Cybersecurity Expert Stefan Savage Elected to the National Academy of Engineering

Making cars safe from cybersecurity attacks

Perhaps the broadest-reaching work Savage undertook is focused on cybersecurity–or lack thereof–in cars. 

A team co-led by Savage and Yoshi Kohno, a UC San Diego Ph.D. alumnus now a professor at the University of Washington, first found cybersecurity vulnerabilities in automobiles. They showed that they could take over a sedan while having direct access to the vehicle as well as remotely. They were able to control the car’s engine, brakes, lights and more. 

“It was this work, and uniquely this work, that forced the automotive industry to significantly invest in security,” Savage said. 

General Motors went from having a few cybersecurity experts scattered around the company to creating a cybersecurity team of more than 100, with a chief information security officer at its helm.

The National Highway and Traffic Safety Administration created a laboratory dedicated to cybersecurity testing. DARPA and the Department of Homeland Security both created programs to try and develop solutions to car-related security issues. 

In addition, the Society of Automotive Engineering, which is the group dictating standards for the U.S. automotive industry, created a cybersecurity working group and has released two generations of security standards for cars. 

Throttling email spam

Savage also co-led a team with fellow UC San Diego computer science professor Geoff Voelker focused on better understanding the business of cybercrime. The effort was funded by a five-year, $10 million from the National Science Foundation to map out illicit activities taking place in the cybersecurity underworld.

Savage and colleagues were able to identify a critical bottleneck for spam email campaigns and online counterfeit goods transactions: only a few banks accept the credit card transactions necessary for these online ventures to monetize their activities. These findings allowed drug and credit card companies to disrupt the business models of several counterfeit drug rings to such an extent that they collapsed. One such example was shutting down all merchant accounts involved in receiving money from the sale of counterfeit Microsoft software online. As a result, it was largely impossible to buy counterfeit Microsoft software online for 18 months. The researchers’ work is described in more detail in Brian Krebs’ book “Spam Wars.” 

Many of the techniques the team pioneered, including the automatic classification of malicious Web links and tracking the price of accounts sold on the black market to measure the effectiveness of anti-abuse mechanisms (e.g., such as CAPTCHAs) are now standard practice at major online companies such as Google, Microsoft, Facebook and Yahoo.  
 

Tracking cryptocurrency transactions to fight crime

One of Savage’s Ph.D. students, Sarah Mieklejohn, with support from his research group and colleagues, developed transaction clustering techniques to trace cryptocurrency payments on the dark web. Mieklejohn is now on faculty at University College London. 

The techniques developed at UC San Diego were adopted by the private sector and  law enforcement to track down criminals who used Bitcoin for illicit transactions. WIRED reporter Andy Greenberg has detailed this work in his new book, “Tracers in the Dark.” 

Cloud security and denial of service attacks

Savage and another UC San Diego Ph.D. student, Tom Ristenpart, now a professor at Cornell Tech, with colleagues now at UT Austin and Columbia, did the first significant work on cloud security. They showed that having computations from different organizations running on the same hardware creates side channels, which are a real security risk.  As a result of this work, cloud providers started offering products that guarantee a given set of servers will only handle that specific client’s computations. 

Earlier in his career, Savage and fellow computer science professor Geoff Voelker worked to better understand denial-of-service attacks that disable servers linked to the internet by overloading them with messages, which usually contain false source addresses (“spoofing”) to conceal the location of the attacker. They used key features of those forged addresses to detect and track the attacks. The resulting measurement infrastructure, known as the UCSD Network Telescope, has been used by countless groups to measure Internet activity.

In addition, the data researchers obtained on worms, as part of this work, allowed them to show how existing models of how disease spreads could be applied to viruses and worms on the Internet. Based on that research, the Department of Defense made significant investments into research to address these threats.

Brief bio

Savage received a bachelor’s degree in applied history from Carnegie Mellon University in 1991 and a Ph.D. in computer science from the University of Washington in 2002. He is part of both the Systems and Networking Group and the Security Group in the Department of Computer Science and Engineering at the UC San Diego Jacobs School of Engineering. He is also the co-director ofUC San Diego's Center for Networked Systems. He has published more than 150 peer-reviewed journal and conference papers in the wide-ranging areas of the economics of e-crime, characterizing availability, automotive systems, routing protocols, and data center virtualization. His Ph.D. students have gone on to work at prestigious academic institutions and Silicon Valley companies, including New York University, University College London, Google, Facebook and Microsoft.

He joins 32 UC San Diego-affiliated researchers who are NAE members.