Impact case study database
Search and filter
Filter by
- The University of Birmingham
- 11 - Computer Science and Informatics
- Submitting institution
- The University of Birmingham
- Unit of assessment
- 11 - Computer Science and Informatics
- Summary impact type
- Technological
- Is this case study continued from a case study submitted in 2014?
- No
1. Summary of the impact
Malware (malicious software) is one of the top security issues with today’s internet, and there is a growing trend of advanced malware that camouflages itself in order to evade standard detection tools. Dr Marco Cova developed novel methods of detecting advanced, evasive malware at scale. As a result of this work, Cova became a founder member of the company Lastline, where his research has contributed to innovation and entrepreneurial activity through the design and delivery of new products, specifically the development of sophisticated anti-malware products that have won dozens of industry awards. Cova’s work has significantly improved the performance of Lastline’s anti-malware products, establishing Lastline as one of the fastest growing cyber-security companies in the world, stimulating direct investment of over US$52 million. Products using Cova’s technology now protect more than 20 million individual users, including schoolchildren and callers to emergency services, as well as international banks and Fortune 500 companies.
2. Underpinning research
Cybercrime has become a major threat to businesses and organisations. Accenture, in their 2019 “Ninth Annual Cost of Cybercrime Study”, estimate the total value at risk from cybercrime over the next five years to be US$5.2 trillion, with a quarter of this threat coming from malware [S1], much of which is delivered via webpages. In recent years, there have been numerous high-profile attacks on UK businesses, universities and the NHS. Basic malware can be easily detected and stopped by anti-virus systems that scan files for patterns of bytes that act as a fingerprint for known malware. In response, malware authors have developed malware that can encrypt and camouflage itself, completely evading basic scans. Additionally, the most dangerous malware will use attacks that have never been seen before and so have not been fingerprinted by anti-virus companies. Such advanced evasive malware represents a major threat to businesses and organisations. Cova’s research has led to improved performance and new products for stopping such malware, which are actively used by a wide range of organisations.
The research conducted at the University of Birmingham (UoB) since 2010 has focused on pioneering systems for efficiently detecting and analysing advanced, evasive malware on a large scale. Cova was the key researcher at UoB on two projects (2010–2014) that developed anti-malware systems that are now widely used: PROPHILER [R1] and REVOLVER [R2]. The PROPHILER system enables the analysis of malicious web content at a scale that was previously impossible, whilst REVOLVER provides techniques for the automated detection of malware that will evade other scans.
Individual webpages can be scanned to detect malware in tens of seconds. However, modern websites may contain hundreds of pages, and to proactively find malware on the internet requires hundreds of millions of pages to be scanned. Before PROPHILER, such scanning was impossible; PROPHILER reduces the resources required for performing large-scale analysis of malicious web pages by developing a fast and reliable filter that can quickly discard pages that are benign, forwarding to the costly analysis tools only the pages that are likely to contain malicious code. Key research findings made by Cova as part of the PROPHILER project were:
Identifying key features of a webpage that characterise what the website does;
Developing a method of statically analysing complex webpages to automatically detect these features at very large scale;
Applying machine learning techniques to these features to determine if a web page is likely malicious or benign.
Putting these three steps together: PROPHILER [R1] statically models a web page using a set of features designed to characterise the page’s security aspects. It then compares these features against profiles established on datasets of benign web pages; if the analysed page deviates significantly from the established profiles, it is deemed potentially malicious. Cova’s research showed that this fast filter method was effective at scanning millions of webpages and so finding malware on a scale that was previously impossible. This improved performance has led directly to new products for Lastline; the method is used by Lastline’s main product Lastline Defender [S2] as part of a fully automated system to find and stop new sources of malware.
The creators of malware have responded to such malware detection systems by making their malware deliberately hide from scanners, adding methods to the malware that try to detect if the scanner is being executed by a human on a normal computer or by a scanning program. REVOLVER developed a technique to automatically identify evasions in web pages. Cova’s key new research idea was that evasive malware will contain snippets of code similar to other non-evasive malware, whereas benign webpages will not. REVOLVER [R2] finds pairs of pages that are similar and that have been classified differently (one malicious and the other benign). This different classification outcome is often attributable to the use of an evasion technique by the malware that, once identified, can be analysed, and scanning methods developed to defeat it. This further key finding is the contribution to innovation which made it possible to detect advanced malware that would evade other scans.
Performing this work required a deep understanding of website malware, large-scale static analysis and machine learning; a combination that Cova pioneered. The results of this combination were the first effective methods of detecting malware that could be used on the scale of the internet and a technology that has given Lastline a key competitive edge as an anti-malware company.
3. References to the research
R1. Davide Canali, Marco Cova, Christopher Kruegel, and Giovanni Vigna (2011). “Prophiler: A Fast Filter for the Large-Scale Detection of Malicious Web Pages”, International World Wide Web Conference (WWW), 2011. DOI: 10.1145/1963405.1963436.
Microsoft Academic Search ranks WWW as a top conference in World Wide Web research; the Australian CORE association ranks WWW as an A* conference.
R2. Kapravelos, A., Shoshitaishvili, Y., Cova, M., Krügel, C., and Vigna, G. (2013). “Revolver: An Automated Approach to the Detection of Evasive Web-based Malware”. Proceedings of the USENIX Security Symposium, 2013. ISBN 978-1-931971-03-4.
