Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
[KLAUDIA] My name is Klaudia Krawiecka,
I'm a CDT cyber security student at the University of Oxford.
I work on introducing novel, behavioural biometric systems based on
naturally occurring interactions with objects in smart environments,
in Internet of Things (IoT) environments and augmented reality environments.
So, profiling people based on how they interact with devices around them.
The biometric that I propose leverages existing sensors to both identify and
authenticate users without requiring any hardware modification of existing
smart home devices. It doesn't require any specific gestures,
[you] just interact with environment.
The system is designed to reduce the need for phone based authentication
on which current smart home systems rely.
I conducted a real world experiment that involved 38 participants
in both a smart office environment and private smart household.
I used this experiment to, not only collect the data for identification purposes,
but also to study mimicry attacks.
What's interesting about this (and novel) is that it operates in three modes:
the first uses only the sensors embedded in devices that the user interacts with.
Another mode only uses co-located sensors (sensors on nearby devices).
Lastly, it operates in combined mode that is a mixture of both.
So that's in a nutshell what I'm working on currently.
[CLAUDINE] Could you explain what authentication is?
[KLAUDIA] The system can perform both identification and authentication.
Identification is when we classify users into individual profiles per person.
Can the system recognise whether it's mother or father or child interacting?
Authentication is - do they get permission to operate certain devices?
E.g., financial transactions would not be available to children.
The system, after identifying who is currently interacting, should make this decision.
That's the distinction between the two [concepts] I'm looking at.
Authentication (who can do what) and identification (do I recognise you?).
[ARI] What is it that you're curious about?
[KLAUDIA] We have lots of different smart devices on the market.
We have plenty of vendors. One of the things that's annoying about setting up
your own environment is the cross-platform interaction (or lack thereof)
each device from different vendors will have a different app,
you operate these devices through the app - authenticating very differently.
It is a lot of hassle to use all of this securely.
There's also a problem with permissions, because you have cross-app interaction.
[An operation on one device]
may be permitting something on another device from another vendor. It's tricky.
I'm trying to develop a method that will work for all and look at usability aspects.
[ARI] Why do we want to think about usability? Why is that important to you?
[KLAUDIA] Asking people for passwords, PIN codes or gestures... it's a hassle for
the user. What I'm proposing and looking at is - can we make it more usable,
more natural for the user to authenticate, to identify devices in an environment.
That's why I started doing this research. I was curious - can we make it usable?
We have a lot of amazing security platforms and systems and tools, but
users are just not able to use them. So can we do something that will be easy to
use, and will be used by the user? There's so much good research, but it's unusable.
That's my motivation, and that's where my curiosity lies.
[CLAUDINE] I'm curious how, over the last few years your ideas around what
usability means has changed as you've gone through all of these challenges
and dealt with all of these practical problems.
[KLAUDIA] I come from an applied engineering (software engineering) background.
Until my Masters research, usability wasn't something I was thinking about.
I was like, "OK, if I develop this system and it works, fine!"
I was working on securing password databases on cloud servers.
I was collaborating with Intel, it was a new technology at the time.
It was hardware-based protection.
We asked - how do we convey (to users) which platforms are using our solution?
We came up with a web browser plugin to connect [to a server] and perform
something called 'remote attestation' to verify whether the server is running the
secure part that will protect data. For this study we had almost 100 users coming
to our office trying to use the plug-in, trying to spot whether the website was
actually using our solution or just trying to convince them [that it was secure].
Also known as... 'phishing attacks'. We asked users afterwards,
"What do you think about the solution? Would you use the solution?"
Many people said that it was a very interesting project, very easy to use.
Some of them also said, "I don't have that many things to protect".
And once you follow up with them and you ask, "What about medical records...?"
Then they start thinking about how inconvenient the password feels for them
and how they reuse passwords across different platforms.
They said [Klaudia's solution] was a lot of new things to learn and it didn't seem
seamless for them. It seemed something they would need to spend time on,
reading and researching, and that's why they wouldn't transition [from passwords]
So then I realised that things have to happen in the background.
It has to be easy to use, intuitive, because otherwise we waste
the potential of the amazing systems we have. In the end, we are doing this for
users, not for engineers. This is why this aspect became interesting to me.
[ARI] Security shouldn't get in the way. [KLAUDIA] Yeah, exactly. That's the thing.
It shouldn't get in the way. It should be there, it should be there for users
because that's what we want, we want to protect people and their data.
[ARI] What's the biggest challenge in your research, how have you approached it?
[KLAUDIA] Let's go back to the end of 2019, maybe the beginning of 2020.
When you do any research that connects to users and requires them to come into
the lab so you can gather samples... It became very tricky in the pandemic.
The biggest challenge was how to reach the user remotely - in their own houses.
If you invite [research participants] to a lab, it's an artificial setting.
In behavioural biometrics you want people to behave naturally,
which, in a lab they will not. With the pandemic and the knowledge that we
wanted to gather realistic samples.
I came up with a remote testbed for the participants.
We developed this plug and play experimentation set-up, sent
to people in private households so that they could connect all the smart devices.
