|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The Rice Thresher
Phone:
|
by Mark Berenson Thresher Editorial Staff
When Stubblefield was still in high school, his research was classified by the National Security Agency. His list of accomplishments goes on. He was also one of a group of researchers that sued the recording industry over the group's right to publish a paper on digital watermarks. Stubblefield's latest accomplishment has garnered him the most publicity: He broke the encryption system used for the wireless networks found in many office buildings, some coffeehouses and even Fondren Library. Stubblefield said while working at AT&T Labs Research in New Jersey this August, he read a research paper outlining a theoretical way to break into the 802.11b protocol for wireless networks, the protocol on which Apple AirPort runs. He received permission from his boss at AT&T to work on applying the theoretical approach and tested his software a week later. Stubblefield successfully recovered the encryption key protecting the wireless network at AT&T, which would allow him to access any files on the AT&T network. Avi Rubin, Stubblefield's boss this summer, said the work was entirely Stubblefield's. "He came to me with this idea of breaking the encryption in the wireless standard and went off and running, and he did it," Rubin, a principle researcher in the Secure Systems Research Department at AT&T Research Labs said. The very next day, Stubblefield and Rubin wrote a report about the accomplishment and sent it to several colleagues in the computer security field. "From there, it got passed on to Web sites and reporters, and things got crazy after that," Stubblefield said. The following day, Stubblefield's last at AT&T, consisted of interviews with news Web sites, being filmed for CNN and doing a photo shoot for The New York Times. An article on Stubblefield also appeared in the Houston Chronicle Aug. 11. And Stubblefield did not see his fame disappear quickly. "Since then, I have been randomly called up by people like the [Associated Press] saying, 'We need to talk with a wireless networking expert,' and I'm like, 'OK, why did you come to me?'" Stubblefield said. "So, I've now been quoted as a random wireless security expert." In addition, Stubblefield said he has been flooded with e-mail messages from network administrators of government agencies, the military, and large businesses wanting to know if their wireless network is secure. Shortly after Stubblefield published the research paper, a software program called AirSnort, which allows a user to break into a wireless network, became available on the Internet. Stubblefield said he spoke with the AirSnort programmers before they released the software, but had nothing to do with the programming of AirSnort. Stubblefield said he has been successful because his area is a narrow field, bridging computer security and cryptography. Computer Science Assistant Professor Dan Wallach, with whom Stubblefield has done research, said Stubblefield's exceptional skills contributed to his success. "I've known a lot of really smart students over the years, but Adam is one of the best I've ever worked with," Wallach said. Rubin agreed. "He blew everyone here away at AT&T," Rubin said. "I think he is some kind of prodigy or something." Rubin added that Stubblefield's generosity with his intellectual ideas, as demonstrated in his handling of the wireless encryption break, will certainly help him in the long run. Rubin said after the research was complete, Stubblefield declined his invitation to write the paper alone and insisted Rubin and a colleague become co-authors. While his specific work on wireless networking security earned Stubblefield a great deal of publicity, his research has been attracting attention for years. Stubblefield attended Thomas Jefferson High School for Science and Technology in Northern Virginia, where he says he began to appreciate computer science. As a high school senior, Stubblefield served as an intern at Wang Government Services, a NSA-funded government contractor that focuses on computer security. As an intern, Stubblefield worked to improve the operating system for the Defense Information Infrastructure, the computers that route messages across various defense and military departments. Specifically, Stubblefield worked on the Guard, software designed to protect top-secret messages while allowing other messages to pass freely. To receive academic credit for his internship, Stubblefield needed to write a research paper and prepare a poster to present at school. He completed both tasks and decided to show the project to his boss at Wang, who then sent it to his contact at NSA to demonstrate what Stubblefield had been doing. "I got a call at home that night, which was [my boss] saying, 'We need you to come back, and we need you to bring all of the copies of the paper and everything that you have at home that has anything to do with this,'" Stubblefield said. Stubblefield said he wasn't told directly that the NSA had classified his research, but he thinks this was because he did not have security clearance. When Stubblefield returned to Wang, everything pertaining to the project was taken from him, and he said he was nudged to "forget" what he had done. His lack of a research paper and poster caused a problem at school, since he was meant to receive a grade for his internship. "The administrators and teachers worked it out with Wang," Stubblefield said. "They basically decided that if the NSA wants to classify my research, it must have existed and not totally sucked." In his first semester at Rice, Stubblefield did not take any computer science classes. "I was kind of upset with the [computer science] department freshman year because they said that everyone needed to take [Computer Science] 210, and I was a stupid freshman, and I was like, 'No, I'm not taking 210,'" Stubblefield said. "That's the real reason I'm a math major. "Second semester, I was like, 'Hey, what's the most interesting course the [computer science] department offers?" Stubblefield said. After flipping through the course book, he decided on Computer Science 527: Computer Systems Security, a graduate level course taught by Wallach. Stubblefield was doing very well in the class when it became time for him to choose a project, so he went to Wallach with an idea. Around that time, mp3.com introduced a service called My.Mp3.com, which allows users to upload music from their CDs to the Internet. The service first requires the user to put a music CD in their computer; then a software program named Beam-It verifies the presence of the CD and sends the verification to My.Mp3.com. "I decided it might be interesting to see how they actually decide whether or not you have the CD and whether they are doing it right," Stubblefield said. Over a tiring weekend, Stubblefield recreated the software's code by analyzing the program. Then, he wrote a report with Wallach about how the software worked in which he said mp3.com was doing the verification process correctly. "That was his first thing that got his name in lights, and he's still doing good stuff now," Wallach said. Currently, Stubblefield is working to devise a method of making wireless networks more secure. For example, some coffeehouses offer access to a wireless network for a fee, so patrons can surf the Web while drinking their coffee. Stubblefield hopes to design a protocol that would prevent people from stealing access to these networks. Stubblefield plans to study computer science in graduate school, but is not sure if he will stay at Rice.
- back - |
|||
|
Search the Thresher pages:
This document may be distributed electronically, provided that it is distributed in its entirety and includes this notice. However, it cannot be reprinted without the express written permission of: The Rice Thresher, Rice University MS-524, PO Box 1892, Houston, TX 77251-1892, USA. The Thresher Online Project -- ethresh@listserv.rice.edu |
