Professor Steven J. Murdoch
I am Professor of Security Engineering and a Royal Society University Research Fellow in the Information Security Research Group of the Department of Computer Science at University College London. I am also a bye-fellow of Christ’s College, Innovation Security Architect at the OneSpan Innovation Center, Cambridge, a member of the Tor Project, and a Fellow of the IET and BCS.
Open positions
I am always interested in recruiting talented researchers to join my team at UCL, both as PhD students and for post-doctoral positions. Interested candidates should email me their curriculum vitae and a short research proposal.
Recent publications
For more details see my full list of publications or my Google Scholar page. I also write articles on information security for the UCL Information Security Group blog – Bentham’s Gaze.
- The sources and characteristics of electronic evidence and artificial intelligence
Steven J. Murdoch, Daniel Seng, Burkhard Schafer, Stephen Mason
Various devices are capable of creating and storing data in digital form, and such data may serve as evidence. The aim of this chapter is to introduce the reader to the technologies, their underlying principles and the general characteristics that set evidence in digital form apart from evidence in analogue or physical form. The content of this chapter does not deal with any of these matters in depth. Neither does it aim to be a comprehensive review of the devices and technologies that create electronic evidence. Rather, the aim is to provide a broad brush introduction to the relevant technical issues, and to highlight features that a digital evidence professional and a legal professional should be concerned about when investigating electronic evidence and dealing with electronic evidence issues.
In Electronic Evidence and Electronic Signatures, Stephen Mason, Daniel Seng, eds. (fifth edition), University of London Press, August 2021. [ chapter | full book | book website | buy ] - Transparency Enhancing Technologies to Make Security Protocols Work for Humans
Alexander Hicks, Steven J. Murdoch
As computer systems are increasingly relied on to make decisions that will have significant consequences, it has also become important to provide not only standard security guarantees for the computer system but also ways of explaining the output of the system in case of possible errors and disputes. This translates to new security requirements in terms of human needs rather than technical properties. For some context, we look at prior disputes regarding banking security and the ongoing litigation concerning the Post Office's Horizon system, discussing the difficulty in achieving meaningful transparency and how to better evaluate available evidence.
International Workshop on Security Protocols, Cambridge, UK, 10–12 April 2019. Published in LNCS, Springer-Verlag. [ paper | slides ] - Taken Out of Context: Security Risks with Security Code AutoFill in iOS & macOS
Andreas Gutmann, Steven J. Murdoch
Security Code AutoFill is a new convenience feature integrated into iOS 12 and macOS 10.14, which aims to ease the use of security codes sent via SMS. We report on the first security evaluation of this feature, inspecting its interaction with different types of service and security technologies that send security codes via SMS for authentication and authorisation purposes. We found security risks resulting from the feature hiding salient context information about the SMS message while still relying on users to make security-cautious decisions. Our findings show that adversaries could exploit this decontextualisation. We describe three attack scenarios in which an adversary could leverage this feature to gain unauthorised access to users’ online accounts, impersonating them through their instant messengers, and defraud them during online card payments. We discuss the results and suggest possible measures for affected online services to reduce the attack surface by altering the phrasing of their SMS or using alphanumeric security codes. In addition, we explore the design space of Security Code AutoFill and sketch two alternative prototype designs which aim at retaining the improved convenience while empowering users and online services to safeguard their interactions.
Who Are You?! Adventures in Authentication Workshop (WAY), Santa Clara, California, USA, 11 August 2019. [ paper ]
Recent talks
For more detail see my full list of talks
- Post Office Horizon Scandal
Steven J. Murdoch
Computer bugs were found to be the reason many sub-postmasters and sub-postmistresses were wrongly convicted of stealing and false accounting. Professor Steven Murdoch, a professor of Security Engineering and a Royal Society University Research Fellow at UCL explains the sorts of faults that were found.
