Steven J. Murdoch

I am a researcher in the Security Group of the University of Cambridge, based in the Computer Laboratory and a member of the OpenNet Initiative.

Some of my writings can be found on the Security Group blog: Light Blue Touchpaper.

In my spare time, I also enjoy photography. You may be interested in my photo collection.

My research interests include:

• Side-channels, covert channels, watermarking and steganography
• Operating system and network security
• Data collection and visualisation techniques
• Software engineering, maintainability and reverse-engineering
• Cryptography and security protocols
• Distributed databases, filesystems and versioning
• Smartcards and financial security
• Privacy, anonymity and traffic analysis
• Structured information formats (XML, SGML, LDAP, etc.) and markup languages
• Physical security and optical document security

Chip & PIN relay attack

For further information on the Chip & PIN relay attack, as featured on Watchdog, please see this press release and our summary of the attack.

News and Updates

27 Dec 2006
The slides from my talk – “Detecting temperature through clock skew”, presented at the 23rd Chaos Communication Congress, are now online. This presentation is based on the paper “Hot or Not: Revealing Hidden Services by their Clock Skew”, for which I wrote some software to perform remote clock skew analysis. The source code for these tools is now available.

21 Dec 2006
The slides from my talk – “Out of Character: Are the Chinese Creating a Second Internet?” are now online. They are from a presentation I gave at a workshop of the Inter-Disciplinary China Studies Forum, held in the University of Cambridge.

19 Dec 2006
Links added to conferences I am on the program committee for: PET 2007 and ACM CCS 2007.

13 Dec 2006
The slides from my talk – “Censorship resistant technologies” – are now online. They are from a presentation I gave at the Horizon Seminar: Risk, Threat & Detection, held in the University of Cambridge.

Professional activities

Program committee member on:

PET 2007

7th Workshop on Privacy Enhancing Technologies, held in Ottawa, Canada, 20–22 June 2007. See the CFP for further details (the submission deadline is 23 February 2007).

ACM CCS 2007

14th ACM Conference on Computer and Communications Security, held in Alexandria, VA, USA, 29 October–2 November 2007. See the CFP for further details (the submission deadline is 1 May 2007).

SAC 2007 (computer security track)

Computer security track of the 22nd ACM Symposium on Applied Computing, held in Seoul, Korea, 11–15 March 2007. See the CFP for further details (the submission deadline has passed).

Previous professional activities

• Program committee member, Workshop on Privacy in the Electronic Society (WPES), Alexandria, VA, USA, 30 October 2006, co-located with ACM Computer and Communication Security (CCS).

Projects

Publication quality graphics

I am interested in improving the explanatory power and typographical quality of graphical representations of data in papers I write. To this end, I have written some functions for GNU R to produce data-rich graphs, based on ideas presented by Edward Tufte in his book, The Visual Display of Quantitative Information.

iButtons

In the course of a different research project, I have worked with Dallas iButtons. I dismantled two of them, and while these are sensors, not designed to have any significant security properties, the photos may still be of interest.

Chip and PIN

Along with colleagues from the Security Group, I have been investigating security aspects of the recent Chip and PIN deployment. Our initial comments are summarised in Chip and Spin. Since that document was published, we have been looking at issues in PIN distribution and, in particular, the tamper-evidence of laser-printed PIN mailers. Our Laser-printed PIN Mailer Vulnerability Report describes some problems we found. This document was distributed to users and manufacturers of tamper-evident mailers in November 2004 and since then they have been working to deploy improved products. As of August 2005 this report is now publicly available.

Our work on "snooping" the account number and PIN over the communication between card and terminal was featured in a program on ARD TV's Plusminus, by Sabina Wolf and on ITN news by Chris Choi. There is further information about this work on our interceptor page.

Project Dendros

I have been working on the representation of Compounds in Project Dendros and also the API through which the framework will be exposed to programmers.

Software detection of currency

Recent printers, scanners and image manipulation software identify images of currency, will not process the image and display an error message linking to www.rulesforuse.org. The detection algorithm is not disclosed, however it is possible to test sample images as to whether they are identified as currency. This webpage shows an initial analysis of the algorithm's properties, based on results from the automated generation and testing of images.

General-purpose data-representation formats and markup languages

In order to allow information to be easily exchanged a data format must exist, which facilitates sharing between different applications and different geographical locations throughout the evolution of both the data schema and software. There are a great number of existing solutions for this problem, each making different trade-offs and so resulting in radically different approaches. As a first step in exploring this area I have compiled a growing survey of general-purpose data-representation formats and markup languages.

Symbian OS programming

I have done some work on developing software for the Symbian OS, in particular on the Sony Ericsson P800. As part of that work I have written a brief "getting started" guide for developing Symbian OS applications on Windows using GCC.

