Dr Steven J. Murdoch
I am a Principal Research Fellow in the Information Security Research Group of the Department of Computer Science at University College London. I am also a bye-fellow of Christ's College, Security Architect at the VASCO Innovation Center, Cambridge, and a member of the Tor Project.
Open positions
PhD studentship in Privacy Preserving Continuous Authentication: funded studentship for an EU or UK student. Based in the Information Security Group at University College London, in collaboration with VASCO Data Security. Closing Date: 22 Aug 2016.
Recent publications
For more details see my full list of publications or my Google Scholar page
- Adblocking and Counter-Blocking: A Slice of the Arms Race
Rishab Nithyanand, Sheharbano Khattak, Narseo Vallina-Rodriguez, Mobin Javed, Marjan Falahrastegar, Julia E. Powles, Emiliano De Cristofaro, Hamed Haddadi, Steven J. Murdoch
Adblocking tools like Adblock Plus continue to rise in popularity, potentially threatening the dynamics of advertising revenue streams. In response, a number of publishers have ramped up efforts to develop and deploy mechanisms for detecting and/or counter-blocking adblockers (which we refer to as anti-adblockers), effectively escalating the online advertising arms race. In this paper, we develop a scalable approach for identifying third-party services shared across multiple websites and use it to provide a first characterization of anti-adblocking across the Alexa Top-5K websites. We map websites that perform anti-adblocking as well as the entities that provide anti-adblocking scripts. We study the modus operandi of these scripts and their impact on popular adblockers. We find that at least 6.7% of websites in the Alexa Top-5K use anti-adblocking scripts, acquired from 12 distinct entities – some of which have a direct interest in nourishing the online advertising industry.
6th USENIX Workshop on Free and Open Communications on the Internet (FOCI '16), Austin, TX, US, 08 August 2016. [ paper | slides | data ] - A Framework for the Game-theoretic Analysis of Censorship Resistance
Tariq Elahi, John A. Doucette, Hadi Hosseini, Steven J. Murdoch, Ian Goldberg
We present a game-theoretic analysis of optimal solutions for interactions between censors and censorship resistance systems (CRSs) by focusing on the data channel used by the CRS to smuggle clients’ data past the censors. This analysis leverages the inherent errors (false positives and negatives) made by the censor when trying to classify traffic as either non-circumvention traffic or as CRS traffic, as well as the underlying rate of CRS traffic. We identify Nash equilibrium solutions for several simple censorship scenarios and then extend those findings to more complex scenarios where we find that the deployment of a censorship apparatus does not qualitatively change the equilibrium solutions, but rather only affects the amount of traffic a CRS can support before being blocked. By leveraging these findings, we describe a general framework for exploring and identifying optimal strategies for the censorship circumventor, in order to maximize the amount of CRS traffic not blocked by the censor.We use this framework to analyze several scenarios with multiple data-channel protocols used as cover for the CRS. We show that it is possible to gain insights through this framework even without perfect knowledge of the censor’s (secret) values for the parameters in their utility function.
Proceedings on Privacy Enhancing Technologies, Volume 2016, Number 4, pages 83–101. De Gruyter Open, July 2016. (Journal of the 16th Privacy Enhancing Technologies Symposium, Darmstadt, Germany). [ paper | DOI 10.1515/popets-2016-0030 ] - SoK: Making Sense of Censorship Resistance Systems
Sheharbano Khattak, Tariq Elahi, Laurent Simon, Colleen M. Swanson, Steven J. Murdoch, Ian Goldberg
An increasing number of countries implement Internet censorship at different scales and for a variety of reasons. Several censorship resistance systems (CRSs) have emerged to help bypass such blocks. The diversity of the censor’s attack landscape has led to an arms race, leading to a dramatic speed of evolution of CRSs. The inherent complexity of CRSs and the breadth of work in this area makes it hard to contextualize the censor’s capabilities and censorship resistance strategies. To address these challenges, we conducted a comprehensive survey of CRSs – deployed tools as well as those discussed in academic literature – to systematize censorship resistance systems by their threat model and corresponding defenses. To this end, we first sketch a comprehensive attack model to set out the censor’s capabilities, coupled with discussion on the scope of censorship, and the dynamics that influence the censor’s decision. Next, we present an evaluation framework to systematize censorship resistance systems by their security, privacy, performance and deployability properties, and show how these systems map to the attack model. We do this for each of the functional phases that we identify for censorship resistance systems: communication establishment, which involves distribution and retrieval of information necessary for a client to join the censorship resistance system; and conversation, where actual exchange of information takes place. Our evaluation leads us to identify gaps in the literature, question the assumptions at play, and explore possible mitigations.
Proceedings on Privacy Enhancing Technologies, Volume 2016, Number 4, pages 37–61. De Gruyter Open, July 2016. (Journal of the 16th Privacy Enhancing Technologies Symposium, Darmstadt, Germany). [ paper | DOI 10.1515/popets-2016-0028 ]
Recent talks
For more detail see my full list of talks
- Anonymity & Censorship-Free Communication
Steven J. Murdoch
This talk discusses the history of anonymous communication systems, their applications (including censorship resistance), how they are designed, and what cryptographic mechanisms they use. Techniques to measure and quantify the security levels provided by anonymous communication systems are also covered. Finally, challenges faced by such systems are discussed, along with future directions for research.
Invited talk at IFIP Summer School 2016, Karlstad, Sweden, 21–26 August 2016. [ slides | slides (PDF) ] - Banking Security: Attacks & Defences
Steven J. Murdoch
This lecture provides an introduction to payment card and online banking security mechanisms and the fraud techniques which are designed to break or bypass these measures. An overview of the EMV protocol is given, along with an illustration of how skimming attacks and the no-PIN attack exploit protocol weaknesses. The man-in-the-browser attack is outlined, and how transaction authentication is intended to defend against this.