They would get instructions (2-3 pages), video... we decided to progress this way.
You have different aspects that you need to consider, e.g., safety.
There were wires - people could trip. On university premises, we were insured
but outside, what then? We came up with a remote experimentation framework.
The system was called "Plug and play: a framework for remote experimentation in cyber security".
The biggest challenge that I had resulted in a very interesting research problem.
It allowed us to reach people we normally couldn't reach,
people with disabilities, for instance, that couldn't come to the lab.
This was the biggest challenge, but it was also, in a way, a blessing, because
we started thinking about all the other aspects and how to address them.
The first testing household we sent the devices to... we asked participants to stick
devices to surfaces they might, in the future, put a smart device.
We sent [adhesive] stickers but once devices got hot (because of
all the processing they were doing), they were falling off the walls.
This was something we didn't think of earlier. It was the first test household,
we wanted to collect data from them (due to the cost of shipping/procedures).
We couldn't. Devices were falling down - people didn't put them in the same place!
For us it was important that all users had devices in the same position/placement.
And then you get the data, you look at them [and there's something odd].
Fortunately, we asked for pictures of the set-up. Different days, different places!
When we asked why, [participants] said they were falling down,
so we had to put them somewhere else. We had to discard that data.
[ARI] What has been the biggest surprise in your research?
[KLAUDIA] Huh. That's a really good question.
Tied to this issue of the pandemic and inability to work with people directly,
is how the process of experimentation and doing something out of the typical
frame can be challenging. When we were developing this methodology,
we had to wait for approval for several months because it had to go through
all the safety committees. That can delay your research.
I was surprised to see no solution for problems like this. No guidelines.
This is not a very technical paper, but it's one of my proudest achievements.
It starts this discussion - we should improve the methods of experimentation.
We should improve formal procedures and take safety into account.
You need to be able to experiment with the user where they are.
Depending on your research work, you might take it outside the lab
because in certain cases, simulations are not reflective of natural behaviour.
I was surprised there was no formal method of dealing with
outside-of-premises experimentation. If you want to collect natural behavioural
samples from users - having that in the lab is not representative of behaviour.
People behave very differently, depending on where they are.
Are they familiar with the space? Is someone observing them? In a lab they
would be on their best behaviour, which is not what they would do normally.
What I learned is that, you can do amazing experiments and collect data...
But in the end, they may not represent what is actually happening.
We talk about the usability of systems to end-users,
but there's no usability in terms of how you experiment with users.
If you're going to give them flexibility to organise in the way they want to do it,
Make it usable, make it experimentation-friendly for the user.
There is a bigger issue of of making system interfaces usable.
So this is not the main thing I look at in my research, but this is certainly
something that I pay attention to and discuss in every paper I write now.
My supervisor says that I'm the usability person in our group because I always
think about it whenever we design experiments. I think it's important.
My [research] group is very technical. We are all from a computer science,
software engineering background. So it's easy not to think about [usability].
Then again, if you have smart devices or wearable devices (part of the IoT,
which is something that people interact with on daily basis), there are ways to
secure these devices (or data) for the environment they are in, without
interfering or asking [people] to understand something too technical.
[ARI] You've mentioned two different kinds of attacks so far. Phishing attacks:
we don't click on links in emails because it might take you somewhere
you're not meant to go, and so it might put viruses on your machine.
[ARI]: Tell us about [mimicry attacks] and how they relate to your work.
[KLAUDIA] Mimicry attacks are [copy cat] attacks - the attacker tries to mimic
the behaviour (e.g., gestures) of the victim, of the person who is able to
carry out financial transactions or access data [i.e., a user with 'privileges'].
[To defend against this group of attacks] You will look at how your system defends
and protects the user from someone copying their gestures/interactions.
In my work, I look at 2 kinds of this attack (it's the same attack in both,
the attacker will mimic the victim, but the observation period is different).
So two flavours of this attack: video-based and in-person observation.
Video based: we assume the attacker has video footage.
E.g., the attacker got access to a video recording of the local camera.
We allowed our participants (the attacking group) to watch the video
and then try to mimic the behaviour of the victim on the video footage.
In-person observation: let's imagine a smart-office environment. You have a
lot of colleagues, but you have a manager who can do things you can't.
Or you want access to a smart printer's history of another user.
You are a malicious colleague. You want to use the privileges of someone else.
You can easily follow the person because it won't be that suspicious.
You might be in the kitchen or next to the printer, you can observe how the
person interacts, how much force they put into the interaction...
Some of our participants looked at the time the person took to interact with
certain devices or the strength, the speed of certain interaction types.
Mimicry attacks will be the attacks in which the attacker tries to simulate
the behaviour of the victim to fool the system.
[CLAUDINE] Which strategies for mimicry attacks were more successful?
[KLAUDIA] We found, in the smart office, that video attacks were successful.
[Attackers] could observe the victim, and replay the recording.
What plays a key role here is the time of observation.
[The security system Klaudia was testing used nearby (co-located) objects which
took different measurement to make sure the right person was gesturing].