Sun Ray 1

The Sun Ray 1 is a stateless thin client produced by Sun. I have briefly looked at the protocol used and produced some notes on the Sun Ray protocol.

Publications

• Hot or Not: Revealing Hidden Services by their Clock Skew
  Steven J. Murdoch
  Location-hidden services, as offered by anonymity systems such as Tor, allow servers to be operated under a pseudonym. As Tor is an overlay network, servers hosting hidden services are accessible both directly and over the anonymous channel. Traffic patterns through one channel have observable effects on the other, thus allowing a service's pseudonymous identity and IP address to be linked. One proposed solution to this vulnerability is for Tor nodes to provide fixed quality of service to each connection, regardless of other traffic, thus reducing capacity but resisting such interference attacks. However, even if each connection does not influence the others, total throughput would still affect the load on the CPU, and thus its heat output. Unfortunately for anonymity, the result of temperature on clock skew can be remotely detected through observing timestamps. This attack works because existing abstract models of anonymity-network nodes do not take into account the inevitable imperfections of the hardware they run on. Furthermore, we suggest the same technique could be exploited as a classical covert channel and can even provide geolocation.
  13th ACM Conference on Computer and Communications Security (CCS), Alexandria, Virginia, USA, 30 October–3 November 2006. [ paper (PDF 1.5M) | slides (PDF 5.2M) | code ]
  Also presented at NoVA Sec, 2 November 2006.
• Ignoring the Great Firewall of China
  Richard Clayton, Steven J. Murdoch, Robert N. M. Watson
  The so-called "Great Firewall of China" operates, in part, by inspecting TCP packets for keywords that are to be blocked. If the keyword is present, TCP reset packets (viz: with the RST flag set) are sent to both endpoints of the connection, which then close. However, because the original packets are passed through the firewall unscathed, if the endpoints completely ignore the firewall's resets, then the connection will proceed unhindered. Once one connection has been blocked, the firewall makes further easy-to-evade attempts to block further connections from the same machine. This latter behaviour can be leveraged into a denial-of-service attack on third-party machines.
  6th Workshop on Privacy Enhancing Technologies, Cambridge, England, 28–30 June 2006. [ paper (PDF 267K) ]
  Published in LNCS 4258, Springer-Verlag.
• Message Splitting Against the Partial Adversary
  Andrei Serjantov, Steven J. Murdoch
  We review threat models used in the evaluation of anonymity systems' vulnerability to traffic analysis. We then suggest that, under the partial adversary model, if multiple packets have to be sent through these systems, more anonymity can be achieved if senders route the packets via different paths. This is in contrast to the normal technique of using the same path for them all. We comment on the implications of this for message-based and connection-based anonymity systems. We then proceed to examine the only remaining traffic analysis attack -- one which considers the entire system as a black box. We show that it is more difficult to execute than the literature suggests, and attempt to empirically estimate the parameters of the Mixmaster and the Mixminion systems needed in order to successfully execute the attack.
  5th Workshop on Privacy Enhancing Technologies, Dubrovnik (Cavtat), Croatia, 30 May–1 June 2005. [ paper (PDF 639K) | data ]
  Published in LNCS 3856, Springer-Verlag.
• Embedding Covert Channels into TCP/IP
  Steven J. Murdoch, Stephen Lewis
  It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naïve embedding. Finally, we describe reversible transforms that map block cipher output into TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden in such a way that an attacker cannot demonstrate its existence without knowledge of a secret key.
  7th Information Hiding Workshop, Barcelona, Catalonia (Spain), 6–8 June 2005. [ paper (PDF 262K) ]
  Published in LNCS 3727, Springer-Verlag.
• Low-Cost Traffic Analysis of Tor
  Steven J. Murdoch, George Danezis
