N1005 IBM Research: cybersecurity

Would you know if your car was being hacked?

<br /><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; margin-right: 1em; text-align: left;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s1600/yairallouche.jpg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s320/yairallouche.jpg" width="320" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">Yair Allouche, IBM cybersecurity researcher</td></tr></tbody></table><div class="MsoNormal"><i><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Editor’s note: This <span style="font-family: "verdana" , "sans-serif";">article is</span> by Yair Allouche, researcher at IBM’s Cybersecurity Center of Excellence in Beer Sheva, Israel.</span></i></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">When my sister reluctantly upgraded to a smart phone, she was concerned that her location, contacts, personal calendar, and even banking information would be vulnerable to cybercrime. And she was right to be concerned. Most of us made the decision to give up a certain amount of security in exchange for the wondrous and practical applications that we can no longer live without. But how many of us are making that same conscious decision when we buy a new car? </span></div><div class="MsoNormal"></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">IBM cybersecurity researchers in Israel are developing protection for connected cars<span style="font-family: "verdana" , "sans-serif";"> by</span> providing cloud-based intelligence to identify cyberattacks and suspicious activity that can endanger the car or its occupants. By offering car manufacturers a hybrid system that can collect, analyze, and cross-reference massive amounts of data from different vehicles, these researchers are bringing IBM’s security smarts from the data centers to the road<span style="font-family: "verdana" , "sans-serif";">.</span></span><br /><a name="more"></a></div><div class="MsoNormal"><br /><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">What makes cars so vulnerable?</span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Today hackers can get inside your smartphone and steal identities or personal information, access emails, or in extreme cases, hack into our banking apps. This in itself is pretty scary, but so i<span style="font-family: "verdana" , "sans-serif";">s the idea of</span> hackers t<span style="font-family: "verdana" , "sans-serif";">aking</span> over your car’s steering or braking systems. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Cars are now more digital than ever. And with <span style="font-family: "verdana" , "sans-serif";">more than</span> 100 distributed computer systems and 100 million lines of code in a typical car, there are plenty of components that need protection from hackers. Why do cars have 7 times more code than a Boeing 747? This comes primarily from the fact that today’s cars are assembled from different parts rather than manufactured from start to finish in one factory. As a result, the central door-locking mechanism could easily be the same component <span style="font-family: "verdana" , "sans-serif";">across several differ<span style="font-family: "verdana" , "sans-serif";">ent car manufacture<span style="font-family: "verdana" , "sans-serif";">rs</span></span></span>. This is problematic from the point of view of security because it means that any vulnerability breached in one car leaves the others open to hacking.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">A <a href="http://blogs.barrons.com/focusonfunds/2015/09/08/americans-worry-about-falling-victim-to-cyberattacks-more-than-any-other-type-of-crime/" target="_blank">recent study</a> stated that <span style="font-family: "verdana" , "sans-serif";">by</span> 2018, 420 million automobiles will be connected, representing a huge growth over the 45 million connected vehicles in 2013.<i> </i>If the frequency of software threats for the auto industry is similar to that of PCs, the need for a sophisticated system that continuously remains updated becomes critical. By applying the expertise from the IT world to cars, IBM can offer a solution that never stops working and is always updated to deal with new types of attacks. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Int<span style="font-family: "verdana" , "sans-serif";">ra-<span style="font-family: "verdana" , "sans-serif";"> <span style="font-family: "verdana" , "sans-serif";">And Inter-<span style="font-family: "verdana" , "sans-serif";">Vehic<span style="font-family: "verdana" , "sans-serif";">le</span> Se<span style="font-family: "verdana" , "sans-serif";">curity</span></span></span></span></span></span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">At our Cybersecurity Center of Excellence in Beer Sheva, Israel<span style="font-family: "verdana" , "sans-serif";">, my</span> team of researchers decided to take a holistic approach<span style="font-family: "verdana" , "sans-serif";"> to <span style="font-family: "verdana" , "sans-serif";">car sec<span style="font-family: "verdana" , "sans-serif";">urity</span></span></span>. On one hand, we want to protect the car so that hackers can’t take over control<span style="font-family: "verdana" , "sans-serif";"> by</span> changing the car’s speed or direction, or applying <span style="font-family: "verdana" , "sans-serif";">t</span>he brakes, for example. On the other hand, we want to protect the data stored in and sent by the car’s systems. This data is used to send messages if the car was stolen, or if the driver had a heart attack, or simply about its speed and location. If abused by hackers, false data <a href="http://arxiv.org/pdf/1410.0151.pdf" target="_blank">can be injected</a> to create fake traffic jams that reroute vehicles, submit false information to insurance companies for pay<span style="font-family: "verdana" , "sans-serif";">-</span>as<span style="font-family: "verdana" , "sans-serif";">-</span>you<span style="font-family: "verdana" , "sans-serif";">-</span>drive packages, or even <span style="font-family: "verdana" , "sans-serif";">determine if </span>someone is not at home. Each digital component in the car that is connected to an outside system is vulnerable. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Most automotive security systems focus on in<span style="font-family: "verdana" , "sans-serif";">-</span>car security, similar to the way an anti-virus program might work on our home computer. This may include isolating the car’s infotainment and critical drive systems, or even the inter-car connections that are used to prevent accidents. <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">Our research technology</a> goes beyond the level of the individual car. By taking into account all cars' data channels, we can build a system that uses the synergy between the many sources. For example, by collecting and analyzing data from many cars, we can cross reference them to validate that the information coming in is correct. If one car says it’s traveling at 50 kmph and all the other cars near it are traveling 90 kmph then obviously something is not right. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our goal is to offer security visibility by identifying suspicious activity and alerting the drivers or car manufacturers<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"></span></span></span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span></span></span>even without having to install a specific component in the car. Our hybrid solution includes a component that sits in the car, but its intelligence sits in the cloud. This allows us to continuously protect the car and driver, remaining connected at all times and not only when the car goes in for servic<span style="font-family: "verdana" , "sans-serif";">e</span>. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">This new solution also offers more control and transparency over what information is being collected about you from your car. Since the data collected includes information on where your car is every single second of the day, our technology will allow users to access services to help secure the car, but will only use personal identification if the driver agrees to share it.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">By building a protective solution whose architecture allows it to adjust itself to new threats as they arise, we are giving the automotive industry a boost in the right direction. With IBM’s vast amounts of IT security knowledge and assets — alongside new algorithms from Research</span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span> we can offer true protection for connected cars and the data being collected from them. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our next step<span style="font-family: "verdana" , "sans-serif";"> is</span> targeted at bringing the technology to market. We recently demonstrated a prototype solution for securing vehicles at the <a href="https://securityintelligence.com/events/66th-international-motor-show-2015-in-frankfurtmain/" target="_blank">International Motor Show</a> in Frankfurt, Germany.<span style="font-family: "verdana" , "sans-serif";"> Read m<span style="font-family: "verdana" , "sans-serif";">ore about the de<span style="font-family: "verdana" , "sans-serif";">m<span style="font-family: "verdana" , "sans-serif";">o,</span></span></span></span><span style="font-family: "verdana" , "sans-serif";"></span> <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">here</a>.</span></div>

Yair Allouche, IBM cybersecurity researcher Editor’s note: This article is by Yair Allouche, researcher at IBM’s Cybersecurity Center of Ex...

From Discovering Rock Patterns to Detecting Cyber Threats

5:00 AM N1000 0

<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioBqmIl7rky5iKc1mdHh55WJmXN4wyh2e_rST_W_S__bvwqv4elnukC8-BKQQPb7Q4Ms6fumPZpK6NcSkuzxzDPX7X0AwT5FlGbg6X0CQeM4rRwYc2WcooG3WB3pLoVFjQ-U0dvP8Jq5Q/s1600/15854883508_a7a56e9604_z.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioBqmIl7rky5iKc1mdHh55WJmXN4wyh2e_rST_W_S__bvwqv4elnukC8-BKQQPb7Q4Ms6fumPZpK6NcSkuzxzDPX7X0AwT5FlGbg6X0CQeM4rRwYc2WcooG3WB3pLoVFjQ-U0dvP8Jq5Q/s200/15854883508_a7a56e9604_z.jpg" width="133" /></a></div><span id="goog_1904145733"></span><span id="goog_1904145734"></span>IBM scientist <a href="http://researcher.watson.ibm.com/researcher/view.php?person=zurich-mtc">Marc Ph. Stoecklin</a> has always been fascinated by discovering unusual patterns as long as he can remember. Even as a child, during family hikes in the Swiss Alps, he was looking for crystals and special patterns of rocks. <br /><br />An IBMer since 2006, this past summer Marc joined the next wave of IBM millennial managers, and today he leads a team of experts working on cyber security analytics with a particular focus on advanced threat detection and cyber security data visualization. In simple terms, he helps security analysts detect, understand, and counter sophisticated cyber security attacks. <br /><br />“I’ve always enjoyed analyzing data and mining them for unusual changes and deviations from expected behavior," says Marc.<br /><a name="more"></a><br /><br />When traditional security solutions use signature-based detection (knowing what unwanted events to look for, i.e., a strict pattern), Marc’s team looks into how machine learning, data mining, and statistical modeling can be applied to learn the behavior of laptops and mobile devices on the network.<br /><br />“We look for the unknown and unexpected, like an irregular heartbeat. Research in behavioral analytics has become crucial, particularly when it comes to detecting advanced threats and targeted attacks. Attacks which an organization cannot anticipate, nor has adequate protection mechanisms for, simply because they do not know what to expect in advance, and attackers exploit <a href="http://en.wikipedia.org/wiki/Zero-day_attack" target="_blank">zero day</a> vulnerabilities – these attacks were crafted just for this specific organization, and no signature or blacklist will catch them,” Marc said.<br /><br />“The last resort is to be constantly on the watch for any unusual behavior patterns, which reveals the presence of an attacker.”<br /><br />“On top of that, data visualization is very important as the human brain is brilliant at exposing abnormal patterns, but it has to be pre-processed and condensed, especially when there is so much data as in security. Scrolling through lines of a spreadsheet isn’t nearly as effective as looking at a heat map, which is why visual design is so important to our tools,” Marc said.<br /><br /><b>Goodbye Zurich. Hello New York</b>!<br /><br />“I had the opportunity to do my PhD thesis here at IBM Research-Zurich. The IBM lab is really one of the few places in the world where you can join an industrial PhD program. It was a truly great experience both being in an academic program as well as conducting research which had direct industry impact,” Marc says. <br /><br />As a member of IBM's <a href="http://www.zurich.ibm.com/aurora/">AURORA project</a>, Marc and the team created a flow-based network traffic monitoring and visualization system where he was responsible for the design and development of the anomaly detection and user interface components; the system has since been commercialized by other IBM businesses.<br /><br />“It was really a rewarding experience as a young graduate creating software, which was sold to IBM clients worldwide,” Marc said with a proud smile. <br /><br /><div class="separator" style="clear: both; text-align: center;"></div>In 2011 he left Zurich to join the IBM T.J. Watson Research Center in Yorktown Heights, NY. Here, he participated in the development of the IBM Cyber Security Analytics and Intelligence research platform.<br /><br />“I didn’t have any second thoughts moving from Switzerland to New York. Sometimes you have to make decisions when you know this is the right thing to do,” Marc said.<br /><br />He continues, “For me it was a chance to go into a new field and to start exploring something completely different. And I was fortunate that IBM offered me this opportunity.” <br /><br /><b>“A Needle in a Haystack” </b><br /><br />Still collaborating intensively with the scientists in Yorktown Heights, Marc returned to Zurich in 2012 and last summer was promoted to manager of a global team.<br /><br />“It is an absolute pleasure to work with such a talented team. Most of the team members are millennials, all of whom have PhDs in data mining, machine learning or behavioral modeling in areas like big data security analytics and malware analysis. So, we speak the same jargon and relate to each other,” Marc said.<br /><br />Coming from the millennial generation and being “digital natives,” Marc believes his team has an almost innate capability of understanding the minds and strategies of today’s hackers.<br /><br />“You have to think in a multidisciplinary way about how things are connected and how the attacker may capitalize on different attack vectors. If you look at how enterprises and organizations have changed in the recent few years, as they embrace new technologies such as cloud services, mobile -- and employees are allowed use their own devices (BYOD) for business purposes -- the traditional perimeter-based security defense mechanisms become drastically less effective,” Marc said.<br /><br />“Building curtain walls around a castle will not protect crown jewels that get distributed outside the castle.”<br /><br />He continues, “One of the biggest challenges we face is that many of the attacks today are not discovered, and only a small fraction are eventually disclosed to the public. So how can anyone understand the latest trends? This is like looking for the needle in a haystack without even knowing what the needle looks like. There are only a few known examples out there and we need to study them carefully and extrapolate. The methodologies we devise have to be able to catch variants thereof as well as new types of variations.”<br /><br /><b>Looking Forward</b><br /><br />Marc sees a number of interesting technologies over the next five years as being the real breakthroughs in cyber security. <br /><br />“Understanding where the crown jewels are and who accesses them, how, when, and why will be a major focus for the future. This involves contextual models, and adaptive data protection by building fine-grained perimeters around the data, as well as real-time, historical, and predictive behavior monitoring using advanced machine learning analytics, such as techniques used in IBM Watson,” Marc said.<br /><br />Searching for crystals in the Swiss mountains as a young boy Marc could never have dreamed of having such a successful career.<br /><br />Marc had this advice for other young researchers.<br /><br />"Whichever path you take, it is important to be innovative, and constantly questioning the state-of-the art. And most of all: start identifying missing bits, which you should embrace to make a difference"

computer security cybersecurity IBM Research - Zurich From Discovering Rock Patterns to Detecting Cyber Threats

IBM scientist Marc Ph. Stoecklin has always been fascinated by discovering unusual patterns as long as he can remember. Even as a child, du...

From Internship to Professor: Cryptographer Looks Back at the Birth of Identity Mixer

11:47 PM N1000 0

<br /><div style="text-align: right;"></div>IBM researchers today announced <a href="http://ibm.biz/identitymixer">Identity Mixer</a>, a cloud-based technology that holds potential to help consumers better protect online personal data.<br /><br /><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: right; margin-left: 1em; text-align: right;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaBHNztKzWm7NNxx4Ip1XrSZyPtLQMPNMdkWUlRaJawAAldHlUiwn6wT__4WxjQhYG2r4UXeKzbgBKC-Z59oLQkuizLtAvjkg3Dt8fNJYZZVIrDDlvr3ycGF919WD56IKTTed2hmdEn6Ky/s1600/annalysyanskaya.jpg" imageanchor="1" style="clear: right; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaBHNztKzWm7NNxx4Ip1XrSZyPtLQMPNMdkWUlRaJawAAldHlUiwn6wT__4WxjQhYG2r4UXeKzbgBKC-Z59oLQkuizLtAvjkg3Dt8fNJYZZVIrDDlvr3ycGF919WD56IKTTed2hmdEn6Ky/s1600/annalysyanskaya.jpg" width="187" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">Dr. Anna Lysyanskaya</td></tr></tbody></table>The cryptographic algorithm encrypts the certified identity attributes of a user, such as their age, nationality, address and credit card number in a way that allows the user to reveal only selected pieces to third parties. The result, consumers don't lose any data, and businesses don't have to worry about securing it. <i>(<a href="https://idemixdemo.mybluemix.net/">try for yourself</a>)</i><br /><br /><a href="http://cs.brown.edu/people/anna/home.html">Dr. Anna Lysyanskaya</a>, a professor of computer science at Brown University, co-invented the technology with IBM cryptographer <a href="http://asmarterplanet.com/blog/2015/01/protecting-data-using-cloud.html">Dr. Jan Camenisch</a>. The two worked together on Identity Mixer more than a decade ago when Anna was a summer intern at IBM's Zurich Lab, publishing a number of <a href="http://rd.springer.com/chapter/10.1007%2F3-540-44647-8_23?LI=true">seminal papers</a> on anonymous credential systems.<br /><br />Today, on <a href="http://www.staysafeonline.org/data-privacy-day/" target="_blank">Data Privacy Day,</a> we caught up with Anna to look back and to hear about her current research.<br /><a name="more"></a><br /><br /><b>While I know it was some time ago, can you reflect on your internship at IBM Research in Zurich and share how it helped prepare you for your career?</b><br /><div><br /></div><div><i>Anna: I originally wanted to spend  a summer in Zurich because I just wanted to mix it up, to take a summer  break. Little did I know that it would lead to a collaboration with  Jan and a research breakthrough that has been supremely important to my  research career.</i> <b> </b><br /><br /><b>Did you know back then how important privacy would be 10-15 years later?</b></div><div><br /></div><div><i>Anna: Yes, it was pretty  clear to me even back then that, unless we take serious steps to adopt  privacy-protecting technologies, all our activities could easily be  tracked. </i><br /><br /><b>Do you have any anecdotes or stories about when you and Jan were developing the idea for Identity Mixer?</b></div><div><br /></div><div><i>Anna: A  pretty funny one is that we initially thought, towards the end of the  summer in 1999, that anonymous credentials, which would eventually be called Identity Mixer, was a pretty  straightforward idea given the prior work both of us had done. So when I  came back in the summer of 2000, we figured we should work that one out quickly  just to tie loose ends from the previous summer, and then move on to  other, more challenging problems. I guess we are still tying those  loose ends, because we are still working on anonymous credentials.