Computerphile, 09 July 2021. [ video | video (extra bits) ] - Designing for Dispute Resolution
Steven J. Murdoch
No computer system is perfect, so some people may dispute a computer’s decision (whether or not it is actually correct), and the system may be required to help resolve this disagreement. This requirement is particularly important when the computer system tracks who owns what, whether money or goods. The state of the art for reliably tracking account balances is double-entry bookkeeping, developed in the 13th century and translated more or less unchanged to computers. Double-entry accounting can identify losses but is less good at identifying the cause. As shown in the Post Office trial, companies may tend to hold the weaker party liable for such losses, and there’s not much they can do to show otherwise. In this talk, I argue that we need to move away from tracking balances and track items – which would be inconceivable with 13th-century technology but tractable with modern computing. This is one approach to addressing the challenges of evidence-critical systems, which must produce accurate and interpretable information to resolve disputes.
Workshop on Security and Human Behaviour (SHB 2021), 03–04 June 2021. [ slides ] - Making sense of EMV card data – decoding the TLV format
Steven J. Murdoch
EMV (sometimes known as Chip and PIN) is the worldwide standard for smart card payments. It was designed to allow credit and debit cards issued by any bank work to make a payment through any terminal, even across international borders and despite chip cards being extremely limited in the computation they can perform. In this talk I’ll discuss how EMV achieves this difficult task, through the use of the TLV (Tag-Length-Value) data format. I will demonstrate how to decode TLV data found on real EMV chip cards, and what significance this data has in the wider payment ecosystem. Finally I’ll discuss how the use of TLV, despite its advantages, has contributed to the creation of security vulnerabilities in Chip and PIN.
DEF CON 28 Safe Mode, Payment Village, 07–09 August 2020. [ video | video (alternate) | slides (interactive) | slides (static) | code | code (alternate) | notes (interactive) | notes (alternate) ]
Professional activities
Research supervision
Killian Davitt (PhD student, 2018–): understanding, measuring and improving the security of collaboration tools.
Alexander Hicks (PhD student, 2017–): privacy preserving continuous authentication.
Andreas Gutmann (PhD student, 2016–): privacy-preserving transaction authentication for mobile devices.
Shehar Bano (Research Assistant & PhD student, 2013–2016): measurement of censorship and censorship resistance systems.
Kumar Sharad (PhD student, 2012–2016): security in social networks – anonymisation and fraud prevention.
Program chair
14th Privacy Enhancing Technologies Symposium, 16–18 July, 2014, Amsterdam, Netherlands.
15th Privacy Enhancing Technologies Symposium, 30 June–2 July 2015, Philadelphia, PA, USA.
General chair
Financial Cryptography and Data Security 2011, 15th International Conference, 28 February–4 March 2011, St. Lucia.
Programme committee membership
- IEEE European Symposium on Security and Privacy 2019
- IFIP Summer School 2016, 2017, 2018
- Financial Cryptography and Data Security (FC): 2010, 2016, 2018
- Privacy Enhancing Technologies Symposium (PETS): 2007, 2008, 2009, 2011, 2017, 2018
- Network and Distributed System Security Symposium (NDSS): 2017
- ACM Conference on Computer and Communications Security (CCS): 2007, 2008, 2010, 2011, 2016
- Annual Privacy Forum 2014
- Free and Open Communications on the Internet (FOCI) 2013
- USENIX Security 2012
- European Symposium on Research in Computer Security (ESORICS) 2011
- Workshop on Foundations of Security and Privacy (FCS-PrivMod): 2010
- Workshop on Privacy in the Electronic Society (WPES): 2006, 2007, 2009
- FIDIS/IFIP Internet Security & Privacy Summer School: 2008
- ACM Symposium on Applied Computing (Computer Security track): 2007
Journal reviewing
Includes Proceedings on Privacy Enhancing Technologies (2017, 2018, 2019), ACM Transactions on Internet Technology (TOIT) (2017), International Journal of Computer Security (2016), IEEE Transactions on Dependable and Secure Computing (2009), ACM Transactions on Information and System Security (2008), IEEE Transactions on Software Engineering (2008), IEEE/ACM Transactions on Networking (2007), IEEE Security & Privacy (2007), The Triple Helix (2008), Identity in the Information Society (2008).
Contact Details
email (preferred):
s.murdoch at ucl.ac.uk
post:
Professor Steven J. MurdochComputer Science Department
University College London
Gower Street
London
WC1E 6BT
United Kingdom