  Tor is the second generation Onion Router, supporting the anonymous transport of TCP streams over the Internet. Its low latency makes it very suitable for common tasks, such as web browsing, but insecure against traffic analysis attacks by a global passive adversary. We present new traffic analysis techniques that allow adversaries with only a partial view of the network to infer which nodes are being used to relay the anonymous streams and therefore greatly reduce the anonymity provided by Tor. Furthermore, we show that otherwise unrelated streams can be linked back to the same initiator. Our attack is feasible for the adversary anticipated by the Tor designers. Our theoretical attacks are backed up by experiments performed on the deployed, albeit experimental, Tor network. Our techniques should also be applicable to any low latency anonymous network. These attacks highlight the relationship between the field of traffic analysis and more traditional computer security issues, such as covert channel analysis. Our research also highlights that the inability to directly observe network links does not prevent an attacker from performing traffic analysis: the adversary can use the anonymising network as an oracle to infer the traffic load on remote nodes in order to perform traffic analysis.
  2005 IEEE Symposium on Security and Privacy, Oakland, California, USA, May 8 – 11, 2005. [ paper (PDF 364K) | code ]
  Nominated for the 2006 PET workshop award for outstanding Research in Privacy Enhancing Technologies.
• Unwrapping the Chrysalis
  Mike Bond, Daniel Cvrcek, Steven J.Murdoch
  We describe our experiences reverse engineering the Chrysalis-ITS Luna CA3 a PKCS#11 compliant cryptographic token. Emissions analysis and security API attacks are viewed by many to be simpler and more efficient than a direct attack on an HSM. But how difficult is it to actually "go in the front door"? We describe how we unpicked the CA3 internal architecture and abused its low-level API to impersonate a CA3 token in its cloning protocol – and extract PKCS#11 private keys in the clear. We quantify the effort involved in developing and applying the skills necessary for such a reverse-engineering attack. In the process, we discover that the Luna CA3 has far more undocumented code and functionality than is revealed to the end-user.
  Technical Report UCAM-CL-TR-592, University of Cambridge, Computer Laboratory, June 2004. [ paper (PDF 344K) | source code (85K) ]
  Also published in Czech as Bezpen hardware, kter nen zase tak bezpe in Data Security Management Rok 8, Cislo 5/2004, strany 44–47 and Reverse-engineering kryptografickho modulu in Crypto-World Rok 6, Cislo 9/2004, strany 8–14.
• Covert Channels for Collusion in Online Computer Games
  Steven J. Murdoch, Piotr Zielinski
  Collusion between partners in Contract Bridge is an oft-used example in cryptography papers and an interesting topic for the development of covert channels. In this paper, a different type of collusion is discussed, where the parties colluding are not part of one team, but instead are multiple independent players, acting together in order to achieve a result that none of them are capable of achieving by themselves. Potential advantages and defences against collusion are discussed. Techniques designed for low-probability-of-intercept spread spectrum radio and multilevel secure systems are also applied in developing covert channels suitable for use in games. An example is given where these techniques were successfully applied in practice, in order to win an online programming competition. Finally, suggestions for further work are explored, including exploiting similarities between competition design and the optimisation of voting systems.
  6th Information Hiding Workshop, Toronto, Ontario, Canada, 23–25 May 2004. [ paper (PDF 178K) | slides (PDF 477K) ]
  Published in LNCS 3200, Springer-Verlag.
• Compounds: a Next-Generation Hierarchical Data Model
  Markus G. Kuhn, Steven J. Murdoch, Piotr Zielinski
  Compounds provide a simple, flexible, hierarchical data model that unifies the advantages of XML and file systems. We originally designed it for Project Dendros, our distributed, revision-controlled storage system that aims to fully separate the control over data from its storage location. Compounds also provide an excellent extensible and general-purpose data format. A processing framework based on stackable filters allowed us to add rich functionality in a highly modular manner, including access control, compression, encryption, serialization, querying, transformation, remote access, and revision control.
  Microsoft Research Academic Days, Dublin, Ireland, 13–16 April 2004. [ poster (PDF 185K) ]

