New THaW patents

The THaW team is pleased to announce two new patents derived from THaW research, bringing the project total to five patents and one pending.  For the complete list, visit our Tech Transfer page.  The two new patents are described below.

  • March 2020: Xiaohui Liang, Tianlong Yun, Ron Peterson, and David Kotz. Secure System For Coupling Wearable Devices To Computerized Devices with Displays, March 2020. USPTO; U.S. Patent 10,581,606; USPTO. Download from https://patents.google.com/patent/US20170279612A1/enPriority date 2014-08-18, Grant date 2020-03-03. Patent describes a system enabling information from mobile health sensors (eg Fitbit) to be displayed onto nearby screens without being affected by local security threats. The scheme uses visible light sensor on the mobile device. See papers liang:lighttouch and liang:jlighttouch.
  • February 2020: Timothy J. Pierson, Xiaohui Liang, Ronald Peterson, and David Kotz. Apparatus for Securely Configuring A Target Device and Associated Methods, February 2020. U.S. Patent 10,574,298; USPTO. Download from https://patents.google.com/patent/US20180191403A1/enThis is a patent. Priority date 2015-06-23, Grant date 2020-02-25. Patent based on “Wanda” device, described in other publications. Device implements a scheme for single antenna wi-fi device to determine its proximity to another wi-fi device with which it is communicating, in order to assure it is not unwittingly communicating with a distant adversary device rather than a nearby device. See paper pierson:wanda.

Do Breach Remediation Efforts Affect Patient Outcomes?

THaW professor Eric Johnson was recently interviewed on the DataBreach Today podcast.  “How do hospitals’ efforts to bolster information security in the aftermath of data breaches potentially affect patient outcomes? Professor Eric Johnson of Vanderbilt University discusses recent research that shows a worrisome relationship between breach remediation and the delivery of timely patient care.”

You can find the 14-minute podcast, and written summary, on DataBreachToday.com.

The podcast discusses a recent THaW paper:

Sung J. Choi, M. Eric Johnson, and Christoph U. Lehmann. Data breach remediation efforts and their implications for hospital quality. Health Services Research 54(5), pages 971–980, September 2019. John Wiley & Sons. DOI: 10.1111/1475-6773.13203

Proximity detection with single-antenna IoT devices

ACM SIGMOBILE has posted a video of our presentation of the THaW paper Proximity detection with single-antenna IoT devices at MobiCom’19.  Abstract below the video.

Timothy J. Pierson, Travis Peters, Ronald Peterson, and David Kotz. Proximity Detection with Single-Antenna IoT Devices. In Proceedings of the ACM International Conference on Mobile Computing and Networking (MobiCom), Article #21, October 2019. ACM Press. DOI 10.1145/3300061.3300120.

Abstract: Providing secure communications between wireless devices that encounter each other on an ad-hoc basis is a challenge that has not yet been fully addressed. In these cases, close physical proximity among devices that have never shared a secret key is sometimes used as a basis of trust; devices in close proximity are deemed trustworthy while more distant devices are viewed as potential adversaries. Because radio waves are invisible, however, a user may believe a wireless device is communicating with a nearby device when in fact the user’s device is communicating with a distant adversary. Researchers have previously proposed methods for multi-antenna devices to ascertain physical proximity with other devices, but devices with a single antenna, such as those commonly used in the Internet of Things, cannot take advantage of these techniques.

We present theoretical and practical evaluation of a method called SNAP – SiNgle Antenna Proximity – that allows a single-antenna Wi-Fi device to quickly determine proximity with another Wi-Fi device. Our proximity detection technique leverages the repeating nature Wi-Fi’s preamble and the behavior of a signal in a transmitting antenna’s near-field region to detect proximity with high probability; SNAP never falsely declares proximity at ranges longer than 14 cm.

THaW’s Klara Nahrstedt named AAAS Fellow

THaW is proud to share news that Prof. Klara Nahrstedt, co-PI of the THaW project, has been recognized by the American Academy for the Advancement of Science as a Fellow of the AAAS.  To be named an AAAS Fellow is one of the most prestigious recognitions in the science community.  Congratulations to Klara!

More about her recognition here.

klara_nahrstedt_stairwell_342x342

photo by L. Brian Stauffer

Welcome Tim Pierson

PiersonThe THaW team is pleased to welcome Dr. Timothy Pierson as an affiliated faculty member.  Tim is no stranger to THaW – he completed his PhD within the THaW project, publishing his work about systems named Wanda, SNAP, and CloseTalker.

Tim now serves as a Lecturer at Dartmouth College after completing a PhD in Computer Science in 2018. He previously spent more than 20 years working in strategy, technology, finance, and operations. He has led teams in a wide variety of organizations including: technology start-ups, hedge funds, management consulting, non-profits, and the military.

Tim’s PhD research focused on the privacy, security, and usability of wireless sensor networks. His work on a project called Wanda was featured in over 200 newspaper, radio and television stations, including the New York Times and the Washington Post.

Most recently before returning to school, Tim worked with a technology start-up where he developed and deployed 11,000 Internet of Things sensors in San Francisco to help the city manage traffic congestion and parking. Tim served on the firm’s Management Committee and was Chief Technology Officer.

