CyberByte - Fall 2022

FA L L 2 0 2 2

FA L L 2 0 2 2

Doctors all around (clockwise from top left) and Drs. Rasika Bhalerao (l) and Damon McCoy. (r); Dr. Michail Maniatakos with Drs. Esha Sarkar (l) and Dimitris Tychalas (r); Dr. Brendan Dolan-Gavitt with Drs. Yu Hu (c) and Zekun Shen

Pomp and Circumstance Return to Tandon.

CCS faculty and Ph.D. grads celebrate the first in-person graduation ceremony since 2019.

CENTER FOR

CYBERSECURITY

1

FA L L 2 0 2 2

IN THIS ISSUE GREETINGS FROM THE EDITOR-IN-CHIEF

3

2022 Ph.D. GRADUATES

4

RESEARCH FOCUS: PRIVACY

6

FACULTY PROFILE: RACHEL GREENSTADT

8

STUDENT PROFILE: ALAN CAO

10

ALUMNI PROFILE: KIRAN CHAUDHRY

12

CCS EVENTS

14

CCS NEWS

17

AWARDS AND HONORS

18

OUR TEAM

Editor in Chief

Editorial Copy Writer

Quanyan Zhu

Lois De Long 2

FA L L 2 0 2 2

MORE THAN JUST KEEPING SECRETS…..

When asked in an interview for this issue’s Faculty Profile how she would define the issue of privacy, Dr. Rachel Greenstadt replied it was “how individuals can manage the data about them, and their self-presentation in their interaction in online and offline spaces. It’s about autonomy and control and how we accomplish this in a digital world.” in other words, in the realm of cybersecurity, solving privacy issues requires more than just building metaphorically higher walls or more fences. It also means giving both individuals and groups a defense against misrepresentation and that, without that protection, breaches can have a devastating human cost.

In this issue of CyberByte, we take a very brief look at how this complex issue is being addressed at NYU’s Center for Cybersecurity. In addition to the profile of Greenstadt, we offer brief summaries of other privacy research initiatives underway at both at the Brooklyn and Abu Dhabi campuses. As we feature these different research that mark the scope of CCS work in privacy, we welcome feedback from alumni that may be addressing these issues in industry and academia. We would be happy to highlight your contributions in future issues.

As we feature these different research areas that mark the scope of work performed at NYU’s Center for Cybersecurity, we welcome feedback from alumni who may be addressing these issues in industry and academia. We would be happy to highlight your contributions in future issues Dr. Quanyan Zhu, Editor in Chief

3

FA L L 2 0 2 2

CELEBRATING OUR 2022 PH.D. GRADUATES

Khoury College of Computer Sciences at Northeastern University. Her Ph.D. dissertation is entitled, “Analyzing Harms of Online Platform and Policy Design.”

The NYU Center for Cybersecurity is proud to recognize its 2022 Ph.D. graduates.

After two years of virtual ceremonies, this year’s eight newly minted graduates got to mark their departure at an in-person

MAX ALIAPOULIOS (Advisor: Dr. Damon McCoy)

Ph.D. Computer Science

graduation ceremony, held in May 2022 at

In collaboration with his advisor, Max has

the Barclays Center. Congratulations on

contributed to a number of projects in

the Center’s newest doctors.

security and privacy, applied machine learning, and cybercrime. Two recent studies have looked at the influence of dark web marketplaces on available supplies during the COVID-19 pandemic, and examined how QAnon theories were disseminated over time. During his tenure, he authored or coauthored numerous papers for conferences, such as the International AAAI Conference on Web and Social Media and the IEEE Symposium on Security and Privacy.

LAURA EDELSON

(Advisor: Dr. Damon McCoy)

Ph.D. Computer Science Laura Edelson will not be leaving Tandon right away as she will be serving as a postdoctoral researcher at Cybersecurity for Democracy, a CCS initiative that promotes transparency in social media.

Her work with this group, which she founded with her advisor, Dr. Damon McCoy, has made her a sought-after commentator for journalists on issues of privacy, disinformation, and the abuses of social media. Laura’s dissertation,

SAMRAT ACHARYA (Advisors:

“Characteristics of Misinformation and

Ph.D. Electrical Engineering

Spaces,” was one of three from Tandon

Samrat was featured in CyberByte’s Spring

Research Award.

Political Content in Online Information

Dr. Yury Dvorkin and Dr. Ramesh Karri)

honored with a Pearl Brownstein Doctoral

2021 issue for serving as an unofficial spokesperson for cybersecurity in his native Nepal during the pandemic. This role evolved when he wrote an article to ensure that the surge in online work would not open new cybersecurity threats.

His research at NYU Tandon focused on smart grid security, and security of cyber-physical systems, and he wrote his dissertation on “Cybersecurity of Electric Vehicle Charging.” Over the past five years, Samrat has authored or co-authored 17 papers. He recently began a new post as a power systems research engineer at Pacific Northwest National Laboratory.

RASIKA BHALERAO (Advisor: Dr. Damon McCoy)

Ph.D. Computer Science Rasika has pursued research endeavors in cybersecurity, ethics, and social bias in machine learning during her tenure at Tandon. Her commitment to ethical approaches in education and research are reflected in several papers, including one presented at the 53rd ACM Technical

YU HU

(Advisor: Dr. Brendan Dolan-Gavitt)

Ph.D. Computer Science

Symposium on Computer Science

Yu completed two master’s degrees at

Education. Rasika has accepted a position

NYU Tandon—in wireless communication

as an Assistant Teaching Professor in the

and cybersecurity—before starting his

4

FA L L 2 0 2 2

doctoral work at the school. His research initiatives have focused on automatic bug-finding techniques, and developing novel defenses against real-world software system attacks. As an associate researcher in the NYU Tandon MESS (Machine Learning, Embedded Systems, and Software/Systems Security) Lab, he contributed to research projects in crash widening, chaff bugs, and hybrid AEG. He also served as an adjunct lecturer for wireless and electronics. Yu’s dissertation topic is “Evaluating and Improving Symbolic Bug-finders for Security Vulnerabilities.”

