October '06 Newsletter

<!-- InstanceBeginEditable name="Feature1Story" --> Phishing and computer infiltration affected 1.2 million Americans in the first half of 2006

In the first half of 2006, phishers sent out more than 157,000 different email messages to millions of recipients'an 81 percent increase over the last six months of 2005, according to a bi-annual Internet Security Threat Report released by the security-software maker Symantec.

If phishing schemes'in which attackers pose as legitimate organizations in order to dupe Internet users into handing over passwords and other private information'are on the rise, so are attacks that install software onto computers that steal passwords as they are being typed, or hijack PCs for use in denial of service or spam attacks. The economic loss from these types of electronic crimes has been estimated at $1 billion, affecting 1.2 million Americans, in the first half of this year alone.

To address this growing problem, researchers at the Team for Research in Ubiquitous Secure Technology (TRUST), a multi-campus initiative, have created a set of tools that help protect Internet users against online identity theft. Available through CITRIS's NERF (Non Exclusive Royalty Free) licensing agreement, these software downloads are already being put to good use. Working with California law enforcement, researchers with CITRIS's Cybersecurity Center are also developing more effective means of litigating against these crimes.

Few are as familiar with the challenges of preventing and prosecuting online identity theft and other electronic crimes as Robert Rodriguez. A retired secret service agent who directed the Secret Service West Coast Electronic Crime Taskforce, Rodriguez is now collaborating with TRUST.

John Mitchell (above) and Dan Boneh of Stanford have created five browser extensions to help users guard against common security risks.

"The threats and risks and vulnerabilities change every day. It is moving at a very fast pace. All the tools, processes, policies, and procedures are reactive for the most part. And the attackers are in a global environment, attacking from foreign countries we can't reach out to. Law enforcement does not have the technical or financial resources or the manpower to challenge them. We're inundated," says Rodriquez.

Several years ago, Rodriguez and his colleagues turned to Stanford University computer science professors John Mitchell and Dan Boneh for help. "Law enforcement was very helpful in telling us what kinds of problems they were seeing. Companies have been very helpful in giving us more information about what their business constraints are and what kinds of solutions may be acceptable to them. What we can do in the university is just try things out without having a good idea of what the market is or how we're going to make money off of it," says Mitchell, a TRUST member.

Since that meeting more than three years ago, Mitchell, Boneh, and their students have developed five free browser extensions (software that, when installed, works with an Internet browser like Mozilla Firefox) that Internet users can download for protection against some of the most common tricks played by electronic thieves. PwdHash encrypts Internet users' passwords as they are entered so that thieves will not be able to use them, while SpoofGuard alerts Web browsers when they have landed on a fake site. SafeCache and SafeHistory protect users of Mozilla Firefox browser against malicious crime ware that tracks which sites and links they have visited. SpyBlock blocks passwords from any keylogging software that might be embedded on a user's computer.

TRUST member Doug Tygar

One of the reasons phishing schemes are so successful in getting people to turn over their personal information is their ability to replicate existing Web sites. Research conducted by UC Berkeley professor and TRUST member Doug Tygar, revealed that computer users often ignore and misread the clues (e.g. address bar, status bar, and security indicators) that the Web site they are visiting is a fake. His proposed solution: Dynamic Security Skins, which provide users with bolder visual cues'photographic images and patterns'to reassure them that the site they're signing in to is a trusted one.

The problem, of course, is that people savvy enough to know about and download these tools and others like them are usually savvy enough to avoid falling for a phishing scheme in the first place. "One of the best outcomes for us would be to have some of the ideas we've developed in our prototype software get adopted and built into browsers," says Mitchell. That way, everyone surfing the Web would be automatically protected whether or not they are aware of phishing.

However, software alone will not bring electronic identity theft to an end. "Criminals are increasingly sophisticated these days, and this escalation poses new technical problems. We certainly need to increase platform security, protect assets from crime ware, and improve web authentication. But we also need to address the social and legal issues, the human factors," says Deirdre Mulligan, Clinical Professor of Law and Director of the Samuelson Law, Technology and Public Policy Clinic.

Mulligan and a team of Berkeley students are collaborating with TRUST scientists and engineers to make sure the social and legal aspects of electronic identity theft and other TRUST projects are addressed alongside the technical challenges.

