Jefferson's Wheel

The New York Times has a new article about Karsten Nohl’s studies of mobile phone carrier security: Lax Security Exposes Voice Mail to Hacking, Study Says (the title is very misleading, since there is nothing really specific to voice mail here, it is about intercepting actual calls), New York Times, 25 December 2011.

In a study of 31 mobile operators in Europe, Morocco and Thailand, Karsten Nohl, a Berlin hacker and mobile security expert, found that many operators provided poor or weak defenses to protect consumers from illicit surveillance and identity theft.

Mr. Nohl said he was able to hack into mobile conversations and text messages and could impersonate the account identities of cellphone users in 11 countries using an inexpensive, 7-year-old Motorola cellphone and free decryption software available on the Internet. He has tested each mobile operator more than 100 times, he said, and has ranked the quality of their defenses.

…

“This is a major vulnerability in most networks we tested, and the irony is that it costs very little, if nothing, to repair,” Mr. Nohl said. “Often it is just a question of inertia on the part of operators, or they have other priorities, such as building their networks.” …

While the research was limited mostly to Europe, Mr. Nohl, a German citizen who received a doctorate in computer science at the University of Virginia, said the level of security provided by U.S. network operators was on a par with European operators, meaning there was also room for improvement.

In Asia, the Middle East and Latin America, the level of mobile security varies widely and can be much lower. Operators in India and China, Mr. Nohl said, encrypt digital traffic poorly or not at all, either to save on the network’s operating costs or to allow government censors unfettered access to communications.

Jiamin Chen and Peter Chapman have been recognized by the Computing Research Association Outstanding Undergraduate Researchers Award. This is the premier national award for undergraduate researchers in computer science.

Peter was selected as the Runner-Up, and Jiamin Chen was selected as an Honorable Mention.

Congratulations to Jiamin and Peter!

[Added 9 Dec] Here’s the CRA Announcement:

Our paper on using generic garbled circuits to perform private set intersection is now available:

The paper develops three circuit designs for securely computing the intersection of two sets, where each set is the private input from one protocol participant. We show that for many scenarios, protocols built using only generic garbled circuit secure computation techniques can be competitive with the best custom-designed protocols for private set intersection.

Yan Huang will present the paper at NDSS in San Diego, in February 2012.

Our paper on Efficient Secure Computation with Garbled Circuits (by Yan Huang, Chih-hao Shen, David Evans, Jonathan Katz, and abhi shelat) is now available (Abstract, Paper [PDF, 21 pages]).

The paper is connected with a keynote talk I will give at the Seventh International Conference on Information Systems Security (ICISS 2011) in Kolkata (previously known as Calcutta), India on 17 December 2011.

Abstract. Secure two-party computation enables applications in which participants compute the output of a function that depends on their private inputs, without revealing those inputs or relying on any trusted third party. In this paper, we show the potential of building privacy-preserving applications using garbled circuits, a generic technique that until recently was believed to be too inefficient to scale to realistic problems. We present a Java-based framework that uses pipelining and circuit-level optimizations to build efficient and scalable privacy-preserving applications. Although the standard garbled circuit protocol assumes a very week, honest-but-curious adversary, techniques are available for converting such protocols to resist stronger adversaries, including fully malicious adversaries. We summarize approaches to producing malicious-resistant secure computations that reduce the costs of transforming a protocol to be secure against stronger adversaries. In addition, we summarize results on ensuring fairness, the property that either both parties receive the result or neither party does. Several open problems remain, but as theory and pragmatism advance, secure computation is approaching the point where it offers practical solutions for a wide variety of important problems.

Yan Huang has been selected as a finalist for the NYU-Poly AT&T Best Applied Security Paper Award for the paper, Faster Secure Two-Party Computation Using Garbled Circuits (USENIX Security 2011, co-authored with David Evans, Jonathan Katz, and Lior Malka). The award recognizes the best paper on applied security in any venue between September 1, 2010 and August 31, 2011.

The award will be announced at a ceremony as part of the CSAW Cybersecurity Competition in New York on 11 November.

UVa Today has a story about our secure computation project: U.Va. Team Awarded $3 Million NSF Secure Computation Grant, Fariss Samarrai, UVa Today, 14 October 2011.

Photo: Cole Geddy

“Secure computation is the idea that you can have two people compute a function that depends on things that each one knows individually and wants to keep private without exposing their private data to the other person, or to anyone else,” Evans said.

The research has applications in everyday life, from private medical information, such as personal genomics, to privacy-preserving face recognition and electronic commerce.

As a simple example of how it works, consider two people who each have smartphones with personal address books. They would like to know if they know any of the same people by comparing their address books. But, they may not want to share their address books, which include potentially sensitive private information. So how can they find the common entries, without revealing anything about their other contacts?

Read More …

Yikan Chen presented his work on Auditing Information Leakage for Distance Metrics at the Third IEEE Conference on Privacy, Security, Risk and Trust today.

The slides are here: [PPTX] [PDF]

Here are the slides from my talk in cs6190, our seminar for new graduate students: [PPTX] [PDF]

Links from the talk:

• http://www.mightbeevil.com — secure computation with garbled circuits
• CommonContacts Android Secure Computation Demo
• Research group mailing list
• Publications

Today (August 30th) we are hosting the Kickoff Meeting for our new NSF-funded 5-year project, Practical Secure Two-Party Computation: Techniques, Tools, and Applications. This is a collaborative research project with abhi shelat and Aaron Mackey at UVa, Michael Hicks and Jonathan Katz at the University of Maryland, and Steven Myers at Indiana University. The goal of the project is to make privacy-preserving computation practical and accessible enough to be used routinely in applications such as personalized genetics, medical research, and privacy-preserving biometrics. For more, see http://securecomputation.org.

The Computer Science department has moved into Rice Hall, our beautiful new building next to our former home in Olsson Hall.

Here are some pictures of the lab space for the Secure Research Group in Rice 442: