The modern world depends on the safe operation of infrastructure and vehicles for transport, communication, and power distribution. All these systems are increasingly computerized and interconnected. Connecting devices together into large systems creates new security vulnerabilities that conventional tests on single devices cannot find. To help find these vulnerabilities, we developed new tools to make testing complex systems easier. First, the Triton testbed provides a flexible way to test many interconnected devices that can include physical devices on real hardware, emulated devices running real software, and simulated devices that replicate the expected behavior of a physical device. Second, a Bus Driver device can modify messages on a wired communication bus to see how devices respond to modified messages. Finally, for part of the HyperScanner project, we adapted a low-cost software-defined radio to scan for Bluetooth devices more quickly by sending and receiving on many channels at the same time. The same approach could also be used to monitor wireless communication on many different protocols to detect problems with wireless security. These tools will enable more effective security testing to make complex cyber-physical systems safer and more reliable.

Customized hardware accelerators have made it possible to meet increasing workload demands in cloud computing by customizing the hardware to a specific application. They are needed because the cost and energy efficiency of general-purpose processors has plateaued. However, creating a custom hardware accelerator for an application takes several months for development and requires upfront development costs in the order of millions of dollars. These constraints have limited their use to applications that have sufficient maturity and scale to justify a large upfront investment. For instance, Google uses customized hardware accelerators to process voice searches for half a billion Google Assistant customers, and Microsoft uses programmable customized hardware accelerators to answer queries for ~100 million Bing search users. Reducing development costs makes it possible to use hardware accelerators on applications that have moderate scale or change over time.

In this dissertation, I demonstrate that it is feasible to reduce the development costs of custom hardware accelerators in cloud infrastructure. Specifically, the following three frameworks reduce development cost for the three main parts of the cloud infrastructure. For computation inside data centers, I built a bottom-up framework that considers different design parameters of fully customized chips and servers to find the optimal total cost solution. This solution balances operational, fixed and development costs. Counter-intuitively, I demonstrate that older silicon technology nodes can provide better cost efficiency for moderate applications. For in-network computations, I built a framework that reduces development cost by

offloading the control portion of an application-specific hardware accelerator to modest processors inside programmable customized hardware. I demonstrate that this framework can achieve throughput of ~200 Gbps for the compute-intensive task of deep packet inspection. For base stations at the cloud edge, I built a flexible framework on top of software-defined radios which significantly reduces their required computation performance and bandwidth. I show that it is possible to backhaul the entire 100 MHz of the 2.4 GHz ISM band over only 224 Mbps instead of 3.2 Gbps; making it possible to decode BLE packets in software with requirement of a wimpy embedded processor.

Defenders combat online adversaries by understanding their behavior, the resources theydepend on, and their strategies and tactics. However, measuring adversarial activity directly is often challenging, because adversaries take steps to obfuscate their behavior and evade detection by defenders. To overcome this challenge, defenders may leverage the knowledge that adversaries rely on licit, external resources, whose business models do not require secrecy. These resources may therefore leak valuable information, including the prevalence of threats, the relative effectiveness of competing adversaries, the strategies adversaries use, or the resources and infrastructure they rely upon. Such information can help defenders prioritize threats and decide which components of an ecosystem to target for interventions. This dissertation presents a new framework for designing measurement techniques and interventions for online adversaries: I leverage the information leaked by naming systems. I show that because naming systems are both lists of an adversary’s resources and critical resources themselves, observing them enables defenders to measure adversaries’ prevalence, compare their harmfulness, analyze their infrastructure, and more, thus improving interventions by identifying the most effective resources to target and prioritizing the most dangerous threats. I present four studies that each leverage some aspect of a naming system to measure an adversary’s behavior and inform defenses against it. First, I measure the prevalence of overt stalkerware in the wild, by using privacy-preserving DNS cache snooping on four public DNS resolvers. Second, I determine the location in the network of DNS redirection attacks, by exploiting the format of certain special DNS responses. Third, I investigate the abuse of blockchain-based naming systems (BNSes) by malware operators, and design interventions leveraging BNS components to disrupt malware campaigns. Finally, I measure an emerging web privacy threat, UID smuggling, by participating in the naming system built by trackers to link user identifiers with behavioral data. In each case, I measure or design defenses against an adversary that would be difficult to study without examining the information leaked by a naming system.

Modern society relies upon the safe and secure operation of wireless communication links in several computing systems, from personal devices to public infrastructure. These wireless access links utilize Bluetooth and WiFi radios, and enable users to remotely access and monitor computing systems, conveniently and at a safe distance. For instance, equipment on the grid can be remotely accessed, and COVID exposure information can be obtained at a safe distance using wireless links.

Unfortunately, these wireless access links have also made our computing systems less secure — attackers can gain unauthorized access, or remotely track these systems through these legitimate wireless links. Furthermore, attackers even implant their own illicit wireless links to gain access to personal equipment and critical infrastructure alike, e.g., payment card skimmers at gas stations.

In order to secure these wireless access links, we need to understand if attackers are gaining unauthorized access by hiding illicit links, and if attackers are performing targeted attacks on popular wireless access links. Wireless scanning-based auditing can be a potential solution to develop insights about the above security and privacy problems. However, there are several challenges to utilizing wireless scan information for this auditing, that bring to question the feasibility of wireless scanning as a security approach. In particular, wireless scans provide limited information and the wireless access links are extremely diverse, making targeted auditing of particular wireless link a needle in a haystack problem. Furthermore, these links are spread across large metropolitan areas needing us to do wardriving wireless scanning, but the existing scanning tools are extremely slow to discover all devices, making it tough to reliably scan for all wireless access link real-world locations.

In this dissertation, I perform several large scale field measurement studies of real-world wireless access links, by performing wireless scanning based auditing across entire metropolitan areas. I study actual security and privacy scenarios to demonstrate the feasibility of wireless scanning based targeted auditing as a tool to defend against attacks on wireless access links. I also analyze the practical challenges and limitations of performing such targeted auditing, from the perspectives of attackers and defenders. In summary, I defend the following thesis statement: To defend wireless access links spread across urban areas, it is feasible to: 1) use link layer scan information to identify illicit wireless links, 2) use physical layer information in wireless signals to attack a target wireless device, and 3) scan reliably for all wireless access links when wardriving using low-cost commodity hardware

Embedded devices installed inside gas pumps allow criminals to steal millions each year. These devices, called skimmers, record unencrypted information transmitted by the pumps’ payment circuitry. Despite the monetary impact, no study of law enforcement skimmer recovery methodologies exists. This thesis presents the first such study. I discover that criminals often use Bluetooth to retrieve stolen card information. I also find that current investigative mechanisms are ineffective. These findings motivate the development of an Android application for skimmer detection, Bluetana. Bluetana leverages Bluetooth and crowd-sourced data collection to detect skimmers. This approach is effective: detecting 64 skimmers over two years.