A large part of my work in software security builds on the SAGE (Scalable, Automated, Guided Execution) project, with Patrice Godefroid and Ella Bounimova in RiSE and in collaboration with partners in the Windows Reliability, Security, and Privacy team. SAGE is a “whitebox” fuzz testing tool that leverages traces of a program’s execution combined with optimized constraint generation and constraint solving to create program inputs that are likely to lead to security bugs. We partner with Windows, Office, and other teams across the company to run SAGE as part of the Microsoft software development cycle.
As part of the work on SAGE I developed a system called SAGAN that records data from every single run of the SAGE tool and makes it available in a web site. This data allows us to make better decisions about where to allocate our research resources and measure progress. As an extra benefit, the data helps us troubleshoot problems faced by us or our partners with running SAGE. Since coming online in Summer 2010, SAGAN has recorded over 600 gigabytes of log data, including multiple milestones of Windows testing.
In addition to this work, I am working on the Scriptgard, Panoptiheap, and CR2 projects.
The convergence of cloud services and decreasing cost to build devices is leading to radical new capabilities — and with them, new security challenges. Today it is possible to buy a cheap body-worn camera for $20, record several hours of video on a single charge, then ask hundreds of strangers answer questions about this video for pennies per question. At the same time, smartphone apps like Quest Visual’s “Word Lens” dynamically insert themselves into the visual pathway using a smart phone to perform seamless translations.
Wearable computers can be assembled from off the shelf parts for less than $400, including an opaque VGA display. Today these experiences are fragmented, unfinished, and frankly don’t work all that well, but they will give way to a new class of cheap devices that can enhance our capabilities this way.
We know from our experience with smart phones that these new devices will eventually open up to app stores. With these apps stores come security problems that come with allowing mutually untrusted code written by random people to run inside your senses. It’s one thing if a malicious application can send your phone number to the cloud. It’s another entirely if the app can change what you see.
With Doug Burger and his group in XCG, I am pursuing work in devices for continuous user interfaces and “continuous computing.” With Professor Yoshi Kohno at the University of Washington and his graduate student Franzi Roesner, I have written a short overview of security issues in augmented reality settings.
I also have an interest in cryptography. I appreciate both the theory of cryptography and practical problems with cryptographic implementations. For example, I was part of a team that found problems with the use of the MD5 hash function in a web certificate authority:
I’ve been honored to serve on these program committees. For conferences and workshops coming up, please consider sending us your work for review!
- IEEE Symposium on Security and Privacy 2012
- Financial Cryptography 2012
- Network Distributed Security Symposium 2012