Computer Science Division
University of California, Berkeley
Research interests. Computer security, systems security, usable security, and program analysis for security. I am currently working on security for wearable devices, smartphone security, and other topics in computer security. I have worked on software security, electronic voting, wireless security, sensor network security, and applied cryptography.
Projects. I'm part of Berkeley's security research group. I am PI for SCRUB, the Intel Science and Technology Center for Secure Computing, and for the DHOSA project. I am also an active member of the TRUST and ACCURATE centers, and I'm part of the Science of Security project. In the past, I was a co-founder of the ISAAC research group.
Publications. My technical papers and publications are all available online. Some of my technical talks are also available, too.
Teaching. I am co-teaching CS 161 (Computer Security) with Prof. Raluca Ada Popa. See my past teaching.
Students. I'm lucky to have the chance to work with a group of outstanding graduate students: Grant Ho, Nathan Malkin, Michael McCoyd, and Chawin Sitawarin. See also the students I've graduated.
Contacting me. See my contact information for my address and other details. My office hours are Wednesdays 2-3pm in 733 Soda Hall.
Professional activities. I serve on the program committee of NDSS 2015, Usenix Security 2015, MObile Security Technologies (MoST) 2015, Symposium On Usable Privacy and Security (SOUPS) 2015, NDSS 2016, WWW 2016 Security and Privacy track, and I'm serving on the committee for the NSA Award for the Best Scientific Cybersecurity Paper (please send us your nominations!), on the CACM Research Highlights editorial board (I welcome your suggestions!), and on the editorial board for the Journal of Election Technology and Systems (JETS). Join me in committing to support open-access publication venues.
Software. Available: Stowaway, a tool for analyzing whether your Android app requests any unnecessary permissions; Comdroid, a tool for detecting security vulnerabilities in your Android app related to inter-application communications (Android intents); OpenCount, a tool to help with auditing of elections conducted using optical-scan paper ballots; AuditBear, a web application for analyzing audit logs from ES&S iVotronic voting machines; Joe-E, a Java-based programming language for secure programming; html-sanitizer-testbed, a suite of tests to probe the security of a HTML sanitizer; and CQual++, a tool for type inference analysis of C and C++ code.
Information for Berkeley undergraduates. Interested in research with me? New: I'm recruiting Berkeley undergraduates who are interested in research on computer security, starting immediately. Contact me with the information listed here if interested.