Hacking in the Name of Science

Architecture and Background

DEF CON 16 - Panel: Hacking in the Name of Science Our talk will start with some of our latest and greatest hacks. In 2003 we were the first to analyze the security of Diebold's AccuVote-TS voting machine software. We'll discuss the inside scoop on how we got the code, broke it, and then went public. In 2008 we also published the first attacks against a real, common wireless implantable medical device - an implantable defibrillator and pacemaker - and we did so using off-the-shelf software radios. What else will we talk about?

Vulnerability Analysis

Well, there was our research in measuring just how frequently ISPs are injecting ads into people's web pages, our framing of network printers for copyright infringement (and receiving DMCA takedown notices to those printers), our invention of clock skew-based remote physical device fingerprinting, and much more. Are we hackers? No, we're scientists at a leading public university. So what turns hacking into "science" when it's done by academics? We'll answer these and other questions in the second half of the talk, which is geared to give you an inside glimpse into the world of academic security research.

Exploitation and Demonstrations

Along the way we'll answer questions like: How do we choose which technologies to hack - or as we say - "analyze," "study," and "investigate?" What might we hack next? What can we do as academic researchers in public institutions that industry researchers can't? What ethical and legal issues do we need to consider? And why is what we do considered "science?" Anyone who doesn't want their product to be the next technology hacked (sorry, "studied") by academics like us should definitely attend this talk. And, of course, come to this talk if you're considering grad school in computer security.

Remediation and Defensive Strategies

We'll also debate how academics and industry security researchers could better work together. Here we'd particularly like your feedback. What can academics learn from you? What do you think we could do better? What would you like us to look at next? (Standard academic disclaimer: Many of the works will discuss were previously published in conjunction with other researchers. We'll acknowledge all relevant parties in the talk.) For copies of the slides and additional materials please see the DEF CON 16 Archive here: