University of California Santa Barbara Analyzing and Securing Embedded Systems A dissertation submitted in partial satisfaction of the requirements for the degree Doctor of Philosophy in Computer Science by Chad Samuel Spensky Committee in charge: Professor Giovanni Vigna, Co-Chair Professor Christopher Kruegel, Co-Chair Professor Timothy Sherwood Professor Fabian Monrose, University of North Carolina at Chapel Hill September 2020 The Dissertation of Chad Samuel Spensky is approved. Professor Timothy Sherwood Professor Fabian Monrose, University of North Carolina at Chapel Hill Professor Christopher Kruegel, Committee Co-Chair Professor Giovanni Vigna, Committee Co-Chair July 2020 Analyzing and Securing Embedded Systems Copyright © 2020 by Chad Samuel Spensky iii This work is dedicated to Dr. William Hunter Vaughan for inspiring me and cultivating my love for math and science. iv Acknowledgements Where to start... There are so many people that have helped, inspired, and pushed me to make this degree, and my career, possible. First, I need to acknowledge the obvious two | my biological parents | Steve Spensky and Linda Lovy, for bringing me into this world and supporting me throughout my various career decisions. I would also like to acknowledge my \pap pap," Ralph Mills, for showing me what hard work looks like (he worked three time jobs as a mechanic, a coal miner, and a crane operator while raising 12 children) and demonstrating the difference between simply living and living well | being surrounded by people who love and adore you. Next, is the man who taught me the meaning of family, inspired me to believe in myself, showed me what it means to be southern gentleman. Hunter Vaughan, my non-biological dad, has supported me in too many ways to count, and my life would be no where near as great as it has been without him in it. My pursuit of this degree undoubtedly stemmed from a few of the life-changing teach- ers that I have interacted with throughout my education. I was a C student with little aspirations of post-secondary school, until a notable semester during my Junior year at Brooke High School. Peggy Walker (my Pre-Calculus and Trigonometry teacher) and Glenn Berkheimer (my Physics teacher) changed my view on education. They were the only teachers up to that point that let do Mathematics my way | mentally, without showing work, and very quickly | and supported my methods. For the first time in my life, I not only felt \smart," but knew that I was capable of great things. At the university level, Robert Heath (my Introduction to Theoretical Mathematics Professor) solidified my love for Mathematics. His brilliance, dry humor, and Mathematical creativity were awe inspiring | I still recite his \golf ball" problem to this day. Alexandros Labrinidis and Panos K. Chrysanthis introduced me to research, which played a significant role in v my pursuit of a Ph.D., and facilitated my acceptance to the various graduate programs. Their guidance and mentorship was invaluable, and showed me, first hand, how much of a positive influence a great professor can be to a young, motivated student | I have been trying to pay it forward ever since. I am forever grateful for Michael K. Reiter for taking a gamble on me and introducing me to Computer Security as a profession, versus the potentially-criminal activity that I was previously using it for. His mentorship, wisdom, and work ethic have made me the researcher that I am today | I still here Mike's voice every time I create a macro in a LATEX document. I want to acknowledge Fred Brooks for showing me the true meaning of humility and being so generous with his time and knowledge, despite his legendary status in our field. I similarly hear Fred's wise words in my head when conducting research, giving presentations, and interacting colleagues | \Tell them what your going tell 'em, tell 'em, then tell them you told 'em." Fabian Monrose saved my career, and for that I feel forever indebted. I vividly recall our conversation over coffee where I told him, \I want to drop of graduate school." Fabian was able to help me work through my situation and lent a desperately needed ear and outside prospective. He would ultimately introduce me to Charles V. Wright, who then hired me at MIT Lincoln Laboratory as an intern and was later my supervisor and mentor when I joined the technical staff. Charles provided me with some of the greatest career advice of my life, and I still model my management style after him. I recite his words regularly, and even use them as a mantra in my life, \Any time that you can exchange money for time, do it." In context, we were discussing work, but these words echo deeper | we can always make more money; we cannot make more time. I would also like to acknowledge some of my colleagues that inspired me to push myself professionally and helped me achieve the success that I have thus far. I want to acknowledge Samuel Kerr for keeping me honest on getting to work on time, \First!" and vi for being the first person to bridge my two worlds and become a great personal friend and an incredible colleague. Hongyi Hu is easily the most influential coworker that I have had thus far. Without him, my career at MIT LL would have been nowhere near as successful as it was | his impressive intelligence, methodic engineering principles, and calm demeanor were a necessary balance to my more gun-slinging style of conducting research. Similarly, Ben Nahill is one of the most interesting and inspiring people that I have met | he is uncomfortably smart, has a breadth of impressive talents, and is an all around great guy. Working with Ben always inspired me to push myself and to set evermore ambitious goals. Our Turning Machine is still the most fun I have ever had engineering anything. I need to acknowledge the amazing interns that have worked under me, Rick Housley and Kevin Leach. They kept me humble and pushed me to continue improving (because they were way smarter than me), showed me how rewarding it can be to share knowledge and success with others, and were large motivators for pursing this degree (i.e., I realized how enjoyable mentoring and teaching was). I am also indebted to the various managers that inspired me in my time at MIT LL. Eric Evans, the director of the lab, is another whose words frequently echo in my head, \20% of the things that you try should fail; otherwise you are not pushing the limits hard enough." I always remind myself of these words when failures inevitably happen | failures are necessary and expected, not something to be feared. My group leaders, Lee Rossey, John Wilkinson, and Roger Khazan have provided me with saint-like support and encouragement. Lee let me push the limits with my research and put full trust in me, despite my young age at the time, enabling me to produce some of the most fun and exciting work that I have ever done. John's support when I decided to return to pursue my Ph.D. was one of the greatest displays of altruism I have ever seen | it was clearly a loss to his team, but he was still eager to support my dreams. Roger's continued support and mentorship during my Ph.D. through the various projects that we have worked on vii together has helped me become a \professional" and also helped keep my head up during the unavoidable tough times in graduate school. Outside of my advisors, there are others who have unofficially co-advised me through this process. I have worked on so many projects with Hamed Okhravi and learned so much from him as a researcher at this point that it is hard to believe that there is no official \advisor" title connected to his name. Westley Weimer is another professor that has come to embody what an academic should be in my mind | absolutely brilliant, committed to advancing human knowledge, and always looking to pull those around him up. Hani Jamoon and Zhongshu Gu provided invaluable guidance during my time at IBM Research. My internship at IBM Research was during a low psychological point in my life and I am sure that my gratitude was not appropriately conveyed, but I will always cherish my memories of Yorktown Heights and the amazing people that I got to work with at IBM. Receiving the IBM Ph.D. Fellowship is still one of the highlights of my life, and came at time when I desperately needed some reassurance in myself as a person and as researcher; I am forever grateful and beyond proud to have received this award. Dick Kemmerer has been in the background helping me throughout me degree, providing guidance, historical insights, and plenty of good laughs. I also want to acknowledge the Club Football team at the University of North Carolina at Chapel Hill. Easily, one of the greatest experience of my life was playing football under Coach Featherstone. Being a part of that team showed me what a brotherhood was, gave me infinite confidence in myself, and made a man out me. I would not be the person that I am today or have the work ethic that I do today without this experience. It is not every day that meet someone that truly, 100% loves what they do | Feathers did. He loved football and I am honored to have shared this passion with him and my teammates | \We all we got!" Similarly, I want to acknowledge all of the members of Shellphish.