Research

My main security research areas are as follows: Blockchain security and privacy, Internet denial-of-service problems, and wireless network security.

Blockchain Security & Privacy

Erebus: a stealthy Bitcoin partitioning attack

We present the Erebus attack [S&P’20], which allows large malicious Internet Service Providers (ISPs) to isolate any targeted public Bitcoin nodes from the Bitcoin peer-to-peer network. The Erebus attack does not require routing manipulation (e.g., BGP hijacks) and hence it is virtually undetectable to any control-plane and even typical data-plane detectors. The Erebus attack also works against other cryptocurrencies with similar network codebase such as Litecoin, Bitcoin Cash, and ZCash (see below for the list). For technical details, please refer to our paper below.

Obscuro: a secure and scalable Bitcoin mixer using Intel SGX

We present Obscuro [ACSAC’18], a highly efficient and secure Bitcoin mixer that utilizes trusted execution environments (TEEs). With the TEE’s confidentiality and integrity guarantees for code and data, our mixer design ensures the correct mixing operations and the protection of sensitive data (i.e., private keys and mixing logs). Yet, the TEE-based implementation does not prevent the manipulation of inputs (e.g., deposit submissions, blockchain feeds) to the mixer, hence Obscuro is designed to overcome such limitations. Our prototype of Obscuro is built using Intel SGX and we demonstrate its effectiveness in Bitcoin Testnet. Our implementation mixes 1000 inputs in just 6.49 seconds, which vastly outperforms all of the existing decentralized mixers

Denial-of-service problems

Crossfire attack

The Crossfire attack [IEEE S&P’13] cuts off network connections to a variety of attacker-chosen Internet hosts (e.g., servers of an enterprise, a city, a state, or a small country) by flooding only a few network links in the backbone of the Internet. We demonstrated via Internet- scale experiments that the Crossfire attack can cause massive connectivity losses; e.g., it disables up to 53% of the total number of Internet connections of some US states, and up to about 33% of all the connections of the West Coast of the US. Crossfire differs from other traditional attacks in the following aspects: it is scalable to large numbers of hosts since it floods a set of few common network links that are shared by a large number of hosts beyond them; it maintains its attack effectiveness persistently (e.g., hours or days) because it is adaptive to defense strategies and its traffic flows are indistinguishable from legitimate ones.

Detour-learning adaptive Crossfire

In our recent paper [S&P’19], we show that rerouting-based countermeasures against the Crossfire-like link-flooding attacks, unfortunately, do not work in practice. With a large-scale analysis of BGP routing data and extensive simulation, we found the main reason for the difficulty. We also design a new adaptive link-flooding attack that learns the detours created by rerouting defense algorithms and dynamically change the flooding link targets.

Tuple-Space Explosion against Open vSwitch

Packet classification is one of the fundamental building blocks of various security primitives and thus it needs to be highly efficient and available. In this paper [CoNEXT’19], we evaluate whether the de facto packet classification algorithm (i.e., Tuple Space Search scheme, TSS) used in many popular software networking stacks, e.g., Open vSwitch, VPP, HyperSwitch, is robust against low-rate denial-of-service (DoS) attacks. We present the Tuple Space Explosion (TSE) attack that exploits the fundamental space/time complexity of the TSS algorithm. We demonstrate that the TSE attack can degrade the switch performance to as low as 12% of its full capacity with a very low packet rate (i.e., 0.7 Mbps) when the target packet classification only has simple policies, e.g., “allow a few flows but drop all others”.

Routing bottleneck

We investigated the fundamental vulnerabilities of the Internet that make the Crossfire attack possible and highly effective. We performed large-scale Internet measurement study and defined the notion of Routing Bottlenecks of the Internet [ACM CCS’14]. A routing bottleneck of a certain set of hosts (e.g., cloud service, city, or country) is the small set of network links that carry the vast majority (e.g., 7-80%) of Internet routes towards the hosts, which makes them potentially vulnerable to the Crossfire attack. The measurements showed the existence of the routing bottlenecks in 30 countries and major cities around the world. Interestingly, it has shown that the cost minimization of Internet routing and network structure is the main cause of the routing bottlenecks, which is a very desirable feature of Internet routing.

CoDef: Collaborative Defense

We develop a defensive mechanism, called CoDef [CoNEXT’13], that provides bandwidth guarantees to legitimate users when transit networks are under link-flooding attacks, such as Crossfire. CoDef enables collaboration among different networks to detect and filter the legitimate-looking attack traffic by testing the bots via routing conformance test.

Spiffy: Inducing Cost-Detectability Tradeoffs

We developed a defense mechanism, called SPIFFY [NDSS’16], that aims for deterring cost-sensitive, rational denial-of-service attackers. Recognizing the big cost advantage of attackers over their defenders (e.g., cost of generating attack bandwidth is orders of magnitude lower than provisioning the same bandwidth at the target), we designed the SPIFFY mechanism that reduces the attack-defense cost asymmetry. SPIFFY exploits software-defined networking (SDN) to dynamically test large number of denial-of-service bots, ultimately forcing the attacker to spend significantly more attack budget.

Wireless network security

SurFi: Detecting Surveillance Camera Looping Attacks with Wi-Fi

Recent surveillance camera looping attacks demonstrate new security threats – adversaries can replay a seemingly benign video feed of a place of interest while trespassing or stealing valuables without getting caught. Unfortunately, such attacks are extremely difficult to detect in real-time due to cost and implementation constraints. In this paper, we propose SurFi [WiSec’19] to detect these attacks in real-time by utilizing commonly available Wi-Fi signals. In particular, we leverage that channel state information (CSI) from Wi-Fi signals also perceives human activities in the place of interest in addition to surveillance cameras.

Selfish resource exploitation attack in LTE

We developed a selfish resource-consumption attack that allows malicious mobile users to consume unfair amount of cellular radio resources and thus potentially launch denial-of-service attacks to other legitimate users [WiSec’13]. The attack exploits the fundamental vulnerabilities of a state-of-the-art resource management technique, called the multi-cell cooperation, which coordinates multiple cell sites in different locations to serve a particular mobile user. In this attack, malicious mobile users can easily manipulate the channel state measurements and force the cellular system to waste radio resources by conducting unnecessary multi-cell cooperations.