Back to Events

Seminar Series

December 06

Building Secure Systems from Memory Enclaves

Sergey Gorbunov
University of Waterloo

Part Of

4:00P
- 5:00P

Location

32-D463 (Star)
Add to Calendar 2017-12-06 16:00:00 2017-12-06 17:00:00 America/New_York Building Secure Systems from Memory Enclaves Title: "Building Secure Systems from Memory Enclaves" Abstract: Cloud computing has revolutionized modern IT environments, but also created a number of security challenges. For instance, a malicious infrastructure provider or a tenant can potentially see other tenants data in a public cloud. Encrypted memory enclaves (Intel SGX) is an emerging architecture for building secure systems that can be used to protect data and programs from malicious co-tenants, operators, and even hypervisors. However, enclaves have a number of architectural limitations that make building secure systems challenging. For example, they have a small physical memory size, introduce large performance overheads, and remain vulnerable to side-channel attacks. In this talk, I will discuss how to build secure systems from memory enclaves, addressing some of their limitations. I will present ZeroTrace an oblivious memory controller that can be used to protect applications against side-channel attacks. I will also present StealthDB an encrypted database system from Intel SGX. StealthDB has a very small trusted computing base, scales to large datasets, and provides strong security guarantees at steady state and during query execution. StealthDB is the first database that supports both analytical and transactional queries and runs on top of an unmodified DBMS engine.bio: Sergey is an Assistant Professor at the University of Waterloo. His interests range from cryptography to design of secure large scale systems, computer networks, protocols and blockchains. In his research he studies how to build secure systems in untrusted, distributed infrastructures. He received PhD from MIT, where he was a Microsoft PhD fellow. His academic advisor was Vinod Vaikuntanathan. His dissertation was on designing cryptographic tools for the cloud using lattice-based cryptography for which he received Sprowls Doctoral Thesis Prize for best PhD thesis in CS at MIT. 32-D463 (Star)

November 29

A Universally Composable Treatment of Network Time.

Aanchal Malhotra
Boston University

Part Of

4:00P
- 5:00P

Location

D463 (Star)
Add to Calendar 2017-11-29 16:00:00 2017-11-29 17:00:00 America/New_York A Universally Composable Treatment of Network Time. Title: A Universally Composable Treatment of Network Time.Abstract:The security of almost any real-world distributed system today depends on the participants having some "reasonably accurate'' sense of current real time. Indeed, to name one example, the very authenticity of practically any communication on the Internet today hinges on the ability of the parties to accurately detect revocation of certificates, or expiration of passwords or shared keys. However, as recent attacks show, the standard protocols for determining time are subvertible, resulting in wide-spread security loss. Worse yet, we do not have security notions for network time protocols that (a) can be rigorously asserted and (b) rigorously guarantee security of applications that require a sense of real time. In this talk I will: - Describe new notions of security for time sync protocols within Universally Composable (UC) security framework - Show that these notions suffice for protocols that need real time and Prove security of protocols that realize these notions joint work with Ran Canetti, Kyle Hogan and Mayank Varia.Speaker Bio: Aanchal Malhotra is a Ph.D student at Boston University and is part of the BU Security Group. Her research uses cryptography, and the insights gained from network measurement and simulations to improve the security and reliability of core Internet protocols like BGP, DNS, and NTP. She received her M.S. from Boston University in 2014, and has worked as a researcher at Cisco, Akamai, and NLNet Labs, Netherlands. She is an active member of working groups at the Internet Engineering Task Force (IETF). D463 (Star)