ZEKUN SHEN

(Advisor: Dr. Brendan Dolan-Gavitt)

Ph.D. Computer Science Zekun completed a master’s in computer science at Tandon in 2017 before moving on to his doctoral studies at the school.

Much of his work has focused on using fuzzing and sanitizing techniques to test programs and operating systems. Zekun co-authored a paper “Drifuzz: Harvesting Bugs in Device Drivers from Golden Seeds” that was presented at USENIX Security in August 2022. He is now working as a research scientist at Meta.

PRESTON MOORE (Advisors:

Dr. Justin Cappos and Dr. Phyllis Frankl)

Ph.D. Computer Science Preston’s research focused on application security and reliability, specifically exploring a novel testing technique that exposed applications to simulations of scenarios that had caused other applications to fail. In investigating this topic, he developed two new techniques that allow developers to detect situations where an application may fail before it is deployed, so that its deficiencies can be corrected without the negative consequences of a crash. Preston presented his work at ISSRE 2019, and

JANITH WEERASINGHE (Advisor: Dr. Rachel Greenstadt)

Ph.D. Computer Science Janith actually began his doctoral studies

was honored with the Best Paper and

at Drexel University in Philadelphia, PA,

Presentation award. His dissertation

following completion of his master’s

is entitled “A PORT in Stormy SEAs:

degree there. Since arriving at Tandon,

Leveraging Past Problems to Prevent

his research initiatives have focused on

Future Failures.” Preston is now working as

using machine learning to mitigate abuses

a Senior Software Engineer for Anaconda

that occur on social media platforms.

in New York City

His dissertation topic is entitled “Using Stylometry to Mitigate Abuse in Online Communities.” Janith is joining the staff of The Washington Post as a data scientist.

5

FA L L 2 0 2 2

RESEARCH FOCUS:

PRIVACY RESEARCH AT THE NYU CENTER FOR CYBERSECURITY If one were to rank the concerns of the general public about

of breaches. In this effort, Reagen and Maniatakos are working in

technology there is little doubt that privacy issues would be

collaboration with a data security company called Duality. Learn

front and center. In a 2019 survey of U.S. residents by the Pew

more about the research at https://engineering.nyu.edu/news/

Charitable Trust, 81% of respondents voiced concern that they

novel-tandon-designed-microchip-will-allow-data-be-processed-

had no control over information collected about them by

without-being-decrypted. The second project aims to reduce the

companies (see https://www.pewresearch.org/internet/2019/11/15/

loss of efficiency associated with non-linear operators like ReLU

americans-and-privacy-concerned-confused-and-feeling-lack-

(rectified linear activation function).

of-control-over-their-personal-information/). Given the concern

To address these issues, Reagen and Garg, along with two

privacy issues raise, it should not be surprising that CCS faculty

then Ph.D. students, developed a set of optimizations they call

and students are researching so many different solutions to

DeepReDuce. As stated in a presentation given last summer at

vulnerabilities that have privacy implications. Here is a quick look at a few of these projects.

the International Conference on Machine Learning (https://arxiv.

ENCRYPTION The use of encryption strategies offers

contribute equally to accuracy. We leverage this insight to drop,

a way to protect data that is particularly sensitive, such as

or remove, ReLUs from classic networks to significantly reduce

medical records or financial transactions. Unfortunately, the

inference latency and maintain high accuracy.”

org/pdf/2103.01396.pdf), “the key insight is that not all ReLUs

need to decrypt the data once it reaches its destination adds

TESTING Many methods promise to provide privacy via

a layer of effort that could reduce the overall efficiency of the

anonymity, but do they deliver? One such technology, generative

process. Now, a relatively new strategy called fully homomorphic

adversarial networks (GANs), uses machine-learning systems to

data encryption has emerged that can allow computing to be

“scrub” images of any traces of personal identity. But, a team of

performed on encrypted data. Several CCS-affiliated faculty,

researchers, led by Garg, suggest that these scrubbed images

including Dr. Brandon Reagen (far left in photo) and Dr. Siddharth

leave a lot of “residue” behind. In tests conducted to see how

Garg (center) of Tandon’s Electrical and Computer Engineering

effective tools like privacy protecting GANs (PP-GANs) actually

Department, and Dr. Michail Maniatakos (right) of the Computer

were, Garg found that designs can, in fact, be subverted to

Engineering Department at NYU Abu Dhabi, have applied, tested,

pass privacy checks, while still permitting extraction of secret

or advanced this technology in some way over the past year or

information.The results of this study were presented in a paper

so. In fact, Reagen has actually made contributions to two of these projects.

entitled “Subverting Privacy-Preserving GANs: Hiding Secrets in

The first, supported by a three-and-a-half year, $14-million grant

existing DL-based privacy checks, and potential risks of using

from the Defense Advanced Research Projects Agency (DARPA),

untrusted third-party PP-GAN tools.” The paper can be read in its

is the development of an FHE encrypted chip that reduces the risk

entirety at https://arxiv.org/pdf/2009.09283.pdf.

Sanitized Images.” Among its findings were “the insufficiency of

6

FA L L 2 0 2 2

SYSTEMIC PROTECTION, INDIVIDUAL DEFENSE Sometimes the best privacy defense is a good offense, and a good offense requires a deeper understanding of the mechanisms that allow breaches to occur. As stated on his website, Dr. Damon McCoy, an associate professor of computer science and engineering, has focused his research on “empirically measuring the security and privacy of technology systems and their intersections with society.” One of his most recent initiatives, conducted with Dr. Rachel Greenstadt (see profile on the next page), Ph.D. candidate Kejsi Take, Ph.D. alumnus Kevin Gallagher, and colleague Dr. Andrea Forte of Drexel University, examined the obstacles faced by individuals seeking to remove their data from People Search Websites.

