Enigma 2019 Conference Program

Many of the security and privacy mechanisms we build - permission prompts, security warnings, privacy policies - make one critical assumption: the end-user is an adult with agency to make their own decisions. Children, and especially children in schools, operate in a different security and privacy context than the general-purpose online tools they use. Young students can't evaluate security risks or consent to data sharing, but we give them the same security warnings and privacy controls that confuse adults.

Authentication mechanisms aren't designed for children and don't adapt to their age. Password "best practices" aren't considerate of children who are learning to type. Many two-factor and password reset systems don't work for kids who aren't allowed to have phones. Mobile apps that never expire sessions don't make sense for schools who can't afford a device for every student.

The classroom setting is different than the corporate or consumer internet environment. The dynamic power structure of teachers, school administrators, students, and parents needs to be understood and baked into authentication and authorization tools for schools. Teachers play the role of system administrators, fielding support questions, fixing keyboards, and resetting passwords. School and district administrators have important and complicated relationships with the classroom, and technology is deployed both top-down and bottom-up, making inflexible systems brittle.

While many recognize the promise of technology in the classroom, many attempts to design kid-friendly systems are met with suspicion. Early academic data is sensitive. The concept of a "permanent record" is an educational privacy trope. In the era of big data, this is even more concerning. When students create content in edtech apps, that may be the first time they associate their online identity with data.

While edtech promises a revolution in learning outcomes, it first needs to be both safe and useful. This talk introduces security and privacy challenges kids face using technology in the classroom. It's imperative that we apply security and privacy design principles with an understanding of the real-world classroom context to realize the benefits of education technology for society.

Three years ago, Callisto launched its sexual assault reporting platform on college campuses. Callisto recently launched a new product that expands our reach to support any survivor of sexual assault and profession sexual coercion in the United States.

In this new product, users are invited to an online "matching escrow" that will detect repeat perpetrators and create pathways to support for victims. Users of this product can enter the identity of their perpetrator into the escrow. This data can only be decrypted by the Callisto Options Counselor (a lawyer), when another user enters the identity of the same perpetrator. If the perpetrator identities match, both users will be put in touch independently with the Options Counselor, who will connect them to each other (if appropriate) and help them determine their best path towards justice. The client relationships with the Options Counselors are structured so that any client-counselor communications would be privileged. A combination of client-side encryption, encrypted communication channels, oblivious pseudorandom functions, key federation, and Shamir secret sharing keep data encrypted so that only the Callisto Options Counselor has access to user submitted data when a match is identified. This presentation will discuss Callisto’s cryptographic approach and infosec strategy to solve an urgent social justice problem.

Hardware Security Modules occupy a unique position in computer security–they are used to manage the most important secrets, but they're closed designs where opacity and tamper-response are inherent design requirements. These devices have had varying levels of adoption, from being the only way to do cryptography fast, to only being used when security was required (often by regulation), to now being used to protect high-value secrets at a distance. Unfortunately, many of the designs on the market are very old, and essentially designed for a different use case and threat model than exists today. To a degree, even existing certification procedures act as an impediment to successful use of the technology.

We will describe the issues with premises and cloud-based HSMs, as well as some ways to work around these limitations and how to build a new kind of product for current needs.

TLS is the primary protocol used to provide security and privacy for Internet traffic. Sadly, there is abundant evidence that developers do not use TLS correctly, due to a morass of poorly-designed APIs, lack of security expertise, and poor adherence to best practices. In this talk, we argue this is a problem of architecture and abstraction. We first demonstrate how a security layer fits into the Internet architecture, between applications and TCP, and how the POSIX socket API is both a convenient and simple abstraction for a TLS interface. We then discuss ramifications for developers, administrators, and OS vendors, focused on two major benefits: (1) developers have a centralized, well-tested service to easily create a secure application in minutes, and (2) system administrators and OS vendors have policy to ensure all applications on a device use best practices. We finish by illustrating how this new abstraction and architecture can simplify two of the most complex parts of TLS—certificate validation and client authentication. We are releasing code for the security layer, including both operating system services and application examples, to stimulate developer and industry interest in this approach.

Most privacy talks are given by privacy experts. I’m not a privacy expert. In fact, my job is to help teams across Uber access and analyze appropriate data to make our services smarter and more reliable. As such, my team is often on the receiving end of technical and policy requirements from our privacy teams. This talk will discuss how privacy and data engineers at Uber joined forces to build a privacy-protecting approach to data retrieval and what privacy teams need to know about working with data teams to accomplish their goals. I'll share specific examples from Uber engineering on how we work with our privacy colleagues to enforce least privilege, data protection, and compliance with regulatory requirements.

Using automated reasoning technology, the application of mathematical logic to help answer critical questions about your infrastructure, AWS is able to detect entire classes of misconfigurations that could potentially expose vulnerable data. We call this provable security-absolute assurance in security of the cloud and in the cloud. This talk highlights, how this next generation cloud security technology is protecting customers in an evolving threat landscape and how customers are using provable security features in their AWS cloud environment.

The conventional wisdom is that cybercrime is a largely anonymous activity that exists essentially in cyberspace. The supposed anonymity of attackers feeds into a narrative that cybercrime is strange, new, ubiquitous and ultimately very difficult to counteract. The central purpose of this presentation is to dispute this view. When one looks for it, there is actually a strong offline and local element within cybercrime, alongside the online dimension. In a number of cases, offenders are physically known to each other and work together. Understanding this phenomenon is important for informing policy approaches that seek to address this challenge. The arguments made in this presentation are supported by fieldwork carried out over a 7 year period in some 20 countries, including cybercrime "hotspots" like Russia, Ukraine, Romania, Nigeria, Brazil, China and the USA. This included interviews with almost 250 participants from across law enforcement, the private sector and former cybercriminals.

Over the course of the last three decades, and increasingly over the past eight years, state and semi-state actor behavior in cyberspace is veering in a direction that much of the cyber security research has not. While much of the academic and policy communities focus on ‘the high-and-right’ cyber action equivalent to an armed attack - the concept of cyber war - the actual behavior of actors has been of a far more nuanced and different nature. What we have been observing are campaigns comprised of linked cyber operations, with the specific objective of achieving strategic outcomes without the need of armed attack. These campaigns are not simply transitory clever tactics. Rather, they are reflections of the structural imperatives of cyberspace itself as a domain and as such will be the central mechanism of state and semi-state competition in this realm as long as the core structure of cyberspace endures. The fundamental nature of cyberspace rests on a structure of interconnectedness and a condition of constant contact. Once recognized, that nature requires us to study cyber means not as enablers of war, although they can be, but more critically as the alternative to it.

This presentation puts forth the argument that cyberspace is a new field of competition in power politics and cyber campaigns are now a salient means, alternative to war, of achieving strategic outcomes. We propose and evaluate a new set of measures - which go beyond conventional approaches of norms setting, deterrence and resilience - to address today's cyber policy challenges.

Frictionless strong authentication is a critical driver for enabling ecommerce and many other modern technology systems to thrive. In this talk, I showcase the challenges of tackling modern sophisticated machine based attacks and other malicious human activity attempting account takeover using stolen or compromised credentials. This is followed by a quick dive into the engineered solution that can perform behavioral analytics utilizing biometric data and how it tackles machine learning problems at the scale of hundreds of millions of authentication attempts. Insight is provided into implementation challenges, machine learning model generation, and finally integration into a very complex ecosystem. This talk will also showcase wins and how this eventually enabled a zero-trust environment.

Data analytics and machine learning can provide enormous societal value and foster advancements in many industries. However, most of the valuable data needed to power these innovations remains restricted and siloed due to privacy concerns. This talk will discuss how blockchain technology, combined with privacy-preserving techniques, can enable a secure data market allowing users to share their data for analytics and machine learning while maintaining privacy, transparency, and control—without relying on trust of any central organization.

Practically-focused privacy research has disproportionately focused on the browser extension layer. This extension-predilection is a double edged sword. On the positive side, extensions are both simpler to develop and easier to distribute than deeper-reaching modifications, allowing researchers to iterate quickly and share their work with a large audience. On the negative side, an extension focus reduces the privacy improvements that can be achieved, as extensions can only modify a limited set of browser behavior. Researchers exploring modifications beyond the extension layer also lack easy ways of sharing their findings with a broad audience.

As a result, many possible web privacy improvements go under-explored. In this talk, I'll discuss three privacy improvements being developed at Brave that would not be possible at the extension layer. I hope to encourage other researchers and privacy activists to move beyond an extension-focused deployment strategy, and to consider privacy-oriented browser vendors as deployment strategies for getting their improvements in the hands of web users.