October 25

Algorand: Scaling Byzantine Agreements for Cryptocurrencies

Yossi Gilad
MIT CSAIL, Boston University

Part Of

4:00P
- 5:00P

Location

G449 (Patil/Kiva)
Add to Calendar 2017-10-25 16:00:00 2017-10-25 17:00:00 America/New_York Algorand: Scaling Byzantine Agreements for Cryptocurrencies Algorand: Scaling Byzantine Agreements for CryptocurrenciesAbstractAlgorand is a new cryptocurrency that confirms transactionswith latency on the order of a minute while scaling to manyusers. Algorand ensures that users never have divergentviews of confirmed transactions, even if some of the usersare malicious and the network is temporarily partitioned.In contrast, existing cryptocurrencies allow for temporaryforks and therefore require a long time, on the order of anhour, to confirm transactions with high confidence.Algorand uses a new Byzantine Agreement (BA) protocolto reach consensus among users on the next set of transactions.To scale the consensus to many users, Algoranduses a novel mechanism based on Verifiable Random Functionsthat allows users to privately check whether they areselected to participate in the BA to agree on the next setof transactions, and to include a proof of their selection intheir network messages. In Algorand’s BA protocol, usersdo not keep any private state except for their private keys,which allows Algorand to replace participants immediatelyafter they send a message. This mitigates targeted attackson chosen participants after their identity is revealed.We implement Algorand and evaluate its performance on1,000 EC2 virtual machines, simulating up to 500,000 users.Experimental results show that Algorand confirms transactionsin under a minute, achieves 125× Bitcoin’s throughput,and incurs almost no penalty for scaling to more users.BioYossi Gilad is a postdoctoral researcher at MIT and Boston University. His research interests include designing, building, and analyzing secure and scalable networked systems.Prior to this position he was a postdoctoral researcher at the Hebrew University of Jerusalem, and a research staff member at IBM Research. He is a recipient of the IETF/IRTF Applied Networking Research Prize (2017), the IBM Research Inventor Recognition Award (2015), and the Check Point Institute Information Security Prize (2013-2014). G449 (Patil/Kiva)

October 18

Behavioral Intrusion Detection at Scale: Case Studies in Machine Learning

Joseph Zadeh
JASK

Part Of

4:00P
- 5:00P

Location

D407
Add to Calendar 2017-10-18 16:00:00 2017-10-18 17:00:00 America/New_York Behavioral Intrusion Detection at Scale: Case Studies in Machine Learning Behavioral Intrusion Detection at Scale: Case Studies in Machine Learning Intrusion detection at scale is one of the most challenging problems a modern enterprise will face while maintaining a global IT infrastructure. Building defensive systems that help automate some of the pain points, in this space, has been a goal since the early days of enterprise security. From an artificial intelligence standpoint, the problem of designing a model to predict adversarial behavior is part of a class of problems that is impossible to automate completely. At the core of the problem lies an underlying no-go principle: threat actors change tactics to evolve with the technological threat surface. This means that to build pattern recognition systems, for cyber defense, we have to design a solution that is capable of learning behaviors of the attackers and to programmatically evolve that learning over time. In our presentation we outline a solution to this problem called the “The Lambda Defense”. The Lambda Defense is a tool for modeling any problem in which one is trying to automate the detection of attacks, over a complex threat surface (particular in the context of big data). We will highlight how we have applied this pattern to two important security use cases: Exploit Detection and Webshell Mitigation. The first use case is important for current trends because we have seen the delivery of both ransomware and banking Trojans, targeting fortune 500 customers using exploit kits. This malicious behavior can be captured as a prediction problem very easily, with the framework of the Lambda Defense. The second use case we highlight is the detection of webshells. This is important for the finding more stealthily and advanced actors that engage in long term attack campaigns. We will describe the way we have approached the mitigation of these two types of attacks, along with sharing some related open source data sets, and code that are meant to be standalone examples: https://github.com/jzadehJoseph Zadeh is the Director of Data Science at JASK. Zadeh has an M.S. in Mathematics, Computational Finance and a PhD in Mathematics from Purdue University. Zadeh comes to JASK as one of the foremost experts on AI and security operations. Prior to JASK, he served as Senior Data Scientist at Splunk through the aquisition of Caspida, where he developed behavior-based analytics for intrusion detection. He applied his research background to artificial intelligence and cybersecurity, delivering presentations, such as Multi-Contextual Threat Detection via Machine Learning at Bsides Las Vegas, Defcon, Blackhat and RSA. Previously, Zadeh was part of the data science consulting team on Cyber Security analytics at Greenplum/Pivotal, as well as part of Kaiser Permanente’s first Cyber Security R&D team. D407