In a paper published in the Proceedings on Privacy Enhancing Technologies in July 2022, the team observes that “the successful monetization of users personal identifiable information motivates data aggregators to make the removal more difficult.” In order to fight back, McCoy and his team provide recommendations to users, third parties, removal services and researchers aiming to make the removal process more effective. You can read the paper at https://petsymposium.org/2022/files/papers/issue3/popets-2022-0067.pdf.

PRIVACY IN THE REALM OF 5G The emergence of 5G technologies has brought a rash of new security and privacy issues to the telecommunications sector. NYU Abu Dhabi’s Cyber Security and Privacy Lab, overseen by principal investigator Dr. Christina Pöpper, assistant professor of computer science, is tackling challenges in mobile network security, aviation security, and communication privacy. Pöpper’s recent research initiatives have examined the tracking of targeted users in 5G networks (paper at https://dl.acm.org/ doi/10.1145/3448300.3467826) and the potential service/privacy losses that can occur during the “handover procedure,” where an ongoing call or data session is switched from one base station or core network to another, e.g., when user equipment is moving (paper at https://dl.acm.org/doi/pdf/10.1145/3485832.3485914). Though the handover process is cryptographically protected, it is vulnerable to denial-of-service and man-in-the-middle attacks, and information disclosure. Read about the ongoing work of the lab at https:// nyuad.nyu.edu/en/research/faculty-labs-and-projects/cybersecurity-and-privacy-lab.html.

INTERNET OF THINGS As homes become smarter, the risk of privacy breaches from devices connected to Internet of Things devices grows as well. Dr. Danny Y. Huang, an assistant professor of electrical and computer engineering at Tandon, focuses much of his research efforts on improving the security of smart devices. Huang is part of a multi-university project team working with an open source app called IoT Inspector, (https://inspector.engineering.nyu.edu/) which gives individuals the ability to monitor network activity involving their in-home smart devices. Huang is also a Consumer Reports Digital Lab Fellow charged with uncovering and addressing emerging consumer harms from these devices. You can read more about his work with IoT Inspector in a paper published in the Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (https://iotinspector.org/papers/ ubicomp-20.pdf).

7

FA L L 2 0 2 2

FACULTY PROFILE: DR. RACHEL GREENSTADT

PRIVACY, ANONYMITY, TRUST, AND READING BETWEEN THE LINES As we have already established in this

These models are used to characterize

issue of CyberByte, the concept of

author style, which, in turn, can be used

privacy in a computer science context is

for forensic attribution work, such as

complex and needs to be addressed in

“trying to see how identities migrate

a diverse number of ways. The research

from one forum to another to understand

initiatives of Dr. Rachel Greenstad affirm

dynamics of online communities, like

just how diverse these approaches can be.

cybercriminal forums.” But, she has also

During her previous work as director of

used the technique to test the viability of

Drexel University’s Privacy, Security, and

anonymization strategies so those who

Automation Laboratory (PSAL), and as an

might need to hide their identities know

associate professor of computer science

whether their submissions are safe (see

at NYU Tandon since 2019, Greenstadt has

https://arxiv.org/pdf/1512.08546.pdf).

tackled issues of cyber harassment and cyber crime, sometimes in partnership with her CCS colleague Dr. Damon McCoy. One such example can be read at https:// dl.acm.org/doi/pdf/10.1145/3432909.

She has also used techniques like topic modeling, named entity recognition, privacy ontology, sentiment analysis, and text normalization to investigate a broad range of privacy concerns related to social media (see https://dl.acm.org/doi/ pdf/10.1145/2665943.2665958).

But, Greenstadt has also conducted studies that explore the double-sided potential of privacy technologies that can both conceal identities or reveal them.

In an interview with CyberByte in May

Greenstadt notes that there is a somewhat long history of using stylometry to verify authorship, and it can and has been admissible in a number of court cases.

One of the earliest instances was back in the 1960s, when it was used to prove authorship of some of The Federalist Papers. More recently, it was used to prove that a detective novel called The Cuckoo’s Calling was actually the pseudonymous work of Harry Potter author J.K. Rowling (https://en.wikipedia.org/wiki/The_ Cuckoo%27s_Calling).

For Greenstadt, some of her interest in stylometry goes back to graduate school conversations with colleagues, including Nick Mathewson, who would later co-

of 2022, Greenstadt spoke about her

found the Tor project. But, she admits that

work with one such technology called

she initially had “quite a bit of skepticism”

stylometry— a technique based on the

about the technique. “My thought was

premise that “we all speak a dialogue

‘well, if you pick the words, surely you

of one.” Using the assumption that the

could trick it’.” When she finally decided to

language everyone speaks is subtly

pursue the work, it was at the request of

unique, stylometry analyzes linguistic

Michael Brennan, the first doctoral student

patterns that can assist in identifying

she worked with at Drexel. “By this point,

authorship of both text and code samples.

there had been quite a lot of work done on

Though the technique can be applied

stylometry, but nobody had really ‘stress-

using a deep learning system, she noted

tested’ it. What we could potentially bring

that “a handcrafted approach, relying

to it was this cybersecurity adversarial

on character N-gram sliding windows of

mindset by asking ‘what would it take to

1 to 4 characters” works about as well.

fool the system?’”

