DOCSLIB.ORG

Proceedings of the 28Th USENIX Security Symposium

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Proceedings of the 28Th USENIX Security Symposium USENIX Association Proceedings of the 28th USENIX Security Symposium August 14–16, 2019 Santa Clara, CA, USA Conference Organizers Program Co-Chairs Daniel Gruss, Graz University of Technology Nadia Heninger, University of Pennsylvania Joseph Lorenzo Hall, Center for Democracy & Technology Patrick Traynor, University of Florida Xiali (Sharon) Hei, University of Louisiana at Lafayette Thorsten Holz, Ruhr-University Bochum Program Committee The Pennsylvania State University Yasemin Acar, Leibniz University Hannover Trent Jaeger, U.S. Naval Research Laboratory Sadia Afroz, University of California, Berkeley/ Rob Jansen, International Computer Science Institute Mobin Javed, Lahore University of Management Sciences Devdatta Akhawe, Dropbox Chris Kanich, University of Illinois at Chicago Johanna Amann, International Computer Science Institute Vasileios Kemerlis, Brown University Adam Aviv, United States Naval Academy Yongdae Kim, Korea Advanced Institute of Science and Technology (KAIST) Michael Bailey, University of Illinois at Urbana–Champaign Google Adam Bates, University of Illinois at Urbana–Champaign Lea Kissner, University of Washington Vincent Bindschaedler, University of Florida Yoshi Kohno, University of California, San Diego Joseph Bonneau, New York University Farinaz Koushanfar, CISPA Helmholtz Center i.G. Nikita Borisov, University of Illinois at Urbana–Champaign Katharina Krombholz, Google Sven Bugiel, CISPA Helmholtz Center i.G. Ben Laurie, Google Kevin Butler, University of Florida Tancrède Lepoint, Technische Universität Wien Joe Calandrino, Federal Trade Commission Martina Lindorfer, Salesforce Stefano Calzavara, Università Ca’ Foscari Venezia Allison Mankin, Oxford University Yinzhi Cao, Johns Hopkins University Ivan Martinovic, University of Minnesota Srdjan Capkun, ETH Zurich Stephen McCamant, Google Lorenzo Cavallaro, King’s College London Jon McCune, The Pennsylvania State University Stephen Checkoway, Oberlin College Patrick McDaniel, University College London Bill Cheswick, AT&T Labs—Research Sarah Meiklejohn, USC/Information Sciences Institute Marshini Chetty, Princeton University Jelena Mirkovic, Princeton University Mihai Christodorescu, VISA Research Prateek Mittal, Utrecht University Erinn Clark, First Look Media Veelasha Moonsamy, College of William & Mary George Danezis, University College London Adwait Nadkarni, Ben-Gurion University of the Negev Nathan Dautenhahn, Rice University Yossi Oren, The Pennsylvania State University Roger Dingledine, The Tor Project Nicolas Papernot, Royal Holloway Adam Doupe, Arizona State University Kenny Paterson, École Polytechnique Fédérale de Lausanne Thomas Dullien, Google Mathias Payer, (EPFL) Zakir Durumeric, Stanford University Giancarlo Pellegrino, Stanford University Manuel Egele, Boston University Christina Pöpper, New York University Abu Dhabi William Enck, North Carolina State University Brad Reaves, North Carolina State University Roya Ensafi, University of Michigan Elissa Redmiles, University of Maryland David Evans, University of Virginia Konrad Rieck, Technische Universität Braunschweig Sascha Fahl, Leibniz University Hannover Tom Ristenpart, Cornell Tech Giulia Fanti, Carnegie Mellon University Tom Ritter, Mozilla Nick Feamster, Princeton University Franziska Roesner, University of Washington Adrienne Porter Felt, Google Ahmad-Reza Sadeghi, Technische Universität Darmstadt Earlence Fernandes, University of Washington Prateek Saxena, National University of Singapore David Freeman, Facebook Nolen Scaife, University of Florida Daniel Genkin, University of Michigan Wendy Seltzer, W3C/Massachusetts Institute of Technology Neil Gong, Iowa State University Micah Sherr, Georgetown University Matthew Green, Johns Hopkins Information Security Institute Deian Stefan, University of California, San Diego CISPA Helmholtz Center i.G. Rachel Greenstadt, Drexel University Ben Stock, Gianluca Stringhini, Boston University Dave ‘Jing’ Tian, University of Florida Poster Session Chair Luke Valenta, University of Pennsylvania Brad Reaves, North Carolina State University Ingrid Verbauwhede, Katholieke Universiteit Leuven Test of Time Awards Committee David Wagner, University of California, Berkeley Matt Blaze, University of Pennsylvania Byron Williams, University of Florida Dan Boneh, Stanford University Eric Wustrow, University of Colorado Boulder Kevin Fu, University of Michigan Wenyuan Xu, Zhejiang University Fabian Monrose, The University of North Carolina at Yuval Yarom, University of Adelaide and Data61 Chapel Hill Tuba Yavuz, University of Florida Daniel Zappala, Brigham Young University Steering Committee Mary Ellen Zurko, MIT Lincoln Laboratory Matt Blaze, University of Pennsylvania Dan Boneh, Stanford University Invited Talks Chair William Enck, North Carolina State University Devdatta Akhawe, Dropbox Kevin Fu, University of Michigan Invited Talks Committee Casey Henderson, USENIX Association Alex Gantman, Qualcomm Thorsten Holz, Ruhr-Universität Bochum Giancarlo Pellegrino, Stanford University Jaeyeon Jung, Samsung Electronics Elissa Redmiles, University of Maryland Engin Kirda, Northeastern University Tadayoshi Kohno, University of Washington Lightning Talks Chair Adrienne Porter Felt, Google Christina Garman, Purdue University Thomas Ristenpart, Cornell Tech David Wagner, University of California, Berkeley External Reviewers Hadi Abdullah Joel Frank Sebastian Lauer Will Scott Bander Alsulami Vanessa Frost Kevin Liao Karn Seth Cornelius Aschermann Ankit Gangwal Moritz Lipp Hovav Shacham Teodora Baluta Peng Gao Alwin Maier Rich Shay Gabrielle Beck Washington Garcia Patrick McCorry Shiqi Shen Logan Blue Jordy Gennissen Robert Merget Tom Shrimpton Nicole Borrelli Lukas Giner Muhammad Shujaat Mirza Camelia Simoiu Sam Bretheim Steve Gomez Rafael Misoczki Douglas Stebila Marcus Brinkmann Martin Grothe Vladislav Mladenov Mohammad Taha Khan Claudio Canella Muhammad Haris Ivica Nikolic Kejsi Take Benton Case Mughees Liang Niu Dennis Tatang Berkay Celik Marcella Hastings Aleatha Parker-Wood Aaron Tomb Alishah Chator Grant Hernandez Paul Pearce Mathy Vanhoef Rahul Chatterjee Grant Ho Feargus Pendlebury Luis Vargas Qingrong Chen Stefan Hoffmann Mike Perry Liang Wang Joseph Choi Liz Izhikevich Fabio Pierazzi Alexander Warnicke David Clayton Sakshi Jain Ania Piotrowska Christian Wressnegger Shaanan Cohney Tyler Kaczmarek Erwin Quiring Karl Wüst Edwin Dauber George Kappos Sanjeev Reddy Xiaojun Xu Giulio De Pasquale Gabrielle Kaptchuk Paul Rösler Nian Xue Sergi Delgado Segura Katarina Kohls David Rupprecht Haaroon Yousaf Henri Maxime Demoulin Aashish Kolluri M. Sadegh Riazi Pinghai Yuan Brian Desnoyers Georg Koppen Theodor Schnitzler Yupeng Zhang Karim Eldefrawy Ben Kreuter Ser gej Schu mi lo Maximilian Zinkus Evan Evtimov Deepak Kumar Roei Schuster Dennis Felsch Daniele Lain Michael Schwarz.
Load more

Recommended publications
  • Crypto Wars of the 1990S
    Danielle Kehl, Andi Wilson, and Kevin Bankston DOOMED TO REPEAT HISTORY? LESSONS FROM THE CRYPTO WARS OF THE 1990S CYBERSECURITY June 2015 | INITIATIVE © 2015 NEW AMERICA This report carries a Creative Commons license, which permits non-commercial re-use of New America content when proper attribution is provided. This means you are free to copy, display and distribute New America’s work, or in- clude our content in derivative works, under the following conditions: ATTRIBUTION. NONCOMMERCIAL. SHARE ALIKE. You must clearly attribute the work You may not use this work for If you alter, transform, or build to New America, and provide a link commercial purposes without upon this work, you may distribute back to www.newamerica.org. explicit prior permission from the resulting work only under a New America. license identical to this one. For the full legal code of this Creative Commons license, please visit creativecommons.org. If you have any questions about citing or reusing New America content, please contact us. AUTHORS Danielle Kehl, Senior Policy Analyst, Open Technology Institute Andi Wilson, Program Associate, Open Technology Institute Kevin Bankston, Director, Open Technology Institute ABOUT THE OPEN TECHNOLOGY INSTITUTE ACKNOWLEDGEMENTS The Open Technology Institute at New America is committed to freedom The authors would like to thank and social justice in the digital age. To achieve these goals, it intervenes Hal Abelson, Steven Bellovin, Jerry in traditional policy debates, builds technology, and deploys tools with Berman, Matt Blaze, Alan David- communities. OTI brings together a unique mix of technologists, policy son, Joseph Hall, Lance Hoffman, experts, lawyers, community organizers, and urban planners to examine the Seth Schoen, and Danny Weitzner impacts of technology and policy on people, commerce, and communities.
    [Show full text]
  • Matt Blaze 1
    MATT BLAZE 1 TESTIMONY BEFORE THE US HOUSE OF REPRESENTATIVES COMMITTEE ON HOUSE ADMINISTRATION HEARING ON “2020 ELECTION SECURITY – PERSPECTIVES FROM VOTING SYSTEM VENDORS AND EXPERTS” JANUARY 9, 2020 1 McDevitt Professor of Computer Science and Law, Georgetown University, 600 New Jersey Ave NW, Washington, DC 20001. [email protected]. Affiliation for identification only. 9 January 2020 Testimony of Prof. Matt Blaze INTRODUCTION Thank you for the opportunity to offer testimony on the important questions raised by the security of the technology used for elections in the United States. For more than 25 years, my research and scholarship has focused on security and privacy in computing and communications systems, especially as we rely on insecure platforms such as the Internet for increasingly critical applications. My work has focused particularly on the intersection of this technology with public policy issues. For example, in 2007, I led several of the teams that evaluated the security of computerized election systems from several vendors on behalf of the states of California and Ohio. I am currently the McDevitt Professor of Computer Science and Law at Georgetown University. From 2004 to 2018, I was a professor of Computer and Information Science at the University of Pennsylvania. From 1992 to 2004, I was a research scientist at AT&T Bell Laboratories. I hold a PhD in computer science from Princeton University, an MS in computer science from Columbia University, and a BS from the City University of New York. This testimony is not offered on behalf of any organization or agency. In this testimony, I will give an overview of the technical security risks facing elections in the United States today, with emphasis on vulnerabilities inherent in electronic voting machines, as well as the exposure of our election infrastructure to disruption by domestic as well as national security adversaries2.
