The UC Berkeley School of Information (I School) and the Center for Long-Term Cybersecurity (CLTC) are pleased to announce that Trinity Chung, a Computer Science major at UC Berkeley, and Ansuv Sikka, a graduate student in the Master of Information and Cybersecurity program, have been selected to represent CLTC and the School of Information as RSA Conference Security Scholars at RSA Conference 2024, which will run from May 6-9, 2024 at the Moscone Center in San Francisco.
As RSAC Security Scholars, these researchers will connect with leading experts, peers, and conference attendees to share knowledge, experience, and connections to enrich the discourse on how to stay ahead of cyber threats. Trinity and Ansuv will present to RSAC attendees, potential employers, and fellow students at the RSAC Scholar Poster Board Session.
We interviewed Trinity and Ansuv to learn more about their research interests and hear their thoughts about this opportunity. Answers have been lightly edited for clarity.
Trinity Chung
UC Berkeley Department of Electrical Engineering and Computer Science
Trinity Chung is an undergraduate researcher at the Berkeley Laboratory for Usable and Experimental Security (BLUES). She is interested in investigating user-facing security issues, and more recently, building safe robots. Before entering cybersecurity, she was an engineering intern at NASA and a developer for computational biology software.
Poster Session Abstract:
Secure messaging apps use a variety of cryptographic techniques to protect user messages, but do side-channels like push notifications undermine end-to-end encryption? We investigated the implementation of push notification functionality in “secure” messaging apps in the Google Play Store. By default, Google’s Firebase Cloud Messaging (FCM) services ends the payload of push notifications in plaintext, thus leaking that data to Google. Over half of the apps we analyzed, which totaled over 2 billion installs, had undisclosed leakage of user data via FCM. These apps also specifically stated in their privacy disclosure that they do no tshare data with third-parties, suggesting that the app developers are unaware of the data leakage, or if they are aware, their mitigation strategy is insecure. Although we observed several strategies by which apps successfully avoided leaking data to FCM, none were consistent; different types of data were leaked elsewhere. Our findings emphasize a glaring issue: because Google’s FCM does not offer native mechanisms to protect user data in push notifications, developers are left to devise custom and often incomplete solutions, ultimately compromising user privacy. We call on Google, who controls the Android app ecosystem, to proactively address the entire class of data leakage via FCM by designing, supporting, and maintaining FCM software development kits that provide a private-by-default mechanism for Android developers to send push notifications to their users.
What are your primary research interests?
Usable security, robotics, and their intersection.
Why did you apply to be an RSAC Security Scholar?
My mentors highly recommended the program to meet others in security, and I was also excited about being able to give my first poster presentation!
What do you think are some of the most important emerging areas in cybersecurity?
For actively developing fields like robotics, there are often systems built without security in mind. There are also often policies that are stated but not well implemented/enforced, like the third-party privacy policies of the Google Play Store apps (which I will be presenting about). Aside new and popular emerging areas like AI safety, I think all of the “holes” that emerge when companies try to put security to practice is one that desperately needs to be addressed.
What are you most looking forward to about the RSA Conference?
I’m looking forward to hearing the superstars in security at the keynotes and networking with people!
Ansuv Sikka
UC Berkeley School of Information
As an avid cybersecurity researcher, Ansuv began working at Lockheed Martin’s Registered Apprenticeship Program to gain invaluable experience as a cyber software developer while attending George Mason University for a degree in Computer Science. Ansuv currently works at Parsons Corporation where he specializes in Computer network operations development. He loves to network and learn a wide range of topics, from cybersecurity to humanitarian crises at hand.
Poster Session Abstract:
The relevance of climate change and damage to our environment has been an emerging issue in recent times. At the 2023 RSA conference, climate change was considered to be a factor in the rise of cyber-attacks. However, has the opposite been considered? How can cyber-security breaches negatively affect our environment? This conundrum brings on the issue of what repercussions hacking may bring to our biosphere. We will specifically address the environmental damage that occurs when malicious software runs on a system, and how its energy consumption can cause a negative impact.
There has been a rise in malicious programs that take up a lot of energy, specifically crypto-mining malware. This report explains the tactics that some of the most common power-consuming malicious programs use to exploit a machine. We’ve analyzed ~1k viruses that are most known for overhauling computer system resources. We did this by using machine learning technology that classified malicious software opcodes that were affiliated with energy consumption. We also built a proof-of-concept (PoC) intrusion detection/prevention system (IDS/IPS) that demonstrates why monitoring malware behavioral patterns can save energy, via the comparisons, of kilowatt hours (kwH), between running malware vs. an IDS/IPS. As of now, the PoC will be built for Windows; they are most prone to having viruses.
We hope to convince cybersecurity and environmental engineers to push for better security within high-energy-consuming industries. This will result in the burning of less fossil fuels. We are eager to receive feedback that could be used to help polish our IDS/IPS. A final product can be provided to NGOs and other organizations that may not have enough capital to invest in such resources. Furthermore, we hope to incorporate this for MacOS and Linux, since these OSes are still prone to malware attacks.
What are your primary research interests?
I like researching cyber security vulnerabilities within IoT and OS systems, with a particular interest in Windows and Android.
Why did you apply to be an RSAC Security Scholar?
I applied to the RSAC security scholars program to have the opportunity to showcase individual skill sets that I have acquired from the past 5 years – having my proposed research being showcased to industry experts will take me to the next level of developing innovation to help the world prosper as technology advances.
What do you think are some of the most important emerging areas in cybersecurity?
In my opinion, the most important field for cyber is the integration of Artificial Intelligence, and its workings on how it will evolve creating cyber security solutions.
What are you most looking forward to about the RSA Conference?
I am looking forward to meeting world-renowned cyber experts at this conference.