8

FA L L 2 0 2 2

To test these ideas, she designed a study

author verification. As she explained,

the quality of these edits and those from

that required two types of writing samples

these initiatives can “determine if the

editors who can be identified, but those

from participants. In the first set they

same person wrote two different texts,”

editing through Tor were more likely to

merely attempted to disguise their writing

which is useful when looking to find “sock

focus on topics that may be considered

in some way, but in the second group of

puppet” accounts that write threatening

controversial, such as politics, technology,

samples, Greenstadt asked participants

or harassing messages. She recently

and religion.

to write like Cormac McCarthy, an

presented one such study, co-authored

American novelist famous for tales of the

with new graduate Dr. Janith Weerasinghe,

Based on her findings, Greenstadt

frontier, and also for eliminating basic

at the 16th International AAAI Conference

suggested that rather than banning these

writing conventions, like punctuation and

on Web and Social Media. (You can read

pseudonymous contributors that they

capitalization, from his text. The students

the full article at https://ojs.aaai.org/index.

and any other untrusted accounts should

were “supposed to do narratives of their

php/ICWSM/article/view/19359/19131).

simply be reviewed before going live. She

morning, and we got these super grim tales of coffee and shaving,” she observed.

While the immediate results of these tests were not conclusive, “there was an idea that something interesting was going on,” she noted, adding that she felt additional studies could reveal some useful things.

“Maybe you couldn’t identify who did the writing, “ she explains, “but you can see some type of deception is going on.”

Years later, the value of just noting that “deception is going on,” played out in an examination of Reddit accounts that were identified as part of the Russian manipulation in the U.S. Though the comparison didn’t reveal the authors’ identities, by just comparing them to other

points out that this practice is already While her work has provided tools to

common in 17 other Wikipedia editions,

expose those who abuse the privacy of

including those in Germany and Russia.

others—during the interview Greenstadt

If such a review is instituted, it appears

noted that an algorithm she developed

these pseudonymous editors could be

with McCoy is possibly being used by

valuable contributors at very little risk.

the FBI—she has also made important research contributions to the other side of the privacy coin. That is, she sees the potential to design systems to help people more effectively anonymize their text.

This includes work that has evaluated the relationship between anonymity and trustworthiness. Intrigued by the idea that Wikipedia bans contributions that come through Tor or from other pseudonymous contributors, she was curious to see if

And, as Greenstadt pointed out in the interview, “What are you really trusting them to do? People aren’t supposed to be providing facts out of their heads.” She adds that in the current political climate around the world, where anonymity is often a matter of life or death, particularly for journalists and activists,the motivation to use Tor, or to disguise ones identity online, becomes clearer.

there were higher incidences of misleading

Ultimately, for Greenstadt, the

or incorrect information coming from

issue of privacy is, as quoted earlier,

these sources. As explained in a news

“about how individuals can manage

story prepared by NYU, Greenstadt and

the data about them, and their self-

that way.”

her colleagues examined more than 11,000

presentation in their interaction in

Wikipedia contributions made by Tor

online and offline spaces.” Researching

In addition to running stylometry studies,

users, who despite the ban, were able

both sides of the privacy coin can help

which have been documented in about

to edit pages between 2007 and 2018

20 different publications, Greenstadt’s

(https://engineering.nyu.edu/news/tor-

individuals negotiate this increasingly

most recent research in this area has

users-untapped-resource-wikipedia). Not

focused on a subset of stylometry called

only was there little difference between

accounts on Reddit, it did show that the accounts in question “did not have stylistic integrity. These were supposed to be separate accounts, but they didn’t read

9

difficult management task.

FA L L 2 0 2 2

STUDENT PROFILE: ALAN CAO

RISING SENIOR MAKES THE MOST OF EARLY TANDON CONNECTIONS Alan Cao, who begins his senior year in

Cao: I was very fortunate to pick up

the Computer Science and Engineering

various knowledge from the people

Department this fall, has been actively

that I worked with. It also definitely

engaged in research at NYU Tandon

kicked off an interest in trying to pursue

longer than some graduate students. His

work where my job is answering novel

initial research work, back in 2018, was

security research questions, whether it’s

in the Secure Systems Laboratory. As

building automation to quickly detect

a high school student, he worked with

vulnerabilities, or defending against

Associate Professor of Computer Science

rising threats.

and Engineering Justin Cappos and 2022 Ph.D. graduate Preston Moore on the CrashSimulator project (see https:// ssl.engineering.nyu.edu/papers/moore_ crashsim_issre2019.pdf). For Cao, it was an introduction to “work that uniquely involved building systems and mitigations for security.” After finding out that NYU “aligned to that interest greatly and was a school local to me,” he noted that he

CyberByte: In addition to the Leadership Award mentioned above, you also won recognition this year for a paper called “What the Fork? Finding and Analyzing Malware in GitHub Forks” that you presented at the Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) this April. How did that project evolve?

“quickly sought to get involved,” not only

Cao: Professor Brendan Dolan-Gavitt is

to have a chance to “implement software

the faculty advisor for the OSIRIS Lab, and

that tries to solve complex security

his focus on both reverse engineering and

problems, but to also learn more about

doing en-masse analysis of open-sourced

security research itself.”

codebases aligned greatly with my interests. Thus, I thought he was the most

Four years later, Cao has an impressive

appropriate person to reach out to about

list of achievements to share on his

fulfilling my senior design credits. During

resume. He has been an active member

this time, I had a peak interest in open-

of the OSIRIS lab, for which he currently

source supply chain security, specifically

serves as a lab manager, and he was

in the tactics threat actors use when

honored with a 2022 Leadership Award

propagating malware through package

from Tandon’s Department of Computer

registries. I noticed this trend slowly

Science and Engineering in recognition

showing up through GItHub forks, and

of “outstanding leadership in student

wanted to understand if this is a significant

activities.“ In an interview conducted

threat in open source software. We built

via email while he completes a summer

and scaled up detection infrastructure,

internship with Meta Platforms Inc., Cao

and measured and reversed any samples

answered a few questions about his

we were able to find. We demonstrated

accomplishments to date and what he has

the efficacy of our techniques by scanning

learned along the way.