    [Show full text]
  • Advanced Computer and Network Security
    Course Proposal: CMSC ### : Advanced Computer and Network Security April 2017 Background and Motivation This proposal is for a permanent, graduate-level course in computer and network security. Although security is an increasingly popular area of study for our PhD students, there remains no core graduate-level course on the topic. The overall goal of this course is to provide a broad foundational knowledge to prepare students to begin research in security. Dave Levin is currently teaching an iteration of this course as CMSC 818O. For more detailed information (including example attack presentations), please see the course website: https://www.cs.umd.edu/class/spring2017/cmsc818O/ Course Description This course will cover advanced topics in computer and network security, including: anonymity, privacy, memory safety, malware, denial of service attacks, trusted hardware, security design principles, and empirically measuring security "in the wild". This will be a largely paper-driven course, preparing students for research in (or around) the broad area of security. Students will gain first-hand experience launching attacks in controlled environments. The bulk of the grade will be based on a final, semester-long group project. Prerequisites Computer Science, Electrical Engineering, or Computer Engineering student or permission of the instructor. Having taken an undergraduate course in security (or cryptography or networking) is not necessary, but would help, as the class will go considerably deeper than a typical undergraduate security course. Rationale: Unfortunately, there are no consistent cybersecurity courses offered at most undergraduate institutions — it is therefore unlikely that many students would meet a prerequisite of a CMSC 414-equivalent course.
    [Show full text]
  • Mass Surveillance Part 1 - Risks and Opportunities Raised by the Current Generation of Network Services and Applications
    Science and Technology Options Assessment (STOA) Mass Surveillance Part 1 - Risks and opportunities raised by the current generation of network services and applications ANNEX EPRS | European Parliamentary Research Service Scientific Foresight (STOA) Unit PE 527.409 EN Mass Surveillance What are the risks for the citizens and the opportunities for the European Information Society? What are the possible mitigation strategies? Part 1 - Risks and opportunities raised by the current generation of network services and applications Annex IP/G/STOA/FWC-2013-1 - LOT 9 – Safety and security technologies December 2014 STOA - Science and Technology Options Assessment The STOA project “Mass Surveillance – Risks, Opportunities and Mitigation Strategies Part 1” was carried out by TECNALIA Research and Investigation. AUTHORS Arkaitz Gamino Garcia Concepción Cortes Velasco Eider Iturbe Zamalloa Erkuden Rios Velasco Iñaki Eguía Elejabarrieta Javier Herrera Lotero José Javier Larrañeta Ibañez Stefan Schuster (Editor) STOA RESEARCH ADMINISTRATOR Peter Ide-Kostic Scientific Foresight Unit Directorate for Impact Assessment and European Added Value Directorate-General for Parliamentary Research Services European Parliament, Rue Wiertz 60, B-1047 Brussels E-mail: [email protected] LINGUISTIC VERSION Original: EN ABOUT THE PUBLISHER To contact STOA or to subscribe to its newsletter please write to: [email protected] This document is available on the Internet at: http://www.ep.europa.eu/stoa/ Manuscript completed in November, 2014 Brussels, © European Union, 2014 DISCLAIMER The content of this document is the sole responsibility of the author and any opinions expressed therein do not necessarily represent the official position of the European Parliament. It is addressed to the Members and staff of the EP for their parliamentary work.
    [Show full text]
  • Cryptography, the Clipper Chip, and the Constitution
    THE METAPHOR IS THE KEY: CRYPTOGRAPHY, THE CLIPPER CHIP, AND THE CONSTITUTION A. MICHAEL FROOMKINt TABLE OF CONTENTS INTRODUCTION .................................. 712 I. MODERN CRYPTOGRAPHY: PRIVATE SECURITY, GOVERNMENT INSECURITY .................................. 718 A. Who Needs Cryptography?....................... 718 1. Banks, ATM-Users, Electronic Transactors ..... .719 2. Businesses with Commercial and Trade Secrets . 722 3. Professionals ............................ 724 4. National ID Cards and Data Authentication .... 725 5. Criminals ............................... 727 6. Users of Telephones, Electronic Mail, Faxes, or Computers .......................... 728 a. Cellular Telephones ..................... 