News Items

Prof Lorrie Cranor was interviewed by NPR about the potential of using emoji as passwords.

http://www.npr.org/sections/alltechconsidered/2015/06/15/414742418/emoji-passwords-could-be-coming-your-way-is-that-a-good-thing

The Illinois NSA Science of Security (SoS) Lablet is now accepting applications from undergraduate students for their SoS Summer Internship Program! The application deadline is January 19, 2016. Information regarding the internship and a link to the application form can be found at: http://go.illinois.edu/SoSInternship. Please feel free to distribute this announcement to colleagues and students that might be interested in the program.

Report released of a Workshop convened by the Berkeley Center for Law & Technology, the UC Berkeley School of Information and the International Computer Science Institute under a grant from the National Science Foundation

Abstract: 

New study published in Science examined the reproducibility of psychology experiments. They tested 100 experiments and found a large portion of the replications had weaker statistical significance than the original study. For futher details, see the article

http://www.sciencemag.org/content/349/6251/aac4716

http://www.sciencedaily.com/releases/2015/08/150827154242.htm

Reuters has a story that two ex-employees from Kaspersky Labs claiming that they submitted malicous marked benign files to fool compeitors to mark malicous good files of customers while they were employeed at Kaspersky. Whether that part is true or not, the story reviews challenges of manipulation in cooperation of anti-virus companies particularly in 2009-2013.

http://www.reuters.com/article/2015/08/14/us-kaspersky-rivals-idUSKCN0QJ1CR20150814

The Research Directorate of the National Security Agency announced the winner of this year's Science of Security (SoS) Best Scientific Cybersecurity Paper Competition. Of the 50 papers nominated, one winner and two honorable mentions were chosen.

Congratulations to all the winners!

3rd ANNUAL NSA COMPETITION FOR THE BEST SCIENTIFIC CYBERSECURITY PAPER

WINNING PAPER

Christopher Domas from the Battelle Memorial Institute at Blackhat presented how to compromise the lowest level code in Intel CPUs. The bug allows malicious code to jump from 'ring 0,' typically the most privileged level of execution, to 'ring -2,' the System Management Mode. While running under SMM, said code is able to preempt code running in any other ring, including the 'ring -1' hypervisor, and can even bypass protections such as Trusted Execution Technology. This is well below the OS or even the BIOS. Intel CPUs from 1997 to just before the now are vulnerable.

http://www.wired.com/2015/08/researchers-create-first-firmware-worm-attacks-macs/

The New York Times profiled the NSA GenCyger program. This program funds organizations to hold cybersecurity summer camps for kids. Attendance is free for the students and in 2015 there are 43 camps and 1,400 campers. The Berekley Camp used privacy content created by SoS Research. Those interested in 2016, there is an expected BAA in the fall for proposals to hold 2016 camps.

http://www.nytimes.com/2015/07/18/us/nsa-summer-camp-hacking-cyber-defense.html

Darpa annouced the 7 finalist for the Cyber Grand Challenge with a $2 million prize.

NSA posts news story on the ISEF Award

https://www.nsa.gov/public_info/news_information/2015/NSA_Research_Supports_Next_Generation_of_Scientists_and_Engineers.shtml

The Washington Post published an article on a bit of the history of L0pht and how hackers back in 1998 testified to Congress that the Internet security was terribly broken. And yet, it remains terribly broken.

http://www.msn.com/en-us/news/other/hackers-warned-the-internet-would-be-a-security-disaster-nobody-listened/ar-AAbXhHf?ocid=iehp

International Computer Science Institute and the University of California Berkeley are researching web browser messages. They are working to make them less confusing. The Firefox extension prompts surveys on triggered events. It doesn't collect browsing history. It's been IRB approved.

More Info: https://surveys.cs.berkeley.edu/browser-study/

The Deter Project is a research project and a cyber experimental testbed. It has the goal of allowing for repeatable, scalable and scientifically verifiable experimentation -- for homeland security and critical infrastructure protection. It is funded by DHS, NSF and DoD. They are open to collaboration others to use the testbed.

For more information: http://deter-project.org/

The National Security Agency Research Directorate is sponsoring a special award at the Intel International Science & Engineering Fair in Science of Security. The award is to recognize high school students who's research reflect the principles of the science of security and contributes to improving global cybersecurity. The winning students are announced at a banquet on the night of May 14th.

The winning prize is $3,000 and honorable mentions are $1,000.

UIUC Lablet hosted HotSoS 2015 on April 21-22 at the University of Illinois at Urbana-Champaign National Center for Supercomputing Applications.  Interest in Cybersecurity Science and Resarch were hot topics at this Symposium and Bootcamp on the Science of Security.

On March 17 and 18, 2015, researchers from the four System Science of SecUrity and REsilience for Cyber-Physical Systems (SURE) project universities (Vanderbilt, Hawaii, California-Berkeley, and MIT) met with members of NSA's R2 Directorate to review their first six months of work.  SURE is the NSA-funded project aimed at improving scientific understanding of resiliency, that is, robustness to reliability failures or faults and s

This article provides expert insights to modern cyber threat intelligence without marketing material or vendor fluff to give readers a better understanding of this complex but critical area of cyber defense.

https://www.linkedin.com/pulse/insights-modern-cyber-threat-intelligence-shawn-riley

With the first 2015 issue of the SoS Newsletter almost complete, please check-out the last edition for 2014. Issue 6 is available at http://cps-vo.org/node/16335! Issue 6 features a comprehensive distribution of notable topics, news items, publications, and updates within the security community. This edition highlights:

The Science of Security Summer Internship at the Information Trust Institute at the University of Illinois Urbana-Champaign offers undergraduates the opportunity to explore the field of cybersecurity through a unique summer program. Science of security is an emerging area that emphasizes the methodology of research in cybersecurity as much as the results - an approach that is critical in addressing the fundamental problems of security in a principled manner.

The eight-member team from the University of Central Florida (UCF) was the 2014 winner of the Raytheon National Collegiate Cyber Defense Competition (http://www.nationalccdc.org/). This competition is focused on the security tasks associated with administration and protection of an operational "commercial" network. Unlike other stand-alone competitions the NCCDC recognizes the best team in the nation for overall performance at multiple cybersecurity competitions. The UCF team beat nine other regional winners at the two-day event held at the University of Texas at San Antonio.

The University of Wisconsin is establishing a new, independent cybersecurity research center that will allow it to compete with other major academic institutions performing classified national security research. The Wisconsin Information Security Center was approved for classified work by the Wisconsin legislature and will create an environment capable of balancing the openness of academic science with the secrecy demanded of agencies funding classified projects.

*more: http://www.sciencemag.org/news/2015/01/shh-wisconsin-seeking-get-secret-cybersecurity-research

The newest issue of the CPS-VO Science of Security Newsletter is now available at http://cps-vo.org/node/15040! The Issue 4 Newsletter features a comprehensive distribution of notable topics, news items, publications, and updates within the world of computer security. This edition highlights the five academic researchers from the Universities of Maryland, Bonn, and Leibniz, winners of the NSA Award for Best Scientific Cybersecurity Paper and runner-up.