October 11

Software Security Today: Understanding Code-Reuse Attacks and Reducing Attack Surface

George Portokalidis
Stevens Institute of Technology

Part Of

4:00P
- 5:00P

Location

D407
Add to Calendar 2017-10-11 16:00:00 2017-10-11 17:00:00 America/New_York Software Security Today: Understanding Code-Reuse Attacks and Reducing Attack Surface Title: Software Security Today: Understanding Code-Reuse Attacks andReducing Attack SurfaceAbstract:Our society is increasingly reliant on software, so software security isof critical importance today more than ever. Through the years,defenses, such as address space layout randomization (ASLR),data-execution prevention (DEP), and stack and heap protections havesignificantly raised the bar for attackers, making software exploitationhard. However, attacks have also evolved to a new level ofsophistication. Modern attacks combine multiple vulnerabilities tolaunch code-reuse attacks that “re-purpose” existing code to executearbitrary computations. Working exploits are extremely valuable, forexample, companies like Zerodium offer $1.5M for zero-day exploitsagainst iOS. Modern attacks have reignited the interest in variousinstantiations of control-flow integrity (CFI), diversification, andisolation-based defenses. In this talk, I will present our work onevaluating the effectiveness of such defenses, based on analyzing themand producing proof-of-concept (PoC) attacks that expose theirweaknesses. I will first focus on CFI to show that it is vulnerable,specially in its more practical iterations. I will then move toapproaches that employ information hiding to emulate isolationtechniques, and finish by looking at randomization techniques. I willconclude my talk by presenting new directions in hardening software andreducing attack surface.Short bio:Georgios Portokalidis is an Assistant Professor in the Department ofComputer Science at Stevens Institute of Technology. He obtained hisdoctorate degree in Computer Science from Vrije Universiteit inAmsterdam. His research interests are mainly around the area of systemsand security. Some of the subjects he is actively working on include thedetection and prevention of state-of-the-art attacks against softwaresystems, efficient information-flow tracking systems, userauthentication, and IoT security. D407

September 27

A Brief History of Symbiote Defense

Salvatore Stolfo
Columbia University

Part Of

4:00P
- 5:00P

Location

32-G882
Add to Calendar 2017-09-27 16:00:00 2017-09-27 17:00:00 America/New_York A Brief History of Symbiote Defense Abstract Market watchers estimate the IoT Security marketplace is now valued at over $6 Billion and expected to reach $22 Billion by 2020. Just 5 years ago, embedded device security was barely on the map. Our early work in the IDS Lab at Columbia demonstrated the seriousness of the embedded device insecurity problem, and the relatively easy exploitation of devices such as printers, IP phones and routers. Recent advances in offensive technologies targeting a wide range of IoT devices have shown that the exploitation of these lucrative but poorly designed devices is not terribly difficult, including medical products, SCADA devices, automobiles and refrigerators. The goal of our early work was to defend embedded devices with an entirely new defensive capability we call the Software Symbiote, a host-based defensive technology that automatically injects intrusion detection functionality within the firmware of any device. In this talk we will provide a brief history of our work on the Symbiote technology, and the transition from academic research to practical and wide-spread use in common commodity products.Bio Salvatore Stolfo is a Professor of Computer Science at Columbia University. He is regarded as creating the area of machine learning applied to computer security in the mid-1990’s and has created several anomaly detection algorithms and systems addressing some of the hardest problems in securing computer systems. Of particular note is his recent interest in the practical application of deception security in scale. Stolfo is also co-inventor of the Symbiote technology that automatically injects intrusion detection functionality into arbitrary embedded devices. Stolfo has had numerous best papers and awards, most recently the RAID Most Influential Paper and Usenix Security Distinguished Paper awards. He has published well over 230 papers and has been granted over 60 patents and has been an advisor and consultant to government agencies, including DARPA, the National Academies and others, for well over 2 decades. Two security companies were recently spun out of his IDS lab, Allure Security Technology and Red Balloon Security. 32-G882