68,879 forks of 35 popular cryptocurrency repositories, which led to the discovery of

CyberByte: What, if anything, about those

26 forked repositories that were hosting

early lab experiences inspired your current

malware. I personally was very surprised to

research interests?

get an award for it during the conference.

10

FA L L 2 0 2 2

An illustration of how ForkSentry which can detect malicious fork repositories on GitHub.

It definitely could not have been done

this entail? Has it been difficult to keep

delivers a positive experience for members

without guidance and inspiration from

activities going after two years of Covid

and their academic/industry goals.

Dolan-Gavitt. I hope the paper is a great

and the changes it brought to the

stepping stone for research that not only

program?

CyberByte: I know you have also been

Cao: As a lab manager for OSIRIS, a lot

you done for that event?

tries to catch malware effectively, but also leads to secure design choices that can ultimately wipe out these classes

active in CSAW. What types of things have

of my responsibilities are logistical. This

of threats.

includes corresponding with faculty and

CyberByte: You have held internships with

funding, proper access to resources,

three significant tech firms (Apple, Trail

and the ability to host smaller in-person

of Bits, and now Meta). Have any of these

events. I also help manage the lab

experiences influenced what type of work

space, maintain some infrastructure, and

you might want to do when you graduate?

communicate with prospective members

Cao: I really enjoyed that all three experiences challenged me to try to solve difficult problems in unique ways, which required potentially novel ideas and demanded a good amount of engineering.

The ability to do this in a job is definitely a necessity for me, and I would love to continue working in roles that present the opportunity to do ample security research.

Furthermore, I hope that any future positions allow me to find vulnerabilities and/or do reverse engineering/binary analysis, and produce reusable software/ services that others can adopt.

CyberByte: You have also served as lab manager for OSIRIS. What does

staff to ensure that our members have

about the lab. COVID-19 was definitely a game-changer for us, as we became largely a remote organization, and a bit inactive with our usual activities.

Over time, however, we actually grew in popularity with more graduate students studying cybersecurity. This meant we had access to a group of part-time grad students that may already be working in the industry. Their presence opens more mentorship opportunities, and meaningful experiences for students interested in the cybersecurity space. Overall the lab was able to withstand the substantial changes to how we’ve operated pre-COVID, and also see this interesting shift that hopefully attracts a lot more newcomers, and

11

Cao: For CSAW, I helped as an organizer in the Fall of 2020, just as we went remote. This meant hosting the CTF, writing challenges, asking sponsors for challenges, and facilitating the rounds of the competition. While I’m not the primary lead for the recent CTF round, I still help with administrative tasks and by writing some challenges CyberByte: What, if anything, are you looking forward to in your senior year?

Cao: I’m looking forward to wrapping up all the non-engineering classes that I have left over, and using free time to pursue personal projects, working with the lab, and also socializing with friends and family a lot more. And also finally graduating too and starting work in the industry.

FA L L 2 0 2 2

ALUMNI PROFILE: KIRAN CHAUDHRY

NEWLY MINTED ALUMNUS MAKES EVERY CONNECTION COUNT Kiran Chaudhry is just barely an alumnus,

scholarship. Lastly, during her time as

having received her M.S. in Cybersecurity

community and partnership outreach

degree in May 2022 via the Cyber Fellows

campus chair for Victoria’s Secret Pink at

program. She is now working on the

NYU, she created a food event for Hispanic

security integration team for Salesforce,

Heritage Month. The program provided

a company that creates cloud-based

students a healthy snack during midterms

software to support businesses. But, she

while spotlighting Elisa’s Love Bites, a

is also serving as an adjunct professor

local woman and Latinx-owned New York

at the Ying Wu College of Computing

City business.

at New Jersey Institute of Technology and the NYU Cyber Fellows program, teaching Privacy and IT at NJIT and Penetration Testing at NYU. Taking on posts in academia and industry at the same time might seem a bit daunting to some, particularly for a new graduate.

But, for Chaudhry, it’s simply honoring a commitment to “pay knowledge forward” that has been part of her motivation since she was a freshman teaching Python and Java to K-8 students in a Jersey City, NJ,

These examples show that Chaudhry has learned at a relatively young age how to form and use networks to both achieve personal goals, and to benefit others. In a recent conversation with CyberByte, she shared a few tips for other students who need to make the most of their available resources in order to achieve their goals.

Pay attention and follow the best leads

computer summer camp. As that first

As a self-defined “first generation

teaching assignment, along with being

student,” Chaudhry knew early on that

a tutor and peer mentor, helped her pay

she would need to be smart about her

for some of her undergraduate college

educational decisions. She earned her

expenses, the takeaway for Chaudhry has

first three college credits at the age

been that when one pays things forward

of 12 by taking a biochemistry class at

one can often move forward herself.

Rutgers University. Later on, “some female students from Rutgers did a presentation

Chaudhry came to the attention of

at my middle school and told us

CyberByte as the winner of an NYU

scholarships were available to women who

Inclusion Award, which is given to the one

wanted to study computer science.” She

student in each academic department

did land a full tuition honors scholarship

who has demonstrated a commitment to

to New Jersey City University and was

advancing inclusion, diversity, belonging

able to complete her bachelor’s degree in

and equity at Tandon. She received

two-and-a-half years. By then, she realized

the honor for activities that support

how much she liked teaching and began

diversity in STEM professions, including

inquiring about adjunct work so she could

single-handedly organizing, planning,

“be a professor part time while continuing

and promoting two all Gen Z female

a corporate career. I was met with mostly

panel events, even though she recalls,

one response, which was to have a

“I didn’t have any sponsorship or funds

master’s degree before applying.” Once

for either event.” As a social media

again, she went searching for a program

ambassador for Niche.com, a scholarship

she could afford. Her research

application website, Chaudhry also had

led her to NYU Tandon and the Cyber

the opportunity to co-found a $2,000

Fellows program. The program’s online

12

FA L L 2 0 2 2

nature meant she could save commuting

mindfulness, time management and active

held a number of teaching positions,

fees from her home in New Jersey. But,

listening on social media while Covid was

including serving as a course expert and

she admitted she was also worried that

still challenging campus life.” Through

a graduate teaching assistant for three

she would not be able to “build that

the program Chaudhry also met Chelsea

courses at Tandon: Information Security

same sense of community” that she

Garbell, Associate Director for Global

and Privacy, Cloud Security, and Mobile

would have experienced had she chosen

Spiritual Life at NYU, and became

Security. When she reached out to NJIT

an in-person program.

