Sergey Bratus

I am a Research Associate Professor at the Computer Science Department at Dartmouth College. My primary focus is on studying exploitation of systems and networks, and any ways of inducing unexpected computation (a.k.a. "weird machines", unexpected, unintended, or emergent programming models in software or hardware). In a word, I believe that state-of-the-art hacking is already a distinct discipline of computer science, even though not formally recognized as such; this is where my main interest is. I am also interested in all aspects of Unix security, in particular in Linux kernel security, detection and reverse engineering of malware (primarly kernel mode, Linux and Windows), wireless networking, and visualizations of security-related information.

My other interests are in applications of Natural Language Processing for better indexing, search and navigation of natural language documents. Before coming to Dartmouth, I worked on NLP systems at BBN Technologies (see [1, 2]).

Classes

Current: I will be teaching CS 69.16/CS 169 in Winter 2022. The course page is at https://sergeybratus.github.io/RE-basics-W22/, with the draft syllabus posted there.

Previous: [CS 65, Smartphone Programing] [CS 258, Advanced OS] [CS 60, Computer Networks] [CS 59, Programming Languages] [CS 38, Computer Security]

I also teach a variety of low-level networking and systems security reading courses; ask if interested.

Projects

• Language-theoretic approach to security, invented by Len Sassaman and Meredith L. Patterson.
• DemystiPHY, hacking 802.15.4/ZigBee digital radio PHY using our APImote utility, with Travis Goodspeed and River Loop Security;
  BabylonPHY, exploring digital radio polyglots and cross-PHY injection, with Travis Goodspeed & Debanjum S. Solanky ([WOOT'16])
• BinderFilter, an Android Binder firewall & instrumentation framework, with David X. Wu.
• USB Facedancer and FreeBSD firewall, with Travis Goodspeed & Peter C. Johnson.
• Packet-in-packet attacks on digital radio protocols (follow the link to read about it in Travis Goodspeed's blog).
• "Weird machines", unexpected and unusual (and mostly even Turing-complete) programming models via inputs ordinarily thought to be "metadata", "tables", or "descriptors". So far found in the ELF and DWARF formats, x86 MMU descriptors, and other unlikely places. Exploits are programs that run on weird machines made of bugs and features in their targets, and serve as proofs by construction of the weird machine's existence. Many weird machines are emergent, brought into being within the target by careful memory allocations ("heap feng-shui"), resource starvation, thread manipulation, etc.
• Battleaxe shows a new vector for introducing attack logic into modern GCC toolchain's exception handling mechanism based on DWARF. This is not a weakness of GCC, nor do we mean to criticize GCC, but rather a call to developers to more deeply understand the ELF and DWARF formats we all use daily.
• Baffle -- active (behavioral) fingerprinting of 802.11 devices.
  • A side-project tested the reliability of the timestamps clock skew in 802.11 beacon frames for AP fingerprinting ( [paper], [slides])
• Kerf -- data organization and machine learning techniques for smarter log and packet capture browsing, analysis and sharing.
  • An offshot of this work was the Backhoe log and packet trace visualization technique based on graphically representing the amounts of information and conditional information in log cross-sections.
  • While working on Kerf, I developed several tools as side projects. A tool for visualizing and browsing Linux Snare and Solaris BSM system call traces is described here (and is freely available upon request).
• LZfuzz -- a simple fuzzer for plain text proprietary protocols, such as those still found in SCADA systems.
• Windsock -- networks monitoring sensors based on streaming estimation of information-theoretic measures.

Hacking

Being much indebted to the hacker community for many things I learned from its amazingly rich sources, I tried to describe some trends in the hacker learning experience (the so-called "hacker curriculum") that distinguish it from the typical experiences of traditionally trained developers and CS students. We use some (implicit) principles of this "hidden curriculum" and related experiences in our teaching of Computer Security at Dartmouth.

Offsite collection of relevant materials: www.hackercurriculum.org.

Publications:

• What Hackers Learn that the Rest of Us Don't: Notes on Hacker Curriculum [DOI], [PDF]
  I hope to use these observations a basis for larger work on the "hacker curriculum" and a bibliography of influential hacker work. You are welcome to send me comments on the [rough draft].
• Hacker Curriculum: How Hackers Learn Networking
• Hacker Curriculum: How We Can Use It in Teaching

Some of my "random" patches to standard tools (Etherape, dsniff, fragrouter, tcpflow, tcpreplay, etc., see README).

Personal

I received my undergraduate education at the Moscow Institute of Physics and Technology (aka Moscow Phystech), and my Ph.D. at Northeastern University (1999). Before coming to Dartmouth I worked at BBN Technologies on statistical learning methods in Natural Language Processing (NLP) for information extraction from natural English text, "text understanding", and similar topics.

My old homepage is at http://www.ccs.neu.edu/home/sbratus/.

My GPG public key.

	Please support the Free Software Foundation, the people who brought us the GPL and are fighting to protect our freedom to write and change software.
	Don't care to have your research squashed by an unscrupulous vendor's bogus copyright claims or have all of your Internet traffic mined and monitored for undisclosed purposes? Please support the Electronic Frontier Foundation.