RHUL Cyber CDT Blog

A while back, I had the pleasure of joining IEEE Security & Privacy (S&P / Oakland) and the Workshop On Offensive Technologies (WOOT) on behalf of Royal Holloway. In part, this was to present my latest research project at WOOT: an online puzzle game where solutions off-load exploit writers and aid vulnerability severity analysis. In S&P, Royal Holloway presented multiple more projects. Guido from the S3Lab presented his work on the formal analysis of web payment APIs. Through their analysis, they found two vulnerabilities that could be leveraged by online vendors to overcharge the customer, e.g. by forcing to pay the required amount with multiple payment methods. The vulnerabilities have been acknowledged and patched, making the world a safer place. We also had a great (online) presentation from Lenka on security properties of Telegram. They studied the non-conventional symmetric cryptography used in Telegram under normal usage, exploited the flaws, and both propose a fix...

Prior to joining the CDT, I was finishing my Masters in Electronic Engineering and working at an industry placement one day per week. The short time I had working in industry was great fun. I’d met lots of interesting people and found a great team of exceptional colleagues to co-develop my skills with. My decision to apply and join the CDT programme was based on the amazing opportunities it provided. A funded venture, to peruse my own research ideas and collaborate with a cohort of world-class researchers with similar interests was too big of an opportunity to miss. Whilst my industry work was interesting and deepened my skillset, it was mainly applied work. I re-used components developed by other people and glued them together to create new applications. It was fast-paced and exciting, but never completely novel. I had a passion to give back to the open-source community and create something original for myself. The CDT structure allowed me to spend the first year exploring many av...

Third year CDT student Stephanie Itimi has had a busy start to the summer, promoting Seidea (a career development platform she formed aimed at helping black and ethnic minorities build career in cyber security), speaking at conferences and visiting Senegal! Catch up with her great interview with peepsec and read her stories in the links below PeepSec Conference https://peepsec.com/peepsec2022/stephanie-itimi/ Cybersecurity is a growing concern in today’s digital world. I was invited to speak at CybSafe's June PeepSec conference, which addressed the human side of cybersecurity. I spoke about how we can diversify our cyber security efforts and create more opportunities for people who want them. Increased investment in training programs helps bridge gaps that can arise when it comes to hiring employees or developing new strategies. If you don't have enough talent, how effective are our cybersecurity policies, not only at the micro level, but also at the macro level? The UK is faci...

> … Loading, 30 seconds until player two enters the game I appear to be in some sort of train carriage. I look down. My shoes have morphed into some rather fetching cowboy boots, my hands are clad in leather gauntlet-style gloves. > … 15 seconds until player two enters the game Furiously I attempt to discern how to move, hesitantly waddling forward, wary of my unfamiliar surroundings. > … 5 seconds until player two enters the game I turn to face the door of the carriage. > … Start game The door violently swings open and I am met with a veritable blizzard. The scene clears. I am under a moonlit sky. I am on a moving train. Up ahead there is movement. This must be my opponent – the much-vaunted player two. I look down to my hand. I am holding a pistol, a shiny silver pistol. I lift my hand and take aim, expecting a flurry of fire to down my adversary. But my shiny silver sidearm does not flurry. Instead, what can only be described as a slow moving, fluorescent blue orb emerge...

When was the first cyberattack? Your answer to that question might depend on how you define the term ‘cyberattack’. It also might depend on how far you think the public record is complete in this area. It was this knotty tangle of conceptual disputes, secrets, and mysteries that participants sought to address at a recent workshop organised by the University of Warwick: ‘Cyberattacks and covert strategies in perspective: the long history of the future’. The workshop brought together academics from intelligence studies and history, cybersecurity and cyber conflict studies, and security studies more broadly. Among other themes, the panels at the event examined the early roots of state cyber operations, focusing primarily on the US and the UK. As the workshop organisers noted, it is important that academics looking at cyber operations not succumb to the ‘shock of the new’. The means of a state cyber espionage operation may be new, but espionage, deception, and subversion are all very old. ...