a Spiritual Wisdom Fellow, giving

about adjunct work, she explains that

her the opportunity to learn more

they “actually were willing to offer me the

about various faiths. “All these different

opportunity to interview for a university

Make the most of any opportunity you may get Contrary to her concerns though, NYU, which she described as, “my dream school, the school I always aspired to go to but just never thought I’d be

experiences really catered to me as a person,” Chaudhry notes, adding, “I don’t think I would have been able to get these experiences outside of NYU.”

lecture full-time position. But I think that having industry experience is invaluable to teaching, because you bring in an added perspective that you simply cannot just get out of theory and textbooks. So that

able to afford,” not only helped her

Keep the big picture in view

find community, but also allowed her

A big takeaway from Chaudhry’s

to grow in ways other than than just

experience is the value of thinking things

academically or professionally. Signing

through. “I have always been a person

She concludes by saying, “ I think it’s

up for the NYU RADical Health program,

who did the long range plan. When I

just such a beautiful experience being

a four-week interactive experience to

started at New Jersey City University,

able to connect with students, seeing

help incoming first-year students “build

I mapped out my entire degree within

them grow. You really feel like you’re

mental, emotional, and spiritual health,”

two years in my first semester.” Now she

making an impact. I’m not saying that

Chaudhry found it “opened a number of

is approaching her professional career

you can’t make an impact at a corporate

doors at a most opportune time” as she

the same way. “I definitely want to make

level but it’s a different type of impact

became a mental health ambassador

a long term commitment to teaching,”

and, as a first generation student it really

for NYU students “promoting self-care,

she observes, noting she has already

feels so precious.”

13

is the reason that I want to pursue both side by side.”

FA L L 2 0 2 2

CCS EVENTS

Xu (Advisor: Dr. Quanyan Zhu). Yunfan

tools in the market. The interest from the

showcased ISCRAM, a tool for Supply

crowd took us by surprise since we were

Chain Risk Analysis and Mitigation. It

competing for attention with AI bots and

THREE CCS-AFFILIATED PROJECTS SPOTLIGHTED AS RESEARCH EXCELLENCE EXHIBIT RETURNS TO TANDON

provides analysis and decision support

other admittedly compelling things. But

to reduce systemic risk from suppliers in

it was great to see attendees starting to

complex IoT systems.

think about the cybersecurity of their

The 2022 Research Excellence Exhibit returned to the Brooklyn Commons on April 29th, marking another step towards the school’s return to in-person, oncampus events. From 1 to 4 p.m. the

Exposing Encrypted Wireless Data Transfer

smart devices.”

in Wearable IoT Devices, presented by

AI-Driven Interactive Safe Autonomous

Masters students Sumish Pal Singh Ajmani

Driving, presented by Ph.D. students Tao

and Karan Parikh (Advisor: Dr. Danny

Li (on the left in photo below) Haozhe Lei

Huang)

(right) and Dhairya Upadhyay (Advisor:

This presentation reported on the very real

Dr. Quanyan Zhu)

risk of data, such as personal health data,

As explained by Tao Li, the project

financial information, and live locations,

“presents a safe autonomous driving

being inadvertently shared via wearable

technology powered by artificial

IoT devices, particularly when connected

intelligence. The autonomous vehicle

to home WiFi or a phone’s bluetooth.

learns an online adaptation strategy

“What makes our research unique is not

accommodating different traffic

just the tangible thing you might build as

participants and environmental conditions

a result, but the ability to make people

based on its prediction of future traffic

think differently,” Sumish Pal Singh

conditions. This project demonstrates that

Ajmani told a writer for NYU Tandon News

AD has the potential to reduce automobile

Supply Chain Security Risk Analysis and

covering the event. “We wanted to spread

accidents, save thousands of lives, and

Mitigation in IT/OT and IoT Systems,

awareness by showing how easy it is for a

roughly $190 billion in health care costs

presented by then Masters student Yunfan

user to get fooled by new cyber security

every year.”

exhibit showcased 36 student projects that represent work in the school’s seven areas of research excellence: Communications/IT, Cybersecurity, Data Science/AI/Robotics, Emerging Media, Health, Sustainability, and all things Urban.

The three projects representing cybersecurity were:

14

LIVE FROM NEW YORK: CSAW IS BACK, NOVEMBER 9-12 After two years as a virtual event, CSAW’22 returns to NYU Tandon’s Brooklyn campus, live and in person. The 19th edition of the world’s most comprehensive student-run cybersecurity event will kick off its schedule of seven competitions, panel discussions, poster sessions, and more on November 9.