728 b. Standard Telephones .................... 729 c. Faxes ............................... 729 d. E-mail ............................. 729 e. PersonalRecords ....................... 730 t © A. Michael Froomkin, 1995. Associate Professor, University of Miami School of Law. B.A. 1982, Yale College; M.Phil. 1984, Cambridge University;J.D. 1987, Yale Law School. Internet: [email protected] (PGP 2.6.2 public key appears infra note 787). Research for this article was supported by the University of Miami School of Law Summer Research Grant Fund. SueAnn Campbell, Nora de ]a Garza, YolandaJones, and Brian Williams provided superb library support, Rosalia Lliraldi provided secretarial support, andJulie Owen provided indefatigable research assistance. I am grateful to Abe Abraham, Stewart Baker, Tom Baker, Ken Bass, Caroline
    [Show full text]
  • Doomed to Repeat History? Lessons from the Crypto Wars of the 1990S
    Danielle Kehl, Andi Wilson, and Kevin Bankston DOOMED TO REPEAT HISTORY? LESSONS FROM THE CRYPTO WARS OF THE 1990S CYBERSECURITY June 2015 | INITIATIVE © 2015 NEW AMERICA This report carries a Creative Commons license, which permits non-commercial re-use of New America content when proper attribution is provided. This means you are free to copy, display and distribute New America’s work, or in- clude our content in derivative works, under the following conditions: ATTRIBUTION. NONCOMMERCIAL. SHARE ALIKE. You must clearly attribute the work You may not use this work for If you alter, transform, or build to New America, and provide a link commercial purposes without upon this work, you may distribute back to www.newamerica.org. explicit prior permission from the resulting work only under a New America. license identical to this one. For the full legal code of this Creative Commons license, please visit creativecommons.org. If you have any questions about citing or reusing New America content, please contact us. AUTHORS Danielle Kehl, Senior Policy Analyst, Open Technology Institute Andi Wilson, Program Associate, Open Technology Institute Kevin Bankston, Director, Open Technology Institute ABOUT THE OPEN TECHNOLOGY INSTITUTE ACKNOWLEDGEMENTS The Open Technology Institute at New America is committed to freedom The authors would like to thank and social justice in the digital age. To achieve these goals, it intervenes Hal Abelson, Steven Bellovin, Jerry in traditional policy debates, builds technology, and deploys tools with Berman, Matt Blaze, Alan David- communities. OTI brings together a unique mix of technologists, policy son, Joseph Hall, Lance Hoffman, experts, lawyers, community organizers, and urban planners to examine the Seth Schoen, and Danny Weitzner impacts of technology and policy on people, commerce, and communities.
    [Show full text]
  • Mass Surveillance
    Mass Surveillance Mass Surveillance What are the risks for the citizens and the opportunities for the European Information Society? What are the possible mitigation strategies? Part 1 - Risks and opportunities raised by the current generation of network services and applications Annex IP/G/STOA/FWC-2013-1/LOT 9/C5/SC1 January 2015 PE 527.409 STOA - Science and Technology Options Assessment The STOA project 'Mass Surveillance - Part 1: Risks and opportunities raised by the current generation of network services and applications' was carried out by TECNALIA Research and Investigation. AUTHORS Arkaitz Gamino Garcia Concepción Cortes Velasco Eider Iturbe Zamalloa Erkuden Rios Velasco Iñaki Eguía Elejabarrieta Javier Herrera Lotero José Javier Larrañeta Ibañez Stefan Schuster (Editor) STOA RESEARCH ADMINISTRATOR Peter Ide-Kostic Scientific Foresight Unit Directorate for Impact Assessment and European Added Value Directorate-General for Parliamentary Research Services European Parliament, Rue Wiertz 60, B-1047 Brussels E-mail: [email protected] LINGUISTIC VERSION Original: EN ABOUT THE PUBLISHER To contact STOA or to subscribe to its newsletter please write to: [email protected] This document is available on the Internet at: http://www.ep.europa.eu/stoa/ Manuscript completed in January 2015 Brussels, © European Union, 2015 DISCLAIMER The content of this document is the sole responsibility of the author and any opinions expressed therein do not necessarily represent the official position of the European Parliament. It is addressed to the Members and staff of the EP for their parliamentary work. Reproduction and translation for non- commercial purposes are authorised, provided the source is acknowledged and the European Parliament is given prior notice and sent a copy.