Talks

• Detecting temperature through clock skew – Hot or Not: Defeating anonymity by monitoring clock skew to remotely detect the temperature of a PC
  Steven J. Murdoch
  The end of my 22C3 talk showed how a side effect of TCP/IP steganography detection was to precisely measure the error of a computers system clock (skew). This talk will review and expand on that material, showing the various other mechanisms for monitoring clock skew and discussing the tradeoffs involved. Because every computer has a unique clock skew, even ones of the same model, this acts as a fingerprint. Even if that computer moves location and changes ISP, it can be later identified through this clock skew. In addition to varying between computers, clock skew also changes depending on temperature. Thus a remote attacker, monitoring timestamps, can make an estimate of a computers environment, which has wide-scale implications on security and privacy. Through measuring day length and time-zone, the location of a computer could be estimated, which is a particular concern with anonymity networks and VPNs. Local temperature changes caused by air-conditioning or movements of people can identify whether two machines are in the location, or even are virtual machines on one server. The temperature of a computer can also be influenced by CPU load, so opening up a low-bandwidth covert channel. This could be used by processes which are prohibited from communicating for confidentiality reasons and because this is a physical covert channel, it can even cross "air-gap" security boundaries. The talk will demonstrate how to use this channel to attack the hidden service feature offered by the Tor anonymity system. Here, an attacker can repeatedly access a hidden service, increasing CPU load and inducing a temperature change. This will affect clock skew, which the attacker can monitor on all candidate Tor servers. When there is a match between the load pattern and the clock skew, the attacker has linked the real IP address of a hidden server to its pseudonym, violating the anonymity properties Tor is designed to provide. The talk will also present a separate illustration of the temperature covert channel technique, investigating a suspected attack on the Tor network in August 2006, by a well equipped adversary.
  23rd Chaos Communication Congress, Berlin, Germany, 27–30 December 2006. [ slides (PDF 5.6M) | code | related paper (PDF 1.5M) ]
• Censorship resistant technologies
  Steven J. Murdoch
  A growing number of countries and non-state entities are deploying mechanisms to block content and services on the Internet. Motivations include maintaining moral values and public order, reducing political dissent, constraining freedom of expression and practice of religion, as well as enforcing compliance with local laws. This talk will describe the systems which implement such blocking, both technological and social. It will then look at censorship circumvention methods, the effectiveness of these techniques, and future directions for research.
  Horizon seminar: Risk, Threat & Detection, Cambridge, UK, 5 December 2006. [ slides (PDF 1.9M) ]
• Out of Character: Are the Chinese Creating a Second Internet?
  Steven J. Murdoch
  In February 2006, China announced that they had added three new Chinese script top level domains (TLDs) augment the existing country code (e.g. .uk, .cn) and global (e.g. .com, .org) TLDs. Not only was this the first deployment of internationalised TLDs, but China also bypassed the conventional, but much criticised, international agreement process. This talk will describe the organisational structure of the domain name system (DNS), how the Chinese additions fit into this and discuss their potential impact.
  Inter-Disciplinary China Studies Forum workshop: China in the UK, Cambridge, UK, 24 June 2006. [ slides (PDF 334K) ]
• Covert channels in TCP/IP: attack and defence
  Steven J. Murdoch, Stephen Lewis
  This talk shows how idiosyncrasies in TCP/IP implementations can be used to reveal the use of several steganography schemes, and how they can be fixed. The analysis can even be extended to remotely identify the physical machine being used, through extracting clock skew.
  22nd Chaos Communication Congress, Berlin, Germany, 27 – 30 December 2005. [ slides (PDF 878K) | related paper (PDF 262K) ]
• The Convergence of Anti-Counterfeiting and Computer Security
  Steven J. Murdoch, Ben Laurie
  This talk examines the similarities between computer security and optical document security. Also we describe our work on reverse engineering anti-counterfeiting measures, included in much modern graphics software, and discuss its impact on Open Source.
  21st Chaos Communication Congress, Berlin, Germany, 27 – 29 December 2004. Also presented at the Security Group Seminar, Computer Laboratory, University of Cambridge, 15 February 2005. [ slides (PDF 1.4M) ]
• Hidden Data in Internet Published Documents
  Steven J. Murdoch, Maximillian Dornseif
  Many files are being published on the Internet which hold unexpected (and potentially embarrassing) data. We examine different cases of hidden data in file formats (including Word, PDF and JPEG) and show examples of these from a crawl of the Internet.
  21st Chaos Communication Congress, Berlin, Germany, 27 – 29 December 2004 [ slides, source code and demonstration ]
• Software Detection of Currency
  Steven J. Murdoch
  This talk was presented at the rump session of the 2004 Information Hiding Workshop on some initial results from my experiments with the currency detection feature in recent printers, scanners and image manipulation software.
  6th Information Hiding Workshop, Toronto, Ontario, Canada 23–25 May 2004. [ slides (PDF 1.4M) ]
• Collusion in Online Competitions Using Covert Channels
  Steven J. Murdoch
  How collusion in games can be achieved when no conventional communication channel exists and what implications collusion can have on a player's rankings. Also how these techniques were successfully applied in a real life Connect-4 programming competition.
  Inference Group meeting, Cavendish Laboratory, University of Cambridge, 2 July 2003. [ slides (PDF 267K) ]
• Security-Enhanced Linux (SE Linux)
  Steven J. Murdoch
  Introduction to SE Linux, its policy structure, architecture and an example of how it can reduce the impact of security bugs.
  See the SE Linux homepage for downloads and more information. Also the talk by Russell Coker on SE Linux which was given at the Computer Laboratory (abstract) may be of interest.
  Security Group meeting, Computer Laboratory, University of Cambridge, 29 November 2002. [ slides (PDF 79K) ]
  

Miscellaneous

• OpenID protocol diagram
  Steven J. Murdoch
  I found that the OpenID specifications did not give a clear overview of the protocol message flow. So I produced a protocol diagram, which summarises the roles of the various parties, messages sent between them and their important components. Not all details are covered, and only the normal protocol traces are considered so it certainly should not be considered as an alternative to the specification, but I hope it will provide some clarification.
  [ protocol diagram (PDF 68K) ]

Contact Details

email (preferred):

post:

phone:

mobile:

fax:

Last modified $Date: 2007-01-18 17:07:04 +0000 (Thu, 18 Jan 2007) $