One of the Internet's greatest strengths is the degree to which it facilitates access to any of its resources from users anywhere in the world. The Internet has already become a crucial part of our life. People around the world use the internet to communicate, connect, and do business. Yet various commercial, technical, and national interests constrain universal access to information on the internet.

I will discuss three reasons for the closed web that are not caused by government censorship: blocking visitors from the EU to avoid GDPR compliance, blocking based upon the visitor's country, and blocking due to security concerns. These decisions can have an adverse effect on the people of the blocked regions, especially for the developing regions. With many key services, such as education, commerce, and news, offered by a small number of web-based Western companies who might not view the developing world as worth the risk, these indiscriminate blanket blocking could slow the growth of blocked developing regions.

As we are building the future web, we need to discuss the implication of such blocking practices and build technologies that ensure an open web for users around the world.

Mobile platforms have enabled third-party app ecosystems that provide users with an endless supply of rich content. At the same time, mobile devices present very serious privacy risks: their ability to capture real-time data about our behaviors and preferences has created a marketplace for user data that most consumers are simply unaware of. In this talk, I will present research that my research group has conducted to automatically examine the privacy behaviors of mobile apps. Using analysis tools that we developed, we have tested over 80,000 of the most popular Android apps to examine what data they access and with whom they share it. I will present data on how mobile apps are tracking and profiling users, how these practices are often against users' expectations and public disclosures, and how app developers may be violating various privacy regulations.

The main takeaway from this talk is that there are many stakeholders who can be doing more to improve privacy on mobile platforms: (1) mobile app developers need to better understand the privacy behaviors of the third-party SDKs that they use, as well as to better communicate their privacy practices to their users; (2) the providers of third-party services (e.g., SDKs) and platforms need to do a better job of enforcing their own terms of service; (3) and regulators need tools that allow them to proactively audit compliance.

Authoritarian regimes increasingly integrate automated bots, digital trolls, and cyber warriors to achieve a broad range of objectives, including data theft, destruction, and manipulation. This strategy for information control and dominance is no longer limited to major power nation-states. It is increasingly diffusing to smaller states as well as a range of non-state actors, and has impacted international events ranging from multi-state economic boycotts to election interference across the globe. As it proliferates this modern authoritarian playbook is also restructuring global regimes and defining global norms pertaining to security and privacy in the absence of a strong and resilient democratic model. To counter the proliferation of this authoritarian model, a major, strategic overhaul of information security within democracies is required. It is time for a strategic renaissance in information security. This requires the removal of the stovepipes that divide information operations and cybersecurity, avoiding conceptual stretching in favor of greater specificity in the terminology and strategy to modernize the democratic playbook. Importantly, this reimagination must be in sync with technological and social changes, and provide a democratic alternative to the authoritarian model that is increasingly taking a global stronghold. I will first provide an overview of the major innovations across bots, trolls, and warriors, including specific use cases of their integration as a holistic strategy. Next, I will address how this authoritarian model is restructuring the international system, shaping global norms, internet standards, and redefining acceptable behavior in war and peace. Finally, I will offer recommendations for the path ahead given this shifting international landscape, and what the private and public sectors within democracies should do as the digital defenders of security, privacy, and individual freedoms.

What does it take to build a secure voting system that people actually use? Because a democracy is only as vibrant as its citizens are involved, this talk will arm the audience with the latest answers we have to that question, including what's settled, what's not serious, and what's still being debated.

Nowadays, security incidents have become a familiar "nuisance," and they regularly lead to the exposure of private and sensitive data. In practice, the root causes for such incidents are rarely complex attacks. Instead, they are enabled by simple misconfigurations, such as authentication not being required, or security updates not being installed. For example, the leak of over 140 million Americans' private data from Equifax's systems is among most severe misconfigurations in recent history: The underlying vulnerability was long known, and a security patch had been available for months, but it was never applied. Ultimately, Equifax blamed an employee for forgetting to update the affected system, highlighting his personal responsibility.

In this talk, we investigate the operators' perspective on security misconfigurations to approach the human component of these security issues. We focus on system operators, because they are, ultimately, the ones being made responsible for the misconfigurations. Yet, they might not actually be a security issue's root cause, but other organizational factors might have led to it. We provide an analysis of system operators' perspective on security misconfigurations, and we determine the factors that operators perceive as the root causes. Finally, based on our findings, we provide practical recommendations on how to reduce security misconfigurations' frequency and impact.