This April, many CDT cryptographers headed to Amsterdam to attend the Real World Crypto conference . For many, this was our first ever conference, and for almost all of us, the first conference since before the pandemic. RWC itself had already been rescheduled from January of this year due to a surge in cases in the Netherlands. RWC is intended as a conference for both academic researchers and industry professionals, with delegates from many organisations who design and implement cryptography in the wild. The program is designed to have talks with high real world impact - this year, the theme for the invited talks was Cryptography in the Ads Ecosystem, where representatives from Meta and Google Chrome spoke about their understanding and solutions to reconciling users’ privacy and effective advertising using cryptographic primitives. It was really great to finally be able to attend a conference in person after so long! Although the pandemic has led to many conferences being held onl...

It is no surprise that in 2022 fears around cyber incidents potentially impacting elections run high. Since the 2016 interference reports against the US presidential election, concerns over cyber threats to the electoral system have been on the rise around the world. And Colombia is no different. With the legislative elections having passed in March, and the first round of the presidential elections due in May, Colombians have been seeing a stream of warnings from media outlets of possible cyber incidents . In February, during a speech given at a Plenary Session of the European Parliament, Colombian President Iván Duque discussed the need for Colombia to “ be able to protect its democracy against external influence or interference, [and] of those who intend to manipulate algorithms or those who intend to generate hatred and division” [1]. By early March the National Registrar, Alexander Vega, revealed that the National Civil Registry website had seen 400,000 cyber-attack attempts ...

During the lockdown I was researching the implementation of sandboxes with mobile operating systems on the internet. After producing a program to survey these platforms and setting up a reporting server I was able to ascertain that sensor implementations were vulnerable to trivial attacks because of the lack of dynamic values witnessed during the survey. I furthered this work by looking into how researchers would run malware samples on local physical devices which would report the results and then be reset ready for the next execution. This setup has the benefit of including all the sensors of a mobile device and real-world readings.   I decided to imitate such a setup at home using a physical device attached via USB to a reporting server to see if I could exploit the real-world readings to tell me something about the nature of the app analysis. From this I created an app that contained a reverse Turing test to act as a trigger for malware only when a device is performing a recogni...

In this short piece I will discuss my PhD journey during COVID-19, highlighting some of the issues I faced, how I overcame these and providing recommendations to help others in the same position. Of course, first and foremost, the COVID-19 crisis is a global health crisis, and people have been put in much worse situations than their PhD research being delayed. I was fortunate that the EPSRC granted me an extension for my research, a great benefit that was not extended to many other PhD students from different disciplines. However, social distancing has been essential to minimise the spread of COVID and for many researchers this represented, and still does, a change in fieldwork methods, write-up strategy, as well as changing the way we interact with our cohort and supervisors.   1) Field Work When we went into the first lockdown in March 2020, I had just found an organisation (a global law firm) willing to let me conduct my research with their employees. The plan was to spend ...

In mid-February of this year, our team (First year CDT students, Rebecca Hartley, Alex Hodder-Williams, Sasha Lapiha, and Taylor Robinson) participated in the Cyber 9/12 Strategy Challenge. Our team was coached by former Cyber 9/12 participant and coach Nick Robinson and received additional valuable assistance from Ian Slesinger. The annual event, which was virtual this year, requires competitors to propose policy options to a panel of judges (acting as if they are from the Prime Minister's offices) responding to a fictional scenario involving a cyber threat. The competition aims to provide participants with an understanding of the technical, social, political, and economic impacts of cyber security events.   Our team entered under the name "Polymath" which we wanted to reflect the multidisciplinary backgrounds of our members, representing many disciplines ranging from maths, computer science, international relations, and business. This year's fictional scenario evolv...

Below we hear from third year student Neil Ashdown, who was awarded joint fourth place in a Defence Science and Technology Laboratory (Dstl) student competition in which students were asked to write an essay about potential threats and opportunities.   In July last year I submitted an essay to a competition organised by the UK’s Defence Science and Technology Laboratory (Dstl). The question posed by the competition organisers was: “what do you believe to be the future threats or opportunities facing UK defence and security over the next 25 years?” The results of the competition were announced in December and my essay – ‘Sensemaking, systemic competition, and the social compact’ – was among those chosen for publication by Dstl. You can read the essays here. Recurrent themes across the papers include the societal impact of disinformation (as in the essays by Edward Holland and Fearghal Hughes) and the potential for cyber-enabled disruption of critical infrastructure (as examine...

