UAB Cybersecurity Program's Success Leads to Spin Off Company

Researchers and lab students investigating computer viruses at the University of Alabama at Birmingham became so good at it, a company was spun off to take on clients and “phish” for malware within their systems and help combat cybercrime.

Gary Warner, director of research in computer forensics at UAB, told the Kiwanis Club of Birmingham Tuesday his group discovered through years of research that there was no antivirus software that could fully fight the viruses that have infected computers of 46 percent of online adult users in 2012 alone. Warner estimated $110 billion was spent in the U.S. to clean up infected PCs in 2012.

To combat the lack of effective antiviruses, go after cybercriminals, help with cybercrime investigations and protect consumers, businesses and the government, Warner and several cofounders started Malcovery Security.

UAB owns 25 percent of the new company that also has sponsors, including Bank of America, Facebook and e-Bay.

Warner and his team at UAB’s Center for Information Assurance and Joint Forensics Research put themselves on the map last year when they helped the FBI track down the international cybercrime ring responsible for stealing tens of millions of dollars online through viruses that look like email replicas of bank statements, bills and other transfers that trick users into opening them. That gave the criminals access to the user’s computer and accounts via online access.

Warner was featured on NBC’s Rock Center with Brian Williams March 21, 2012, talking about his cybercrime program’s role in the investigation.

Today, Warner helps district attorneys conduct cyber investigations and the center has helped corporate partners such as e-Bay, UPS, Google, Microsoft, FBI and Facebook.

Facebook gave Warner’s center a $250,000 donation after it helped track international criminals behind a social media spam outlet. The donation came from money Facebook recovered from spammers around the world and was used to expand the center’s UAB headquarters by 4,400 square feet, Warner said. Read Facebook’s post about the investigation and acknowledgment to Warner for his center’s role here.

Cybersecurity is a growing field, with an estimated need of 11,000 computer investigators next year, Warner said, but he is concerned there won’t be enough trained workforce to fill the demand considering the U.S. will only graduate 1,100 with that specialty next year.

Warner is also worried about the ability to prosecute cyber criminals in the future, with sequestration prompting a pay cut of 10 percent to FBI agents’ salaries and a reduction of their hours.

Written By: Cindy F. Crawford, Editor.  Article originally appeared in the Birmingham Business Journal 

UAB develops a simple defense for complex smartphone malware

University of Alabama at Birmingham (UAB) researchers have developed simple but effective techniques to prevent sophisticated malware from secretly attacking smartphones. The Tap-Wave-Rub (TWR) methods — tapping, waving a hand over or rubbing the phone’s proximity sensor — are being presented at the 6th Association for Computing Machinery Conference on Security and Privacy in Wireless and Mobile Networks (WiSec‘13) April 17-19, 2013, in Hungary, Budapest.

“The most fundamental weakness in mobile device security is that the security decision process is dependent on the user,” says Nitesh Saxena, Ph.D., the director of the Security and Privacy In Emerging computing and networking Systems (SPIES) lab and assistant professor of computer and information sciences at UAB. “For instance, when installing an Android app, the user is prompted whether or not the application should have permissions to access a given service on the phone. The user may be in a rush or distracted, or maybe it is the user’s kid who has the phone. Whatever the case may be, it is a well-known problem that people do not look at these warnings; they just click ‘yes.’”The designers say the TWR system will turn the phone’s weakest security component, the user, into its strongest defender.

It is this weakness of the human user that malicious entities exploit. For example, a malware writer whose goal is to make hidden phone calls or texts to premium rate numbers may hide a malicious code within a simple tic-tac-toe app. When prompted at the time of installing this game app, pressing “yes” would allow the game to make phone calls.

Attackers create a phone or text number that charges large sums of money for use. The malware then triggers a program that asks your mobile device to call or text that number. Such malware is already prevalent, and researchers and practitioners anticipate this and other forms of malware to become one of the greatest threats affecting millions of smartphone users in the near future.

Accepting terms on computers and smartphones is habitual repetition, and hackers with mal intent know this; they can leverage a user’s vulnerability to, among other things, make a harmless-looking game dangerous.

TWR works by using the proximity sensor that comes standard in most smartphones. These sensors, for example, save power by turning the screen off when a phone is near the user’s ear.

TWR methods help verify the user’s desire to voice dial or message, or access any other resource on the phone, by requiring the user to tap, wave their hand over or rub the sensor before actions are executed. By means of a TWR gesture, the device basically captures the user’s intent to perform an action. In the absence of this gesture, when a malicious app attempts to dial a phone number, the device will simply block it. The strength of this malware defense lies in its simplicity and broad applicability to different forms of constantly evolving malware.

Saxena’s team carefully chose tapping, waving and rubbing because they are the least likely movements to be replicated accidentally. In other words, the device will be less likely to confuse any of those motions during daily activities such as walking, dropping the phone or playing a video game.

“We purposely designed the TWR program to not involve yes/no and to force people to stop for a moment and think about whether or not the action requested by the phone is what they really would like their mobile device to perform,” Saxena said.

There is a disclaimer.

“Any mechanism may not guarantee 100 percent safety, as there is always a little chance of error,” Saxena said. “You must also pay attention to what you are downloading and what permissions are granted at the time of installation to fully protect yourself.”

UAB graduate student Babins Shrestha, a researcher in the SPIES Lab who coauthored the article, will present the paper at WiSec’13.

“There are anti-virus applications available for mobile devices but, unlike our method, they are ineffective, eat up your phone’s resources and cannot keep up with new strains of malware,” Shrestha said.

UAB undergraduate student Justin Harrison has also been involved with the project, integrating the TWR gestures with the voice dialing service. The project team, which is funded by the National Science Foundation and includes researchers from University of Michigan-Dearborn, also developed an implicit gesture mechanism — “phone tapping” — explicitly geared for protecting near field communication (NFC) transactions. These usually require the user to tap their phone with a payment terminal or another phone. This gesture is detected using the phone’s accelerometer, which is also standard on all smartphones.

Using the Internet Could Decrease Loneliness in Seniors

Among senior citizens who live in assisted- and independent-living communities, those who engage in online activity are less lonely than their peers, according to a University of Alabama at Birmingham (UAB) study.

This research, “The Impact of Information and Communication Technologies Use on Loneliness and Contact with Others among Older Adults,” is forthcoming in “The Journal of Medical Internet Research.”

Shelia Cotten, Ph.D., professor of sociology in the UABCollege of Arts and Sciences, along with her colleagues William Anderson and Brandi McCullough, discovered that using the Internet provides seniors with the social connections they need to help decrease feelings of depression and isolation.

“Older adults are at an increased risk of experiencing loneliness and depression, particularly as they move into different types of care communities,” Cotten said. “Information- and communication-technology usage has been shown to help older adults maintain contact with social ties.”

Residents in both assisted- and independent-living facilities were surveyed to examine how Internet use affects perceived social isolation and loneliness, as well as the perceptions of how Internet use affects communication and social interaction.

The data revealed that using the Internet made it easier for seniors to reach people, contributed to their ability to stay in touch, made it easier for them to meet new people, increased the quantity and quality of communication with others, made them feel less isolated and helped them feel more connected to friends and family.

“For those who move into those types of communities, loneliness can be a big issue,” Cotten said. “It is hard to stay connected as they make the transition, moving from their home. We need to encourage older adults to go online to find information and to communicate with their friends and family members. For them, using the Internet can decrease loneliness.”

Written By: Marie Sutton