Academic research on machine learning-based malware classification appears to leave very little room for improvement, boasting F1 performance figures of up to 0.99. Is the problem solved? In this talk, we argue that there is an endemic issue of inflated results due to two pervasive sources of experimental bias: spatial bias, caused by distributions of training and testing data not representative of a real-world deployment, and temporal bias, caused by incorrect splits of training and testing sets (e.g., in cross-validation) leading to impossible configurations. To overcome this issue, we propose a set of space and time constraints for experiment design. Furthermore, we introduce a new metric that summarizes the performance of a classifier over time, i.e., its expected robustness in a real-world setting. Finally, we present an algorithm to tune the performance of a given classifier. We have implemented our solutions in TESSERACT, an open source evaluation framework that allows a fair comparison of malware classifiers in a realistic setting. We used TESSERACT to evaluate two well-known malware classifiers from the literature on a dataset of 129K applications, demonstrating the distortion of results due to experimental bias and showcasing significant improvements from tuning.

Red Teaming is a popular topic for both internal security teams, and for external contractors to emulate real world attacks and improve defenses. Going beyond the pentest model, Red Teaming delivers inarguable results that critically inform detection, prevention and response for an organization's security. However, it is often thought of as the "easy" side of InfoSec, and many Red Teams operate on a "win and go home" model. It can be quite easy, but if it is, you're not achieving the true goal: improved security at an organization or company via an adversarial perspective.

In this talk, Aaron will explore how proper Red Teaming can be extremely challenging, how it often requires understanding an organization functions, knowing how to attack different technology stacks, even exploring business risks, insider threats and abuse. To have an impact or achieve a compromise, sometimes a team may need to understand the target areas more than the people who create or maintain them. However popular Red Teaming is now, and whatever is being targeted, we're only scratching the surface of what is possible.

The rate at which software vulnerabilities are discovered is growing: the National Vulnerability Database includes over 100,000 vulnerabilities, and 10% of these entries were added in the last year. Very few of these vulnerabilities are exploited in real-world attacks, yet the exploits can compromise millions of hosts around the world and can disrupt businesses and critical services.

This talk will discuss what we have learned about vulnerability exploitation by analyzing data from 10 million hosts. These hosts, used by real people around the world and targeted by real attackers, give us an opportunity to quantify the impact of software vulnerabilities on a global scale. Our measurements also allow us to infer statistically which vulnerabilities are likely to be exploited in the wild—before finding the corresponding exploits.

We show that the growing rate of vulnerability discovery does not mean that software is becoming more insecure; in fact, the fraction of vulnerabilities that are exploited follows a decreasing trend. At the same time, popular vulnerability metrics, such as the CVSS score, have a low correlation with the vulnerabilities that are ultimately exploited in the real world. It is difficult to guess why hackers exploit some vulnerabilities and not others, because this decision is influenced by a variety of socio-technical factors. However, we can combine features derived from the technical characteristics of a vulnerability, such as its CVSS score, with features extracted from social media, which reflect how information about the vulnerability spreads among hackers, security researchers and system administrators. Additionally, we can take into account variations in the rates at which vulnerable hosts are patched, after the patch becomes available. By combining these factors into predictive models, we can determine which vulnerabilities present a higher risk of exploitation, and, for some vulnerabilities, we can infer the existence of zero-day exploits on the day of disclosure.

Our predictive models are the result of five years of academic research, and they represent a step toward answering the question "What are the odds that you will get hacked tomorrow?" Along with recent advances on predicting other types of security incidents, these techniques help us assess objectively the impact of various defensive technologies on security in the real world. Such predictive models allow companies to determine their biggest risks and the best mitigations by using data, rather than expert opinions. They also provide evidence for cyber policymaking, and they can be applied to risk modeling in cyber insurance.

Being an Infosec professional kind of forces you to be a jack of all trades. It helps to develop a mindset where analyzing risk becomes second nature. Daily security and risk assessment decisions are an excellent exercise and will help build security muscle memory, and it benefits you professionally and personally. The premise is simple - I will outline what I do from a physical OPSEC standpoint when I travel or am just out and about, and you will reflect (with nudging) on my metaphors. We all do it to a certain extent, so why not consciously put it to the test? What better way to start the process than while traveling to a security conference?