The CDT are delighted that three of our students were among the winning entries in our College-wide competition inviting students to submit a creative response to climate change and related issues of sustainability.   Students were asked to consider climate change and the impact that it is having and will have, both in terms of the global context and at a more local level.  They were encouraged to respond to the 2021   IPCC report , which was unequivocal in placing responsibility for climate change with human action. We suggested reflecting on how the   COP26 global conference  i n Glasgow, which has been described as a “pivotal moment” for change, could also be seen as a point from which to reflect on our agency as individuals, our relationships, and responsibilities to the broader communities, including that of the university, to which we belong. Entries took many forms: creative writing, visual arts, film, digital projects and essays. The judg...

I joined the CDT in 2016, having graduated months earlier with a degree in mathematics. As an undergraduate, I loved pure mathematics, and was excited to learn about cryptography as an application of this. I quickly realised that I wanted to pursue this interest further. I started looking at options, and it didn’t take long for the CDT to show up in my search results. It seemed a perfect fit - a broad training structure in the first year would allow me to expand my knowledge and, as I hadn’t chosen a specific research subject, give me time to pick a topic. I applied and was thrilled to receive an offer to join the CDT. Upon arrival at Royal Holloway, I was surprised (and a little intimidated) by the scope of information security – I had not thought beyond cryptography! However, the activities and classes of the first year helped to make this subject more accessible (and definitely expanded my knowledge). At the end of my first year, I completed a summer project on formal definitions of...

The CDT recently hosted a hybrid engagement event at Cumberland Lodge in Winsor Great Park. This was an exciting event for us to host as it provided an opportunity for us to bring together students from across the cohorts (many meeting for the first time), to reconnect students and staff, and for everybody to share what they've been up to. We had great attendance at this event with many staff and students choosing to join us in-person (following covid measures), and others joining in online. There was a packed programme, full of student talks to update us on their research, some interesting presentations from students who have recently returned from internships, and some engaging sessions from some of our recent graduates in which they delivered an inspiring message and words of wisdom to those who are just at the beginning of their CDT journey. Below we hear from Professor Chris Mitchell, Head of Information Security Group at Royal Holloway with his thoughts on the event.  I had t...

Just a few months ago I was at the beginning of my doctoral research journey. Four years can seem like a daunting task but within my first week as part of the CDT at Royal Holloway, I felt reassured that I was best placed to achieve my goals. I feel so lucky to have had the opportunities to meet some of the best academics in the cybersecurity field. I have also thoroughly enjoyed meeting my fellow CDT cohort and I have learnt a lot already from some of the older CDT students.   It has been exciting to learn of, and experience, the inter-disciplinary nature of the course. I originate from the field of Psychology but I am thrilled to have the opportunity to take on new areas of study and new perspectives surrounding security. Within the short time I have been here, I have had many interesting perspectives provided to me from my peers, lecturers, and independent study.   The first year of the CDT involves taught modules from the Information Security MSc at Royal Holloway...

  "This article was first published in the August 2021 issue of Inside Time, the UK's National Newspaper for Prisoners and Detainees" Since the start of the pandemic, purple visits has operated the video calling service at prisons in England and Wales - but in the summer it was announced that a different provider, Phonehub will take over. Here, Natasha Rhoden describes some of the problems users had with the purple visits service. This past year of Covid-19 lockdowns has spawned new ways to stay in touch with loved ones across the country. It is possible that video calls for prisoners and families introduced in response to the lockdowns may be here to stay. However, to ensure that video calling meets the needs of prisoners and their families, their views on the service will be crucial. I wanted to understand more about how prisoners and their families experienced this change from face-to-face visits to video calls, and how this experience might be improved. My end goal wa...

I passed by PhD viva in March 2020 and currently work as a research scientist at Cambridge Quantum in the quantum crypto team. My role is to explore classical alternatives to quantum schemes so that we can investigate quantum advantage, if/when it exists. There are several aspects of my time in the CDT which have already shown their value in my new role. Firstly, unlike a traditional PhD, the CDT gave us no specific topic to study but instead encouraged us to look at anything related to cyber security. I found the lack of concrete direction challenging at times, and was rarely in my comfort zone. However, the experience of diving into new areas, trying to figure out what the current problems are and what useful things I might be able to say has prepared me for the uncertainties of research. As I am no expert in quantum physics, in my current role I continue to stay outside my comfort zone, diving into new areas and figuring out what useful things might be said. In some ways, it feels ...