</i> <b> </b><br /><br /><b>Now that we have looked back, what are you currently working on?</b></div><div><br /></div><div><i>Anna: Jan's and my most-recent  collaboration, also with Anja Lehmann and Gregory Neven of IBM Zurich,  is on password-authenticated secret sharing, which we nicknamed the <a href="http://asmarterplanet.com/blog/2014/08/one-password-in-the-cloud-to-protect-them-all.html">Memento Protocol</a>, after the Christopher Nolan film of the same name.</i><br /><br /><i>Here, we considered a  scenario where users' data is backed up by a collection of servers,  chosen by each user in such a way that the user is relatively certain  that they won't all conspire against him or her. We showed that all a human user really needs to remember in this setting is a short  password <span style="font-family: "Calibri",sans-serif; font-size: 11.0pt; line-height: 106%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: ZH-CN;">–</span> the same every time, no need to ever change it </i><i><span style="font-family: "Calibri",sans-serif; font-size: 11.0pt; line-height: 106%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: ZH-CN;">–</span> in order  to gain secure access to his data. This work appeared in the most  recent <a href="https://eprint.iacr.org/2014/429">CRYPTO</a> conference.</i></div><div><i><br /></i></div><div><i>Other things I have  been working on range from non-interactive zero-knowledge proofs, to  physically uncloneable functions to, yes, more anonymous credentials.</i><b> </b><br /><br /><b>What will online privacy look like five years from now?</b></div><div><br /></div><div><i>Anna: Hopefully  we have, with the recent stories of data breaches, reached a point where large corporations understand that  they need to protect the privacy of their data and their users. So this  may lead to better security; whether five years is soon enough is not  clear to me at this point, but I hope so.   </i></div><div><i><br /></i></div><div><i>In  my opinion, a missing ingredient is leadership. I think IBM can show  leadership in educating the industry on what can be done, and how to do  it, and also how not to do it. It is already doing it to a large  extent, and hopefully can do more.  </i></div><div><i><br /></i></div><div><i>Another  missing ingredient is education, and not just for undergraduates, but  also for practitioners. Here at Brown we are working on a Master's  program that will consist of a mix of on-campus and remote learning, and  will teach executives what they need to know about security, privacy,  and related law and policy. We are very excited about this!</i><br /><br />Join Anna, Jan and other experts today, 28 January at 10:00 AM New York (16:00 Paris) for a live Tweet Chat about <a href="https://ibm.biz/BdEQ4g" target="_blank">Identity Mixer</a> and privacy technologies. Use #identitymixer. For details visit <a href="http://ibm.biz/identitymixer" target="_blank">http://ibm.biz/identitymixer<i> </i></a></div>

From Internship to Professor: Cryptographer Looks Back at the Birth of Identity Mixer

cryptography cybersecurity IBM Research - Zurich identity mixer privacy From Internship to Professor: Cryptographer Looks Back at the Birth of Identity Mixer

IBM researchers today announced Identity Mixer , a cloud-based technology that holds potential to help consumers better protect online perso...