    [Show full text]
  • Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet Steven M
    Northwestern Journal of Technology and Intellectual Property Volume 12 | Issue 1 Article 1 2014 Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet Steven M. Bellovin Columbia University Matt lB aze University of Pennsylvania Sandy Clark University of Pennsylvania Susan Landau privacyink.org, [email protected] Recommended Citation Steven M. Bellovin, Matt lB aze, Sandy Clark, and Susan Landau, Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet, 12 Nw. J. Tech. & Intell. Prop. 1 (2014). https://scholarlycommons.law.northwestern.edu/njtip/vol12/iss1/1 This Article is brought to you for free and open access by Northwestern Pritzker School of Law Scholarly Commons. It has been accepted for inclusion in Northwestern Journal of Technology and Intellectual Property by an authorized editor of Northwestern Pritzker School of Law Scholarly Commons. NORTHWESTERN JOURNAL OF TECHNOLOGY AND INTELLECTUAL PROPERTY Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet Steven M. Bellovin, Matt Blaze, Sandy Clark, & Susan Landau April 2014 VOL. 12, NO. 1 © 2014 by Northwestern University School of Law Northwestern Journal of Technology and Intellectual Property Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet By Steven M. Bellovin*, Matt Blaze†, Sandy Clark§, & Susan Landau‡ For years, legal wiretapping was straightforward: the officer doing the intercept connected a tape recorder or the like to a single pair of wires. By the 1990s, however, the changing structure of telecommunications—there was no longer just “Ma Bell” to talk to—and new technologies such as ISDN and cellular telephony made executing a wiretap more complicated for law enforcement.
    [Show full text]
  • Expanding Domain Name System Support in Tor
    Expanding Domain Name System support in Tor 6th December 2016 Student: Elmer Jansema Primary supervisor: Marco Aiello Secondary supervisor: Frank B. Brokken ABSTRACT The protocols that are the foundations of the Internet have inherent pri- vacy issues. Anonymity systems attempt to circumvent these privacy issues in a variety of ways. These systems advertise anonymity as a feature but the majority uses technology that is too simplistic. Tor is an anonymity system that works and continues to be the subject of active research. However, its implementation is unable to resolve all of the resource records (RRs) that the Domain Name System (DNS) protocol supports. Part of this thesis is research on how Tor limits the DNS protocol and the workarounds that attempt to bypass these limitations. Proposal 219 with the title Support for full DNS and DNSSEC resolu- tion in Tor describes the removal of these limitations. The proposal addresses DNS resolution of all RRs by sending DNS packet data between onion routers and exit relays. Our implementation of the pro- posal consists of an asynchronous and a synchronous implementation. Using two implementations of the proposal enables us to measure the performance and research the differences. The results reveal that the implementations have a negative impact on the anonymity and performance of Tor and no impact on the security of Tor. Finally, we propose the asynchronous implementation for its performance and propose future work that removes the negative impact it has on an- onymity and performance. These changes make the implementation suitable for inclusion into Tor. iii ACKNOWLEDGEMENTS The road that lead to this thesis was long and bumpy.
    [Show full text]
  • Leeds Thesis Template
    Is Internet privacy dead? Recovering Internet privacy in an increasingly surveillant society. Jeremy Michael Harmer Submitted in accordance with the requirements for the degree of Doctor of Philosophy The University of Leeds School of Law January, 2017 - ii - The candidate confirms that the work submitted is his own and that appropriate credit has been given where reference has been made to the work of others. This copy has been supplied on the understanding that it is copyright material and that no quotation from the thesis may be published without proper acknowledgement. The right of Jeremy Michael Harmer to be identified as Author of this work has been asserted by him in accordance with the Copyright, Designs and Patents Act 1988. © 2017 The University of Leeds and Jeremy Michael Harmer - iii - Acknowledgements This thesis concludes 8 years and 7 months of research (including 2 extensions given on medical grounds) as a part-time Ph.D. student in School of Law at the University of Leeds. First and foremost, I am grateful to my employer - IT Services at the University of Leeds - for subsidising part of my academic fee and allowing me 5 days study leave from work annually to conduct and complete this doctoral research. I would also like to express my greatest thanks to my supervisors, Dr. Subhajit Basu and Mr. Nick Taylor, for supervision and understanding and encouraging me at critical stages of my research. I am grateful to have had the opportunity to benefit from their academic guidance, motivation, encouragement and support. Also, I would like to express my thanks and appreciation to Dr.