In a preview of CSAW events to come, the final presentations of the Hack 3D Summer Challenge were held on July 15 as the centerpiece of a day of talks on security issues in digital manufacturing. The competition winners, who received cash prizes and are now eligible to compete in November’s finals, are: First Place ($750 cash prize): Neo, Indian Institute of Technology, Tirupati, India Sneja M S, Sirish Sekhar, Prabhat Reddy Second Place ($500 cash prize): Hack3rm3n Kevin Jun, Lehigh University; Aryan Rastogi, Indian Institute of Technology, Indore, India; Abhishek Sridharan, National Institute of Technology, Tiruchirappalli, India Third Place ($250 cash prize): Missile Pav Aakar Jain, Purdue University; Diksha Sharma, Symbiosis International University, India; Vishnu Bansal, Birla Institute of Technology and Science, Pilani, India; Sumiran Maiskar, VIT University Other events were still in the planning stages at the time this issue went to press. Go to https://www.csaw.io/ for the latest news and announcements. CyberByte will publish a wrap-up of CSAW 2022 in its spring issue.

15

FA L L 2 0 2 2

TANDON HOSTS VISITING DELEGATION OF CYBERSECURITY FACULTY FROM EASTERN EUROPE This spring, the Center for Cybersecurity played host to two different groups of academics from eight Eastern EU countries seeking to learn more about cybersecurity education and practice in the U.S. As part of a program sponsored by World Learning, with funding from the Polish-American Fulbright Commission, 30 cybersecurity professors traveled to Tandon during a New York City between March 21 and April 4, 2022.

The overall goal of the program is to facilitate an “understanding of the US academic and practical landscape of cybersecurity” for faculty from Lithuania, Latvia, Poland, Hungary, Bulgaria, Estonia, Slovakia and Romania. In particular, the professors were interested in: • Curriculum examples • Preparing students for competitions • Research and research collaboration • Collaboration between academia and industry.

During their time at NYU Tandon, the group learned more about the history of cyber research at Tandon, the role of OSIRIS in CCS programs, an overview of cybersecurity educational programs at Tandon, and the Center’s partnerships with industry. They also toured the 10th floor, attended lectures by Dr. Hammond Pearce, research assistant professor with NYU’s Center for Cybersecurity, and Dr. Damon McCoy, associate professor of computer science and engineering; and received a virtual welcome from Dean Jelena Kovačević.

After the visit, Matt Brown, director of global programming for World Learning, observed that, “the visits to your Brooklyn site were perfect. The sessions were right on target, exactly what our participants were looking for, and with wonderful speakers all around. All of us at World Learning, Fulbright Poland, and the participants, appreciate the time you and your NYU colleagues took to prepare and deliver your talks, and to show us around your premises.”

16

FA L L 2 0 2 2

CCS NEWS

TRAPS PROJECT TO SECURE POWER SYSTEMS RECEIVES DOE GRANT U.S. power systems represent an increasingly desirable target for cyber

+

= TAF

hackers. An IBM report, cited in The New York Times in May, 2021, noted that “the energy industry was the third most targeted sector for such attacks in 2020, behind only finance and manufacturing.”

To address this issue, the U.S. Department

KEEPING THE TRUTH INTACT: TAF HARNESSES TUF TO CREATE SECURE LEGAL ARCHIVES The Update Framework (TUF) (https://theupdateframework.io/), which has secured software updates on automobiles, cloud applications, and for community and commercial software repositories, has ventured out in a new direction: secure archiving of legal documentation. Earlier this year, Dr. Justin Cappos, whose Secure Systems Laboratory at

of Energy announced on April 21, 2022, that it was committing $12 million in grants to fund initiatives to better secure the U.S. energy infrastructure. The grant program named six university-based programs as grant recipients, including NYU Tandon School of Engineering.

NYU Tandon is home base for TUF, announced a new initiative with the Open Law Library

Tandon will use its three-year, $1,939,416

called The Archive Framework (TAF), a system designed to protect any git repository,

grant to develop a new program for

particularly those on which important digital documents, such as legal records or

identifying and addressing vulnerabilities

legislation, are created.

in power grids. Dubbed “Tracking Real

In an interview conducted late last year with David Greisen, Founder and CEO of OpenLaw Library, and Renata Vaderna, a software engineer at the company that did the programming on TAF, Greisen noted that TAF was designed to address a very specific security issue. While version control systems like GitHub can give the user control over multiple versions of a document, it has potentially serious liabilities in protecting both the

Time Anomalies in Power Systems” or TRAPS, the NYU initiative will be a collaborative effort with researchers at SRI International, the New York Power Authority, and Consolidated Edison.

content and the sequence of changes made within a document. By building on Git but

NYU’s efforts will be overseen by

integrating TUF to address the security issue, Greisen explains, users have a way to check

Dr. Farshad Khorrami, a professor of

the validity of documents and verify the authenticity of pull requests and other changes

electrical and computer engineering

to the document. According to Cappos, who is an associate professor of computer science

(ECE) at NYU. Dr Ramesh Karri and Dr.

and engineering at NYU Tandon, TAF uses the delegation, role, and key management

Prashanth Krishnamurthy, both from the

structures of TUF in order to provide long term security and resilience to attack.

ECE Department at Tandon, serve as co-

The Open Law platform (https://openlawlib.org/) was initially created at the request of

investigators.

the city of Washington, DC, which wanted to use it to publish their legal code. What Open

In announcing the awards, U.S. Secretary

Law was able to do was “take all the tools of computer science and apply it to

of Energy Jennifer Granholm notes that,

the codification process.“

“investing in cutting-edge cyber security

Recently, OpenLaw received a grant from the Institute of Museum and Library Services (http://www.imls.gov) that will help them improve the storage of metadata and enhance the signing process on their platform. One particular issue they will be addressing is how to ensure the continuing authentication of data. As Greisen points out, “Law does not fit the space/time continuum of other security systems” largely because the “shelf-life” of legal documents “encompass not years, but decades and centuries.” If, for example, a jurisdiction ceases to exist, TAF is designed to enable other authorities to attest to the authenticity of the original publisher. “In a sense, it protects by leveraging the built in trust in institutions,” Greisein says.