Validating a (hack-free) web experience

6:00 AM N1000 0

<div class="MsoNormal"><i style="mso-bidi-font-style: normal;"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Patent verifies information flow downgraders</span></i><i style="mso-bidi-font-style: normal;"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> </span></i><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> </span></div><div class="MsoNormal"><br /><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Hacks, phishing, and other malicious cyberattacks all happen <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">due</span>to bugs in a software program’s code. Because no one can manually check the millions of lines of code behind a mobile app <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">or a website</span>, developers use verification software to check their work. And even then, sometimes <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">the analysis that traditionally trusts that defenses installed by the developer were implemented correctly, </span>misses vulnerabilities.</span><br /><a name="more"></a><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> </span></div><div class="MsoNormal"><br /></div><div align="right"><table align="right" border="1" cellpadding="0" cellspacing="0" class="MsoNormalTable" style="border-collapse: collapse; border: none; margin-left: 6.75pt; margin-right: 6.75pt; mso-border-alt: solid black .25pt; mso-border-insideh: .25pt solid black; mso-border-insidev: .25pt solid black; mso-padding-alt: 0in 5.4pt 0in 5.4pt; mso-table-anchor-horizontal: column; mso-table-anchor-vertical: paragraph; mso-table-layout-alt: fixed; mso-table-left: right; mso-table-lspace: 9.0pt; mso-table-overlap: never; mso-table-rspace: 9.0pt; mso-table-top: .05pt; mso-yfti-tbllook: 1184; width: 216px;"> <tbody><tr style="height: 209.8pt; mso-yfti-firstrow: yes; mso-yfti-irow: 0; mso-yfti-lastrow: yes;">  <td style="border: solid white 1.0pt; height: 209.8pt; mso-border-alt: solid white .5pt; padding: 4.0pt 4.0pt 4.0pt 4.0pt; width: 2.25in;" valign="top" width="216"><div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><b><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">The   patent process</span></b></div><div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><br /><i><span style="color: #595959; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">What I see most often is someone with a great idea, but who   doesn't think of it in terms of a patentable idea. As a Master Inventor, I   want to help my colleagues move those ideas to patents.</span></i><span style="color: #595959; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> – Marco Pistoia</span><span style="color: #595959; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"></span></div><div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><br /><i><span style="color: #595959; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">It’s also about point of view. Many file patents that describe   what they have done. But what’s more valuable is the abstract, creative use   of the idea.</span></i><span style="color: #595959; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> – Omer Tripp</span><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> </span></div></td> </tr></tbody></table></div><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">This is where IBM Master Inventors Omer Tripp, PhD and Marco Pistoia, PhD focused patent #8,635,602: <a href="http://www.google.com/patents/us8635602"><span class="Hyperlink0">Verification of information-flow downgraders</span></a>. Filed in 2010, the invention aims to close the loop on code that – because of poor<span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">ly implemented defenses</span> – compromises sensitive data, such as bank account numbers, and passwords.</span><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"> </span><br /><br /><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">“I would say the patent is more valuable today (it was issued in 2014) because of the explosion in cloud and mobile technologies, which <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">necessitate defenses that are more challenging to implement correctly than ever before.</span>We’re all accessing websites that require sensitive information about ourselves, and sometimes the software asking for that information is vulnerable,” said Omer, who has filed 174 patent applications and been issued 64. In 2012, Omer earned more than 1 percent of IBM’s entire patent total of 6,478.