What I'm saying is, [mimicry attacks are] more difficult [with several sensors].
In-person, [attackers] could observe the victim from different angles. They could
observe the victim from different perspectives, video attackers couldn't.
The key factor [of successful attacks] was the time of observation.
[ARI] What was the experiment? What did you collect?
[KLAUDIA] There were two types of experiments.
1. General interactions in a private household. We sent devices, people
placed the devices wherever they wanted. They had instructions, we sent
a mobile device which connected to the internet, sending data to our server.
We collected data in real-time so we could quickly feed back to participants.
We asked everyone to do 20 interactions per device.
We gave them flexibility to do it over a day, over a few days...
The majority of them chose to do [all the interactions] on the same day.
(In future work, I want to see how behaviour changes over time!)
The smart office environment (that's the attack scenario) - we asked everyone to
do 20 rounds [of interaction] individually for baseline behaviour, to
see - if they are not trying to mimic the user, can they still fool the system?
They were divided randomly into two groups (one victim chosen randomly)
and the rest of the 12 participants (6 in each group) were either in-person
so they could observe the victim, or getting footage of the victim.
[ARI] What kind of device was it that people were interacting with?
[KLAUDIA] We needed good resolution of sensor data and sampling frequency.
[Smart device vendors could not provide products with high enough resolution]
[We wanted to know which sensors were most common]
We identified the most popular sensors: accelerometer, gyroscope and microphone.
We attached them to Raspberry Pi devices (a small computer)
emulating a smart device. I did a lot of soldiering and all the fun parts!
[CLAUDINE] How did the in-person observation work?
[KLAUDIA] They decided to set up the experiment in the office kitchen,
we asked the victim to do her 20 rounds so [attackers] could watch.
We invited attackers one by one to observe her interactions with devices.
Each attacker got to observe one full round of her interaction.
Attackers were not allowed to speak. They were not allowed to interfere.
[CLAUDINE] If you had unlimited resources, what would you solve?
[KLAUDIA] Two years ago, we looked at authentication for augmented reality.
With unlimited resources taking into account, metaverse coming up...
people moving their services, social interactions to a virtual environment.
This is something I would like to look deeper into. How can we authenticate?
How can we ensure the security of users in that environment, or while they are
using virtual reality or augmented reality glasses?
A lot of what I'm doing now for IoT devices can be mapped to techniques
used in augmented reality environments for how you interact with 3D objects.
[ARI] Thinking about new ways that attackers might steal identities...
how would you bring creativity into this kind of work?
[KLAUDIA] There are a few points you can look at securing (many points!)
One would be biometrics of your interactions with the object.
So continuous authentication - is the person using the glasses currently?
Imagine that you wear the glasses for, let's say, half of the day.
You share the glasses with your partner and they can access all your data.
They potentially see something you saw earlier in the day.
That seems like a huge privacy concern, we have to make sure the glasses can
recognise the user. Especially because this is still very expensive technology,
So it will be shared, at least in the beginning.
There is huge potential in looking at that and trying to solve this problem.
How to protect users from internal threats - family members, for instance,
or people they share equipment with. These things are with you all the time,
they record you. It's not like having a smart watch. Of course, having a smart
watch, you can tell where a person was, what activities they were doing. There's
plenty of things you can infer from that, but [with] VR glasses you'll have
plenty of different types of data that can be misused. Creativity should focus on
securing that... Another thing [to consider] is interface compromise.
Let's say you are driving. A commercial pops up, obscuring your view.
This is another area that people discuss - the safety implications.
There is a lot of creativity to be brought into virtual environments
because there are many things that can go wrong!
[CLAUDINE] Have you thought about using that environment to make users
aware of areas where they might be vulnerable to [mimicry] attacks?
[KLAUDIA] We will live in very interesting times soon - smart devices
all around you and wearables or augmented/virtual reality glasses
that could be used to record the person performing certain interactions
and using the interface to guide you. This is very interesting.
I might start looking at this. There was a paper a few years ago on a person
using glasses to record someone typing their password in a cafe.
Something we should think about is recognising whether users are
performing critical operations, or maybe they are in [restricted] areas.
[ARI] Do you have any tips for keeping up to speed with cybersecurity?
[KLAUDIA] One thing I find useful is the mailing list security[at]fosad.org
Interesting talks and research, different topics (machine learning, IoT...)
There are invitations to summer schools, workshops, reading groups...
[Everyone] interested in keeping up with conferences, papers, talks...
I highly recommend signing up to this mailing list.
[ARI] Do you have anything we can tell our listeners about?
[KLAUDIA] I'm co-organising a research session at the largest
European Women in Tech summit that will happen in Warsaw, Poland.
It's called "Perskpektywy Women in Tech Conference" [June 7-8 2022]
It's really exciting because it's in Poland, my home country.
There is a huge cyber security community coming, meeting, mentoring
There will be cyber security organisations. This is free of charge, we
have a lot of scholarships for students and researchers to attend.
It's a hybrid conference, so you can attend online.
It's a very interesting place to meet like minded people.
Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
and you can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. ARI: Bye!
CLAUDINE: This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.