Perhaps most importantly, in an era of deepfakes and disinformation, TAF offers a way to make sure legal records for a government entity or complex transactions in corporate law reflect the truth over time. “The demand for nonfungible-tokens (NFTs) shows the hunger for this type of service,” Greisen observes. Cappos concurs, noting that, “We’re proud to work on projects like these that ensure that history itself cannot be rewritten.”

17

technology keeps us at the forefront of global innovation and protects America’s power grid in the face of increasing cyber threats from abroad.” She adds, “This funding will bolster our commitment to a secure and resilient clean energy future by fortifying American electricity systems and building a stronger grid.”

FA L L 2 0 2 2

AWARDS AND HONORS

the materials engineering field, Gupta was

Among Gupta’s other research pursuits

singled out for “pioneering contributions

are using machine learning tools to reverse

to the science and technology of

engineer printing orientation to discover

lightweight polymer and metal matrix

the makeup of proprietary materials. With

composites.” Gupta, who is also affiliated

support from the United States Agency for

with the Department of Civil and Urban

International Development (USAID), he is

Engineering, and the NYU Center for Cybersecurity, was also recognized for exceptional dedication to educating the public about scientific discoveries.

Over the past few years, Gupta has been the focal point of initiatives at NYU promoting emerging 3D manufacturing technologies, and strategies to protect them from cyber risks. His recent technical accomplishments in this area include developing a method to hide secret codes in printed parts in order to verify that parts’ provenance (https://engineering. nyu.edu/news/researchers-turn-trackingcodes-unclonable-clouds-authenticategenuine-3d-printed-parts). He has also

GUPTA NAMED AN ASM INTERNATIONAL FELLOW Dr. Nikhil Gupta, Professor of Mechanical and Aerospace Engineering, was recently named a Fellow of ASM International. In doing so the global organization of more than 20,000 members recognizes Gupta

advocated for increased research in this area by regularly putting together panel

also exploring how to create a “zero waste paradigm” for lithium ion and lead acid lithium-ion batteries.

Gupta is also a recipient of the Young Leader Professional Development Award and the 2020 Brimacombe Medalist Award, both from the Minerals, Metals, and Materials Society, the ASM International Silver Medal, and a Visiting Lectureship Award from the ASM-Indian Institute of Metals.

In acknowledging the honor, NYU Tandon Dean Jelena Kovačević states, “Nikhil’s election to the elite ranks of ASM Fellows is a well-deserved acknowledgement of his scholarship, research, and mentorship of

discussions and workshops on the topic.

students.” She adds, “It also speaks to the

Last summer, he also helped organize a

quality and innovative work of our faculty

program to bring together undergraduates

in all of our areas of excellence.”

from India and the U.S. to work on research initiatives in cybersecurity and 3-D manufacturing. Supported by a three-year grant from the National Science Foundation

for making “significant contributions in the

(NSF) International Research Experience

field of materials science and engineering.”

for Students (IRES) program, the initiative

Considered one of the highest honors in

will be repeated in 2022 and 2023.

18

FA L L 2 0 2 2

AWARDS ROUND-UP

• Drifuzz: Harvesting Bugs in Device

In a segment of the June 1 podcast “What

Drivers from Golden Seeds. Zekun

That Means with Camille,” part of Intel’s

Congratulations to Brendan Dolan-Gavitt

Shen, Ritik Roongta, and Brendan

Cyber Security Inside series, Ahmad and

(picture above left) and several of his

Dolan-Gavitt. USENIX Security.

Chowdhury answered questions about

students who have presented papers at a

August 10–12, 2022.

strategy and solving the challenges

number of top conferences over the past few months, and have garnered a few awards in doing so.

• What the Fork? Finding and

HACK@DAC: At last year’s HACK@ DAC competition, NYU’s Center for Cybersecurity claimed not one but two

of the competition. The podcast is available at https://www.youtube.com/ watch?v=3fBfS163oDg,

places in the winners circle. The event,

GRADUATION AWARDS: The following

Analyzing Malware in GitHub Forks,

held December 2021 as part of the Design

CCS-affiliated individuals were honored

Alan Cao and Brendan Dolan-Gavitt,

Automation Conference, is a Capture the

with 2022 department and university

Workshop on Measurements, Attacks,

Flag-style competition that challenges

awards. Note that all three of these

and Defenses for the Web (MADWeb),

participants to find security weaknesses

individuals are spotlighted elsewhere

co-located with NDSS. April 28,

in hardware (https://hackatevent.org/

in this issue.

2022. Winner of a Best Paper

hackdac21/).

Runner Up Award.

•A sleep at the Keyboard? Assessing

CSE Leadership Awards

First place in the competition went to

(Undergraduate)

a team composed of Ph.D. candidate

Alan Cao, Rising Senior

the Security of GitHub Copilot’s

Baleegh Ahmad (photo above center), Dr.

Code Contributions. Hammond

Benjamin Tan (now an assistant professor

Pearce, Baleegh Ahmad, Benjamin Tan,

at the University of Calgary) and Abdul

Brendan Dolan-Gavitt, and Ramesh

Khader Thalakkattu Moosa, all of NYU,

Karri. IEEE Symposium on Security

and Wei-Kai Liu from Duke University,

and Privacy. May 23-25, 2022. Winner

while Tandon Ph.D. candidate Animesh

of a Best Paper Award.

Chowdhury (photo above left) who took

• I RQDebloat: Reducing Driver Attack Surface in Embedded Devices.

third place, was a team of one, with support from Dr, Ramesh Karri.

Zhenghao Hu and Brendan DolanGavitt. IEEE Symposium on Security and Privacy, May 23–25, 2022.

19

Pearl Brownstein Doctoral Research Award Laura Edelson Inclusive Excellence Award for the Cyber Fellows Program Kiran Chaudhry

CENTER FOR

CYBERSECURITY cyber.nyu.edu