Before the start-up, Tim was the Chief Technology Officer at Elliott Associates, one of the oldest and largest hedge funds in the world. There he led teams in New York, London, Hong Kong and Tokyo.

Prior to joining Elliott, Tim was a consultant at McKinsey & Company where he advised senior executives and helped craft the long-term strategic vision for companies in financial services, supply chain, energy, aviation, telecom, and retailing.

Before McKinsey & Company, Tim was Assistant Security Manager at the Metropolitan Museum of Art in New York where he managed projects and helped lead the Museum’s force of nearly 500 security guards that protect the multi-billion dollar art collection and ensure public safety.

Tim began his career in the US Air Force Special Operation Command where he conducted unconventional warfare operations around the world.

Tim holds a PhD in Computer Science as well as an MBA from Dartmouth College, and a BS in Computer Science from Michigan Tech.

Temperature sensors may be vulnerable in safety-critical systems

Recent THaW research has demonstrated that temperature control systems, particularly in sensitive devices like infant incubators or industrial thermal chambers, can be affected by (and thus manipulated by) electromagnetic waves. The team included Prof. Kevin Fu and Research Investigator Sara Rampazzi from THaW, and Prof. Xiali Hei and PhD student Yazhou Tu from the University of Louisiana at Lafayette.

The vulnerability is due to the weakness of analog sensing components. In particular, the change in the measured temperature is due to an unintended rectification effect in amplifiers induced by injecting specific electromagnetic interferences though their temperature sensors.

The researchers demonstrate how it is possible remotely manipulate the temperature sensor measurements of critical devices, such as infant incubators, thermal chambers, and 3D printers. “In infant incubators for example, changing temperature sensor measurement can raise the risk of temperature-related health issues in infants, such as hyperthermia and hypothermia, which in turn can lead in extreme cases to hypoxia, and neurological complications.” Rampazzi says.

In a recent paper describing the attack method, the authors also describe a defense against the vulnerability, proposing a prototype of an analog anomaly detector to identify unintended interferences in the affected frequency range.

The paper was presented this month at the ACM Conference on Computer and Communications Security (CCS), and is available at DOI 10.1145/3319535.3354195.

Short video demos of the effect on an infant incubator are available on YouTube.

 

thermbanner.jpg

Wanda – Securely introducing mobile devices

A few years ago we posted a fun video describing our Wanda approach to securely introduce mobile devices to a Wi-Fi network… or to each other.  Wanda was published in INFOCOM 2016; since then we’ve refined the technique with the CloseTalker (MobiSys 2019) and SNAP (MobiCom 2019).  We just made a new Wanda video, which we hope you’ll enjoy!

With a Laser, Researchers Say They Can Hack Alexa, Google Home or Siri

The New York Times just posted a story about this startling new research from Kevin Fu and his group, funded in part by THaW.  The research team posted more details here.

 

Data breach remediation efforts and their implications for hospital quality

Screen Shot 2019-10-04 at 4.16.34 PMA new THaW paper in Health Sciences Research from Choi, Johnson, and Lehmann explores the relationship between breach remediation efforts and hospital care quality.  They found that hospital time‐to‐electrocardiogram increased as much as 2.7 minutes, and 30‐day acute myocardial infarction mortality increased as much as 0.36 percentage points, during the 3‐year window following a breach.  They conclude that breach remediation efforts were associated with deterioration in timeliness of care and patient outcomes. Thus, breached hospitals and HHS oversight should carefully evaluate remedial security initiatives to achieve better data security without negatively affecting patient outcomes.

https://doi.org/10.1111/1475-6773.13203

SNAP: Proximity Detection with Single-Antenna IoT Devices

THaW graduate Tim Pierson will present SNAP, a method for proximity detection with single-antenna IoT devices at MobiCom in October.

SNAP - Likelihood of declaring proximityAbstract: Providing secure communications between wireless devices that encounter each other on an ad-hoc basis is a challenge that has not yet been fully addressed. In these cases, close physical proximity among devices that have never shared a secret key is sometimes used as a basis of trust; devices in close proximity are deemed trustworthy while more distant devices are viewed as potential adversaries. Because radio waves are invisible, however, a user may believe a wireless device is communicating with a nearby device when in fact the user’s device is communicating with a distant adversary. Researchers have previously proposed methods for multi-antenna devices to ascertain physical proximity with other devices, but devices with a single antenna, such as those commonly used in the Internet of Things, cannot take advantage of these techniques.

We present theoretical and practical evaluation of a method called SNAP — SiNgle Antenna Proximity — that allows a single-antenna Wi-Fi device to quickly determine proximity with another Wi-Fi device. Our proximity detection technique leverages the repeating nature Wi-Fi’s preamble and the behavior of a signal in a transmitting antenna’s near-field region to detect proximity with high probability; SNAP never falsely declares proximity at ranges longer than 14 cm.

In Proceedings of the ACM International Conference on Mobile Computing and Networking (MobiCom), Article #1-15, October 2019. ACM Press. DOI 10.1145/3300061.3300120.