</span><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"></span><br /><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Omer and Marco set out four years ago to verify what software applications claimed to be secure “downgrader” code (the part of a software program that sanitizes <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">or validates</span> untrusted input to a website, or obfuscates and declassifies confidential data before its release). By developing a way to check a website’s information flow downgrader, they found that live, implemented code still had security holes. “Our tool simulates what developers have a hard time testing for, such as ‘double encoded’ input, or other odd combinations of validation routines,” said Marco, who has 148 patent filings and 72 patent issuances to his name. </span> </div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIlZl1qZIqqUM51VWLNwmKD5PDbYw8pb4GZLSp816JVoiEs05pQovCI9onTKhfiMjNzlkWkMOSulfD5-Ok24sF6TZ4xdtc6xFODHL-s-lekU2Jh0Bwl794pAA2wI8OLaEG5_RE2h8ff07M/s1600/patent_art.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIlZl1qZIqqUM51VWLNwmKD5PDbYw8pb4GZLSp816JVoiEs05pQovCI9onTKhfiMjNzlkWkMOSulfD5-Ok24sF6TZ4xdtc6xFODHL-s-lekU2Jh0Bwl794pAA2wI8OLaEG5_RE2h8ff07M/s1600/patent_art.jpg" /></a></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"></span></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"></span></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"></span><span style="font-size: x-small;"><i style="mso-bidi-font-style: normal;"><span style="font-family: "Verdana",sans-serif; line-height: 107%;">Their ISSTA 2011 paper, <a href="http://researcher.ibm.com/researcher/files/us-otripp/issta11-1.pdf"><span style="mso-bidi-font-style: italic;">Path-and index-sensitive string analysis based on monadic second-order logic</span></a> demonstrated vulnerabilities on several open source websites, earning ACM SIGSOFT’s Distinguished Paper Award.</span></i><b style="mso-bidi-font-weight: normal;"><span style="font-family: "Verdana",sans-serif; line-height: 107%;"> </span></b></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"></div><b><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Trust <i>and</i> verify</span></b><br /><div class="MsoNormal"></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Downgraders take input that’s not trusted, like erroneous details entered into a website login form, and help make it trusted. They sanitize the information <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">by getting rid of certain unintended, and potentially malicious, characters and substrings.</span> But they can be tricked by <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">recursive nesting of the payload, and other clever tricks</span>. The invention detects when a downgrader incorrectly allows (or rejects) accurate input – and can be integrated into <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">standard</span> analysis tools.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">"Developers do validate that their software works as it should. But what’s often left unchecked are the inputs to the software – how the average person checks Twitter, or applies for a bank account,” Marco said. “We can now analyze those inputs to make sure the defenses a developer puts in place work, or alternatively, <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">have</span> errors.”</span> <span style="color: black; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: Calibri; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"> </span><br /><br /><span style="color: black; font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: Calibri; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;">“Now, we want to connect this invention with others we’re working on in this area, namely tools that automatically fix<i style="mso-bidi-font-style: normal;"> <span style="mso-bidi-font-style: italic; mso-bidi-font-weight: bold;">broken defenses</span>.</i> This would help developers check their code, and their downgraders,” Omer said.</span></div><div class="MsoNormal"><br /><b><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;">More about IBM's 2014 patent leadership</span></b></div><div class="MsoNormal"><ul><li><a href="http://www.ibm.com/press/us/en/pressrelease/45793.wss" target="_blank"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">IBM sets patent record</span></a></li><li><a href="http://ibmresearchnews.blogspot.com/2015/01/turning-mobile-security-upside-down.html" target="_blank"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Turning mobile security upside down</span></a></li><li><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"><a href="http://ibmresearchnews.blogspot.com/2015/01/patent-powers-cleaner-commute.html" target="_blank"><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;">Patent powers a cleaner commute</span></a> </span></li><li><span style="font-family: "Verdana",sans-serif; font-size: 13.0pt; line-height: 107%;"><a href="http://ibm.co/1yGZ5YR" target="_blank">A new generation of young inventors</a></span></li></ul></div></div>

cybersecurity invention mobile patent verification Validating a (hack-free) web experience

Patent verifies information flow downgraders Hacks, phishing, and other malicious cyberattacks all happen due to bugs in a software progr...