    [Show full text]
  • Curriculum Vitae - Micah Sherr 2
    Micah Sherr Georgetown University Phone: (202) 687-4381 Department of Computer Science Email: [email protected] St. Mary’s Hall, Room 337 Homepage: https://cs.georgetown.edu/~msherr 3700 Reservoir Road, NW Washington, DC 20057 Professional Experience Callahan Family Professor of Computer Science, Georgetown University January 2021 – Current Professor, Department of Computer Science, Georgetown University August 2021 – Current Provost’s Distinguished Associate Professor (w. tenure), Georgetown University Feb. 2016 – July 2021 Visiting Professor, Northeastern University (while on sabbatical) January 2018 – June 2018 College of Computer & Information Science Director, Georgetown Institute for Information Assurance (GIIA) January 2016 – Current Associate Professor (with tenure), Georgetown University August 2015 – July 2021 Department of Computer Science Assistant Professor, Georgetown University August 2010 – July 2015 Department of Computer Science Postdoctoral Researcher, University of Pennsylvania August 2009 – July 2010 Ph.D. Candidate, University of Pennsylvania September 2003 – August 2009 Intel Research Intern, Intel Corporation June 2006 – March 2007 Programmer / Analyst, Columbia University August 2001 – June 2003 Consultant, Scient, Inc. July 2000 – June 2001 Education Ph.D. in Computer and Information Science, September 2003 - August 2009 University of Pennsylvania Thesis: Coordinate-Based Routing for High Performance Anonymity (Awarded the 2010 Morris and Dorothy Rubinoff Award) Advisors: Matthew Blaze and Boon Thau Loo M.S.E. in Computer and Information Science, September 2003 - May 2005 University of Pennsylvania B.S.E. in Computer Science and Engineering, September 1996 - May 2000 University of Pennsylvania Curriculum Vitae - Micah Sherr 2 Awards and Honors Andreas Pfitzmann Best Student Paper Award, Privacy Enhancing Technologies Symposium 2021; awarded for Residue-Free Computing (with Logan Arkema), July 2021.
    [Show full text]
  • Long Comment Regarding a Proposed Exemption Under 17 U.S.C
    Long Comment Regarding a Proposed Exemption Under 17 U.S.C. 1201 Item 1. Commenter Information Prof. Steven M. Bellovin (Columbia University), Prof. Matt Blaze (University of Pennsylvania), Prof. Edward W. Felten (Princeton University), Prof. J. Alex Halderman (University of Michigan), and Prof. Nadia Heninger (University of Pennsylvania) (the “Security Researchers”). Item 2. Proposed Class Addressed Proposed Class 25: Software – Security Research This proposed class would allow researchers to circumvent access controls in relation to computer programs, databases, and devices for purposes of good-faith testing, identifying, disclosing, and fixing of malfunctions, security flaws, or vulnerabilities. Item 3. Overview Literary works, including computer programs and databases, protected by access control mechanisms that potentially expose the public to risk of harm due to malfunction, security flaws or vulnerabilities when (a) circumvention is accomplished for the purpose of good faith testing for, investigating, or correcting such malfunction, security flaws or vulnerabilities in a technological protection measure or the underlying work it protects; OR (b) circumvention was part of the testing or investigation into a malfunction, security flaw or vulnerability that resulted in the public dissemination of security research when (1) a copyright holder fails to comply with the standards set forth in ISO 29147 and 30111; or (2) the finder of the malfunction, security flaw or vulnerability reports the malfunction, security flaw or vulnerability to the copyright holder by providing the information set forth in Form A* in advance of or concurrently with public dissemination of the security research. * Form A is a format derived from ISO 29147 Annex A: FORM A A researcher disclosing a vulnerability to a copyright holder shall provide the following information in writing: PRIVACY ACT ADVISORY STATEMENT Required by the Privacy Act of 1974 (P.L.
    [Show full text]