, as well as their combinations. Finally, we believe energy exploit will be a practical attack vector and mobile users should be aware of this type of attacks.

Christina Garmin

Christina Garman is an assistant professor in the Department of Computer Science at Purdue University.  She received the Bachelor of Science in Computer Science and Engineering and Bachelor of Arts in Mathematics from Bucknell University in 2011, a Masters of Engineering in Computer Science from Johns Hopkins University in 2013, and just completed her PhD in Computer Science from Johns Hopkins University in August 2017.  She then did a short postdoc at the University of Maryland before joining Purdue.  Her research interests focus largely on practical and applied cryptography. More specifically, her work has focused on the security of deployed cryptographic systems from all aspects, including the evaluation of real systems, improving the tools that we have to design and create them, and actually creating real, deployable systems. Some of her recent work has been on demonstrating flaws in Apple’s iMessage end to end encryption, cryptographic automation, decentralized anonymous e-cash, and decentralized anonymous credentials. She is also one of the co-founders of ZCash, a startup building a cryptocurrency based on Zerocash.  Her work has been publicized in The Washington Post, Wired, and The Economist, and she received a 2016 ACM CCS Best Paper Award.

Securing Deployed Cryptographic Systems

Cryptography is the study of how to keep secrets.  It protects your passwords, your email, and in general protects your privacy and keeps your data safe.  In 2016 more than 2 billion records and $450 billion were lost due to publicly-reported criminal and nation-state cyberattacks across the globe, and over 100 million medical records were stolen in the United States alone.  The failure of our existing security infrastructure motivates the need for improved technologies, and cryptography provides a powerful tool for doing this.  Over the past several years though, we have seen a number of serious vulnerabilities in the cryptographic pieces of systems, some with large consequences.  My work focuses on applied cryptography and numerous aspects of building secure software and systems.  In this talk I will discuss examples of two of these aspects: (1) analyzing the security of Apple's iMessage and demonstrating exploits for vulnerabilities that we discovered and (2) building Zerocoin and Zerocash, systems that allow for fully anonymous currency transactions.

Zakir Durumeric

Zakir Durumeric (B.S. University of Iowa 2011, PhD University of Michigan 2017) is an Assistant Professor of Computer Science at Stanford, and Chief Technology Officer of Censys. His research focuses on empirical systems and network security, particularly how large-scale data analysis can uncover security weaknesses. He is well known for his work on Internet-wide scanning and was named to MIT Tech Review's 35 Under 35 in 2015 for creating the ZMap network scanner and Censys search engine. His work has received numerous distinctions including the IRTF Applied Network Research Prize and Best Paper Awards from USENIX Security, ACM CCS, and ACM IMC. Read more.

Demystifying the Mirai Botnet

The Mirai botnet, composed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed high-profile targets with the largest distributed denial-of-service (DDoS) attacks on public record. In this talk, I will describe what actually happened, based on a joint retrospective analysis between academic researchers, the companies that came under attack, independent journalists, and the law enforcement community. I'll cover how the botnet emerged, what classes of devices were affected, who the botnet attacked, and how variants evolved and competed for vulnerable hosts. Finally, I'll discuss Mirai's larger implications for Internet and IoT security going forward.

Lars Daniel

EnCE, ACE, AME, CTNS, CIPTS, CWA, CTA; Practice Leader: Digital Forensics; Envista Forensics

Lars Daniel an EnCase Certified Examiner (EnCE), an AccessData Certified Examiner (ACE), an AccessData Certified Mobile Examiner (AME) a Certified Telecommunications Network Specialist (CTNS), Certified Wireless Analyst (CWA), a Certified Internet Protocol Telecommunications Specialist (CIPTS), and a Certified Telecommunications Analyst (CTA). He is the co-author of the book Digital Forensics for Legal Professionals: Understanding Digital Evidence from the Warrant to the Courtroom, published by Syngess, an imprint of Elsevier Publishing. He is also co-author of the book Digital Forensics Trial Graphics: Educating the Jury Through Effective Use of Visuals", Published by Academic Press, 2017. He spoke at the largest annual digital forensics conference, the Computer Enterprise and Investigations Conference (CEIC), in 2011 and 2013, and 2016.

Lars has qualified as an expert witness and testified in both state and federal court thirty times, qualifying as a digital forensics expert, computer forensics expert, cell phone forensics expert, video forensics expert, and a photo forensics expert.  He has testified for both the defense and prosecution. Lars has attended over 300 hours of forensic training and has worked on over 700 cases involving murder, sexual exploitation, terrorism, rape, kidnapping, intellectual property, fraud, wrongful death, employee wrongdoing and insurance losses among numerous other types of cases. He provides dozens of Continuing Legal Education (CLE) and Continuing Education (CE) training classes for attorneys and claims professionals across the United States every year.

Cell Phone Forensics

With billions of cell phones in the world and millions of phone applications, the amount of evidence created by cell phones can be daunting. This program will explain the common types of evidence that can be recovered from cell phones, including deleted data. Some evidence types that will be discussed include location information, text messages, multimedia, voice mails, cloud backups, and more. Real life case examples will be used to illustrate how evidence recovered from cell phones can be used in cases and investigations. The proper methods to forensically acquire cell phone evidence will be covered as well as how evidence can be challenged in court.

Dr. Omar Haider Chowdhury

Dr. Omar Haider Chowdhury is an Assistant Professor of Computer Science at the University of Iowa. Dr. Chowdhury's research focus is on leveraging formal machinery and techniques to solve practically-relevant security and privacy problems of emerging systems. Dr. Chowdhury currently co-directs the Computational Logic Center (CLC) and is also an active member of the Informatics Initiative (UI3). Before joining the University of Iowa, he was a post-doctoral researcher at Carnegie Mellon University and Purdue University. He received his Ph.D. in Computer Science from the University of Texas at San Antonio. Read more.

Retrospectively Adding Security is Hard!

Many long-lived network protocols were not designed with an adversarial environment in mind;  robustness in an adversarial environment is often an afterthought. Developing security and privacy protection mechanisms that hope to see substantial deployment is often very challenging as these mechanisms are required to maintain compatibility with existing implementations, minimize deployment cost and performance overhead, while being incentive compatible. Such design restrictions induce protection mechanisms that are often ineffective in many corner cases or require a major infrastructural overhaul that risks widespread adoption. In this talk, I will use two network protocols (DNS and LTE cellular telecommunication protocol) and their vulnerabilities as examples to demonstrate that retrospective security and privacy protection mechanisms can only hope to achieve deterrence instead of complete mitigation. 

[Check out UICC in previous years]