Invited lecture as part of 3F6: Software Engineering, Department of Engineering, University of Cambridge, 03 February 2015. [ slides ] - Anonymous Communications and Tor
Steven J. Murdoch
The history of anonymous communications on the Internet dates back to the early 80's but since then there have been dramatic changes in how anonymous communication systems have been built and how they have been used. In this lecture I will describe some of these key changes, and what has motivated them. These include the web taking over from email as the major means of communications, and users of anonymous communication systems prioritising censorship-resistance over privacy. The growing popularity of anonymous communication systems has also led to commercial and political realities effecting how projects are run and software is designed. In particular, I will discuss how the Tor software has changed, and the Tor project evolved in this environment. I will conclude by summarising what might be the future for anonymous communication systems and how they may have to adapt themselves to changing circumstances.
Invited lecture as part of Part II Security, Cambridge, UK, 30 January 2015. [ slides ]
Current projects
Privacy-preserving Transaction Authentication for Mobile Devices (2016–)
Steven J. Murdoch (PI), Andreas Gutmann (PhD student)
With the rapid accumulation and processing of personal data by numerous organizations, it is of paramount importance to protect people from adverse uses of their data, while allowing them to enjoy the benefits the use of these data can possibly provide. This is the question of protecting citizens’ privacy, while enabling them to make informed decisions regarding their actions with privacy implications. In this project, part of the Privacy & Us Marie Sklodowska-Curie Innovative Training Network and based at VASCO, we will explore techniques for privacy-preserving authentication, then extend these to develop and evaluate innovative solutions for secure and usable authentication that respects user privacy.
This work is supported by the EU Horizon 2020 Marie Sklodowska-Curie Innovative Training Network [grant number project 675730].
Censorship resistance and anonymity (2013–)
Steven J. Murdoch (PI), Sheharbano Khattak (Research Assistant & PhD student)
A growing number of countries are using Internet censorship to control the flow of information available to their population. The technologies being used are also increasing in sophistication, as are tools for circumvention censorship. This project studies tools and techniques used to perform censorship, as well as censorship circumvention technologies, in terms of their effectiveness, security and performance.
Publications
- Do You See What I See? Differential Treatment of Anonymous Users, Network and Distributed System Security Symposium, February 2016
- A Look at the Consequences of Internet Censorship Through an ISP Lens, ACM SIGCOMM conference on Internet measurement (IMC), November 2014
This work is supported by the Engineering and Physical Sciences Research Council [grant number EP/L003406/1].
Previous projects
Graph anonymisation and de-anonymisation (2012–2016)
Steven J. Murdoch (PI), Kumar Sharad (PhD student)
Graph data sets provide a valuable source of data, with examples including communication patterns, relationships on social networks, and genetic data. However sharing such data must be done with care because of its sensitivity and consequent legal and ethical implications for improper use. This project focuses on techniques to measure and quantify the effectiveness of graph anonymisation schemes, in terms of the level of protection they offer and the impact on data accuracy.
Publications
- True Friends Let You Down: Benchmarking Social Graph Anonymization Schemes, Draft, February 2016.
- An Automated Social Graph De-anonymization Technique, Workshop on Privacy in the Electronic Society (WPES), November 2014.
This work was supported by the Engineering and Physical Sciences Research Council [grant number EP/J500665/1]; and Microsoft Research through its PhD Scholarship Programme.
Professional activities
Research supervision
Andreas Gutmann (PhD student, 2016–): privacy-preserving transaction authentication for mobile devices.
Sheharbano Khattak (Research Assistant & PhD student, 2013–): measurement of censorship and censorship resistance systems.
Kumar Sharad (PhD student, 2012–2016): security in social networks – anonymisation and fraud prevention.
Program chair
14th Privacy Enhancing Technologies Symposium, 16–18 July, 2014, Amsterdam, Netherlands.
15th Privacy Enhancing Technologies Symposium, 30 June–2 July 2015, Philadelphia, PA, USA.
General chair
Financial Cryptography and Data Security '11, 15th International Conference, 28 February–4 March 2011, St. Lucia.
Programme committee membership
Network and Distributed System Security Symposium (NDSS): 2017.
Privacy Enhancing Technologies Symposium (PETS): 2007, 2008, 2009, 2011, 2017.
ACM Conference on Computer and Communications Security (CCS): 2007, 2008, 2010, 2011, 2016.
IFIP Summer School 2016.
Financial Cryptography and Data Security (FC): 2010, 2016.
Annual Privacy Forum 2014.
Free and Open Communications on the Internet (FOCI) 2013.
USENIX Security 2012.
European Symposium on Research in Computer Security (ESORICS) 2011.
Workshop on Foundations of Security and Privacy (FCS-PrivMod): 2010.
Workshop on Privacy in the Electronic Society (WPES): 2006, 2007, 2009.
FIDIS/IFIP Internet Security & Privacy Summer School: 2008.
ACM Symposium on Applied Computing (Computer Security track): 2007.
Journal reviewing
Includes IEEE Transactions on Dependable and Secure Computing (2009), ACM Transactions on Information and System Security (2008), IEEE Transactions on Software Engineering (2008), IEEE/ACM Transactions on Networking (2007), IEEE Security & Privacy (2007), The Triple Helix (2008), Identity in the Information Society (2008).
Contact Details
email (preferred):
s.murdoch at ucl.ac.ukOpenPGP public key 0x5E2A64A6 (more details)
post:
Dr Steven J. MurdochComputer Science Department
University College London
Gower Street
London
WC1E 6BT
United Kingdom