University of Newcastle, Computing Science foto

Jeff Yan

I did my Ph.D. with Ross Anderson in the Security Group at Cambridge University, and am now a Lecturer with Newcastle University , School of Computing Science in the UK, where we have an active team in both practical and theoretical security research -- see Security@NCL and my Lab of Security Engineering (LSE). I coordinate a weekly Informal Security Meetings and manage cs-security, a local emailing list for discussing all security-related issues.

Other organisations I was affiliated with in one way or another include:

I enjoy, among other hobbies, reading, photography, badminton and table tennis.

What's New

I will give a tutorial on usable security at ACM CCS'09 in Chicago this November. Details are at here.

I gave an invited talk on CAPTCHA robustness (slides) in Amsterdam to the Messaging Anti-Abuse Working Group (MAAWG) this June. Longer versions were given at Cambridge, Cisco, Google, Yahoo and Royal Holloway.

We have released a computer game, Magic Bullet, which is a spin-off from our CAPTCHA robustness project. Our paper about this game appears at IJCAI'09 in Pasadena, CA this July.

A Low-cost Attack on a Microsoft CAPTCHA (with Ahmad El Ahmad). This paper reports a novel attack that can break, with a success rate of higher than 60%, a CAPTCHA that was desinged by Microsoft and has been deployed for their Hotmail, MSN and Windows Live for years. Microsoft was notified our results in Sept, 2007. Responding to their request, we held this paper confidential until 10 April, 2008. Here are some frequently asked questions, and coverage in PC World, Network World, InfoWorld, Yahoo! News, ABC News, ACM Tech News, Register, Wikipedia, Times Higher Education and MIT Technology Review. A peer-reviewed version appears at ACM CCS'08.

A related paper, "Is cheap labour behind the scene? - Low-cost automated attacks on Yahoo CAPTCHAs", is not released yet (an abstract is here), but has been reviewed by Yahoo! Engineering in Sunnyvale, California.

Our graphical password project has been selected by the Royal Society for its 2008 Summer Science Exhibition. Drop by our exhibit in London to try out our leading graphical password system on Monday 30 June - Thursday 3 July 2008.

Breaking Visual CAPTCHAs with Naive Pattern Recognition Algorithms (with A El Ahmad), ACSAC'07. This paper reports a "pixel count" attack that works very well on quite some CAPTCHAs. In spirit, this is an interesting "side channel" attack.

Graphical passwords: "Background Draw a Secret (BDAS)", ACM CCS'07. Featured by BBC News, ACM Tech News, London Science Museum, Slashdot, and many others. Details see our BDAS page.

My Usable Security project won funding from Microsoft Research.

Previous highlights include Enhancing collaborative spam detection with Bloom filters (ACSAC'06), Bot, Cyborg and Automated Turing Test (Cambridge Security Protocols Workshop 2006) and Phishing mitigation (patent pending).

Selected Professional Activities

Research Summary

I am interested in most aspects of computer and network security, both theoretical and practical, and my recent work focuses on systems security, including human aspects of security (e.g. usable security). My previous contributions illustrate both my view of security and research methodology. Namely, security fails not only because of the lack or failure of technical mechanisms, but also because of failures of other issues such as usability and motivation, and therefore an interdisciplinary approach is needed to tackle (many) security problems.

Below you will find brief descriptions of some of my previous work and pointers to selected papers where you can find out more.

Human Aspects of Information Security

Usable Security

Password memorability and security

 Passwords are one good example of the importance of the human factors and usability in security. In this work, carried out in collaboration with a psychologist, we tackled an old but fundamental security problem - how do you train users to choose passwords that are easy to remember but hard to guess? There's a lot of "folk wisdom" on this subject but little that would pass muster by the standards of applied psychology. We did a randomized controlled trial with four hundred of our first year science students, and produced solid empirical results. While confirming some widely held folk beliefs about passwords, we observed a number of phenomena which run counter to the established wisdom.

Graphical passwords

Secure and usable CAPTCHAs

Recent Talks

Incentive-compatible security

Failure of motivation also leads to security failure. Incentive compatible security design, as an emerging research topic, appears to be essential in an autonomous network environment like the Internet where many parties (or agents) involved are selfish.

XenoService

 Distributed Denial of Service (DDoS) is at heart a manifestation of what economists call the "tragedy of the commons": while everyone may have an interest in protecting a shared resource (Internet security), individuals have a stronger motive to cheat (connecting insecure computers). Most of the proposed technical countermeasures would not work, as they didn't consider the incentive issue. We propose the XenoService as a distributed remedy to DDoS attacks which can be deployed in such a way as to provide effective economic incentives for the principals to behave properly. For more information on this line of research, as well as security economics, a highly related topic, and its applications, refer to the Economics and Security Resource Page maintained by Ross Anderson.

Traditional Security Design

The design of technical mechanisms has been the traditional focus of security research. My main contribution in this aspect is the design of new techniques addressing emerging security threats, and improvement of existing security techniques.

Security for network games

The emergence of online games has fundamentally changed the traditional security requirement for computer games, which was mainly copy protection. Although online games share many security issues that other networked E-commerce applications concern, e.g., payment security and service availability, some unique characteristics of online game systems impose interesting and challenging new security requirements, which call for the novel use of existing technology and the invention of new techniques. While online games are developing into a multi-billion dollar business, their security has recently started to attract researchers' attention.
Invited Talks

Proactive password checking and password protocols

In this work, we attack the classical proactive password checking method, which is based on dictionary attack and often fails to prevent some weak passwords with low entropy. A new approach is proposed to deal with this new class of weak passwords by (roughly) measuring entropy. A simple example is given to exploit effective patterns to prevent low-entropy passwords as the first step of entropy-based proactive checking. We also argue why strong password authentication protocols like EKE, SRP cannot replace proactive checking, responding to Wu's proposal in NDSS'99. Here is a piece of related work on password security that I contributed.

Denial of Service

Although denial of service (DoS) attack has become a fast-growing concern in security research, previous work focused on a type of classical service denial caused by resource exhaustion. We look into the DoS problem (including distributed DoS) from some new angles.

Others: code obfuscation for software protection, and vulnerability analysis

Applied Cryptography

Traitor tracing

Traitor tracing is an emerging but promising cryptographic method introduced to combat copyright piracy of digital media, e.g. pay-TV. One threat model considered by researchers is that traitors, who are subscribed users in a content distribution system, build pirate decoders with their legitimate decoding keys to bypass the security mechanism of the system. Many schemes were proposed to catch traitors who leak their keys, and some supported a black-box tracing paradigm. In this work, we show that a type of intelligent self-protecting pirate decoder can defeat many black-box traitor-tracing schemes.
Invited Talks

Teaching highlights

How to contact me

Jeff Yan
School of Computing Science
University of Newcastle
Newcastle upon Tyne, NE1 7RU
United Kingdom
Email:  Jeff.Yan at ncl.ac.uk 

Phone:  +44 191 222 8010
Fax:    +44 191 222 8232