For example, if computers users are provided with more concise notices before or after they install software, they will be far less likely to install programs that they will later regret having on their machines. This was one of the conclusions of a recently completed study of 222 computer users by Berkeley Ph.D. students Jens Grossklags and Nathan Good, along with University of Minnesota computer science professor Joseph Konstan. This is significant because many seemingly harmless software programs come bundled with spyware or adware. This study's results suggest that just by redesigning software notices, such as the End User License Agreement (EULA), users can be guided towards making safer, better informed decisions about what applications they choose to install.

Similarly, a high-tech analysis of spyware and adware programs distributed by Enternet, PacerD, and 180 Solutions conducted last year by TRUST-affiliated students and faculty from Stanford's computer science departments and Law School could be useful should prosecutors ever decide to legally challenge those companies.

Encouraged by these successes, TRUST researchers are working on more defenses to combat the growing problem of online identity theft'from developing curriculum to ongoing research in collaboration with industry and government partners'to ensure that help is available where it is needed. It is a big problem, but by bringing together the best minds from the public and private sectors to tackle it, TRUST believes that victory can be achieved.<!-- InstanceEndEditable -->

 

For more information:

<!-- InstanceBeginEditable name="Feature1Links" -->

John Mitchell software projects

Scientists band together for TRUST-worthy research, by Niall McKay (SearchSecurity.com, March 7, 2006)

TRUST security privacy blog

2 professors go fishing for phishers, by Carrie Kirby (San Francisco Chronicle, July 25, 2005)

Phishing with Rachna Dhamija, by Federico Biancuzzi, (Security Focus, June 19, 2006)

Why Phishing Works, by Rachna Dhamija, J.D. Tygar, and Marti Hearst (PDF)

The Battle Against Phishing: Dynamic Security Skins, by Rachna Dhamija and J.D. Tygar (PDF)

Hackers' favourite targets: home computers and finance networks (Tech news, September 25, 2006)

Criminals flock to the Internet, survey finds (Reuters, September 25, 2006)

For those of us who used to dial up to get online, the day broadband arrived will always be remembered fondly. Widely available high-speed connections not only made surfing the Web a faster, more pleasant experience, it ushered in a whole new era of Web content and applications. Suddenly you could have videoconferencing, voice over internet protocol (VOIP), music file-sharing, and video blogs.

So imagine what the Web would be like with connections that are 10,000 times faster than those we have today.

Connie Chang-Hasnain, UC Berkeley EECS Professor

"It will totally transform our society," says Connie Chang-Hasnain, the John R. Whinnery Chair Professor of EECS professor at UC Berkeley. "Suddenly everybody is a publisher and everybody can receive movies all the time. Three-dimensional video conferencing could totally transform many ways we do business, medicine, and education."

What will make such things possible is an optical network that is radically different from the one we have today.

"One fiber is enough to carry the entire world's Internet traffic," says UC Berkeley EECS Professor Ming Wu

Telecommunications information is carried from point to point over optical fibers, which have a very high capacity. "One fiber is enough to carry the entire world's Internet traffic," explains Ming Wu, an EECS professor at UC Berkeley. "However, the network traffic is very diverse. Many different kinds of data are being transmitted'some voice, some text'and each of them is going to a different destination," he says.

"The Internet was designed nearly four decades ago to support any applications on any physical layer platforms," says S. J. Ben Yoo, an ECE Professor and CITRIS Campus Director at UC Davis. "The Internet traffic continues to grow explosively today. While the modern multi-wavelength optical networking can now transport such traffic, it remains an extremely challenging task to route and switch such an immense amount of traffic to support demanding new Internet applications," he says.

Routing that data creates bottlenecks, because it must be converted from light to electricity and back to light before it can be sent to the next point along the network. It is a bit like having to change planes several times to get to your destination. Chang-Hasnain, Wu and Yoo are three CITRIS researchers who are developing technology that will eliminate those bottlenecks.

"We need a smarter optical network," says Wu. To that end, he is developing reconfigurable, or tunable, optical Micro Electronic Mechanical Systems (MEMS). Data passing through the network in the form of light would be organized by type and destination into different colors along the spectrum. It is a rough analogy, but think: red for "traffic" going to New York blue for Chicago green for Los Angeles. The MEMS, known as a wavelength selective switch, would detect the color, and a tiny movable mirror on the device would steer it accordingly.

Currently, changes to the optical network'such as adding a node or redirecting "traffic" to accommodate heavy bandwidth use or avoid a failed node'must be made manually. "These new tunable devices will allow the entire process to be controlled electronically or even spontaneously. When a node senses more traffic is coming this way, it will allocate more bandwidth to that channel," says Wu.

Other benefits will include networks automatically sensing the presence of new nodes'no need to log on, as you will be automatically connected'and instant access to larger bandwidth whenever you need it.

"Much of our research is focused on how to shrink the size of those smart functions and implement it on a piece of silicon," says Wu.

Prof. Yoo has recently demonstrated a new type of all-optical router that can switch data at a fraction of a "nano" second, or a billionth of a second. "Today's routers store packets, segment them into cells, switch the cells, and reassemble them into packets again. Our new optical router can pipeline and switch optical packets without storing them simply by changing the lanes or colors of the packets," says Yoo. The resulting optical router has been shown to scale to 42 Petabit per second capacity, or millions of times the switching capacity of today's large routers found in typical buildings. However, when such routers try to scale even larger, there are problems.

"Today's highest-capacity (46 terabit per second) router sold today consumes 1.25 MegaWatts of power, weighs 56 tons, and occupies a footprint of a tennis court. The fact that our optical router technologies are being integrated on a semiconductor chip scales this down to about 100 Watts of power, a half-pound weight, and the size of a lightbulb, while providing the switching capacity of 46 times the entire traffic in the United States today. This technology will completely change the way we run our data centers, healthcare centers, and entertainment businesses. It will completely transform the Internet," says Yoo.

Chang-Hasnain hopes to speed up the optical network ironically by slowing it down. "Traditionally an optical signal propagates at the speed of light. It can't be slowed down. We're looking into a method of slowing it down significantly," she says.

Just as memory buffers allow you to watch a video online without having to download it first, or a roundabout enables cars to pass through an intersection without stopping, Chang-Hasnain's semiconductor optoelectronics would bend light as it passed through routers so that it could sorted without having to be converted to electricity and back into light again.

"We actually have made huge progress in demonstrating some of these concepts already," she says. Most recently, her team built a device that delays a picosecond pulse by 2.5 times its bandwidth at room temperature.

Chang-Hasnain is also working on creating nanowire lasers to replace semiconductor lasers. By reducing the volume of light, nanowire lasers would decrease the power needed to move it through the optical network, and the time it takes to do so.

S. J. Ben Yoo, UC Davis CITRIS Director

In January, the Defense Advanced Research Projects Agency (DARPA) awarded researchers at UC Davis and MIT a grant for $9.5 million over three and a half years to fund work on new high-speed devices for optical networking. Yoo's research is aimed at designing and building thumbnail-sized chips that can encode data at rates 10,000 times faster than current ones. "This brings an exciting opportunity for us to integrate functional optical signal processing units onto a single piece of semiconductor chip. Ultrawide-band (100 THz) signal processors, synthesizers, and arbitrary waveform generation for a next generation optical networking can be enabled by using this optical chip."

"When we first started back in 2001, you could count maybe a handful of people, mostly physicists, who were working in this field," says Chang-Hasnain. "Last year, we co-chaired with the Optical Society of America (OSA) the first slow and fast light conference, we anticipated maybe 50 people. It sold out, about 120 seats, and we had to cut registration one day before it closed."

Clearly, it is an exciting time in an exciting field, in which results are expected sooner than later.

"In about five years, our network will look very different from today's network'a lot smarter and a lot more flexible," says Wu<!-- InstanceEndEditable -->

 

For more information:

<!-- InstanceBeginEditable name="Feature2Links" -->

Connie Chang-Hasnain's Web site

Ming Wu's Web site

CCHG Optoelectronics group

S. J. Ben Yoo's Web site

$9.5 Million Grant for Ultrafast Optical Communications (UC Davis news release, January 18, 2006)