The Australian CORE association ranks this conference as an A* conference, and it is one of the leading venues for cyber security research.
4. Details of the impact
Malware (malicious computer code) is one of the biggest threats to the internet; for instance, the Zeus malware steals hundreds of thousands of credit card numbers every year, and, in 2017, the WannaCry ransomware malware crippled organisations across the world, including the NHS. Anti-virus companies have developed effective ways to detect and stop single infections by well-known malware on a single computer, however, to proactively find and defend against new, advanced malware infections from websites, new unknown malware must be detected and millions of websites must be scanned.
Cova’s research made fundamental steps in solving these challenges, contributing to innovation and entrepreneurial activity through the design and delivery of new products. In 2014, Cova moved full-time to the company Lastline in order to commercialise his research, which resulted in Lastline’s flagship Lastline Defender product [S3] that proactively defends organisations from malware, including new and evasive malware.
Lastline Defender is a practical tool that can proactively detect and stop highly advanced, evasive malware. This new product has stopped very damaging attacks against a wide range of large companies, including potentially devastating ransomware attacks [S4]. Lastline’s product is often ranked as the best by independent testers [S5]. Cova’s research was key to making this product viable, as the Chief Technological Officer and co-founder of Lastline writes:
Dr Cova’s technologies allow us to process possible malware several orders of magnitude faster than would otherwise be possible. His research has been the cornerstone of our efforts to detect evasive malware that is becoming increasingly common and cannot be detected by normal scanning methods. Dr Cova’s research has made a fundamental contribution to our current product line. [S6]
In another testimonial, the Chief Product Officer and co-founder of Lastline writes:
A key insight provided by Dr Cova’s Revolver work was that evasive malware could be detected by looking for code that is shared, or similar to, other known malware. The contribution of the Revolver work was to show that this works in practice, and it is now a technique we use to scan millions of documents every year […] We considered this research so important to the success of our company that we took every effort to ensure that Dr Cova joined Lastline as part of the founding team. [S7]
Products that use Cova’s technology are used by 1,000s of customers across the world including telecoms providers, payment card processors, shipping companies and global banks, to protect more than 20 million individual users [S4, S5]. Lastline has worked with more than 20 leading security product providers, including some of the biggest anti-virus companies such as Sophos and Symantec [S8] to ensure that products that use Cova's technology can be integrated with their offerings. The consulting companies KPMG, PWC and Dell Secureworks have all recommended Lastline products to their customers and seven leading managed security service providers use Lastline’s product [S8].
In a leading 2018 study, Lastline’s product detected 100% of the evasive malware tested, unlike products from some of the largest advanced malware detection companies, such as FireEye, whose product detection rate was only 80%. A key reason for Lastline’s excellent performance was the technique for identifying evasive malware presented in Cova’s REVOLVER research [R2]. Lastline’s product also proved to be one of the most cost-effective advanced malware detection solutions. A key reason for this is the fast filtering techniques developed by Cova in his PROPHILER research [R1].
These extremely strong test results for the implementation of Cova’s research are borne out by first-hand accounts from Lastline’s customers. The product has been adopted for use in multiple sectors worldwide, protecting banking and finance, aerospace, education, telecommunications, maritime security and the media. For example, the chief security architect at the Gwinnett County school board in the US, who uses Lastline Defender to protect 190,000 students, teachers and administrators, writes:
Lastline provides us with deeper visibility and insight into web downloads and malicious attachments embedded within ‘accepted’ business applications and protocols, and ‘passed-through’ by traditional perimeter security solutions. Lastline also provides us with ‘post-infection’ awareness to quickly detect and remediate compromised endpoint systems that are ‘calling home’ to criminal networks. [S9]
One of the largest wireless telecommunications networks in the United States who uses Lastline to protect services to millions of customers and 911 emergency service calls writes:
The corporate email security team loves Lastline because it catches stuff that two of our other security solutions miss. When I was looking for a sandbox utility for email, I performed a side-by-side comparison between Lastline and those other tools. Lastline outperformed both of them by a large margin. [S10]
The Head of Service at GTMaritime (a maritime communication company) writes:
Within days of the launching GTMailPlus, we felt the service from Lastline was so security critical, we now integrate the Lastline solution as a compulsory element of our service. We are in the process of rolling this out to our entire customer base, so we are assured our end-users and systems are protected. It’s ‘win-win’ all around. [S10]
Other customer case studies and quotes can be found on our supporting website [S10].
The take up of Lastline is further evidenced by its success as a company. Since Cova joined Lastline in 2014, it has grown to over 100 employees and received direct investment of US$52.5 million, including funding from Dell and the venture capital firms e.ventures and Redpoint Ventures [S11]. Lastline has won dozens of industry awards for the performance of its product, these include, in 2018 alone, awards for “Most Promising Cybersecurity Provider”, “Game Changer of the Year” and “Best Network Protection” [S12]. Inc. magazine named Lastline, “the leader in advanced threat protection”, eighth among security companies on its 37th annual Inc. 5000, “the most prestigious ranking of the nation’s fastest-growing private companies” [S13].
5. Sources to corroborate the impact
S1. Accenture Security, The Cost of Cybercrime, 2019 [accessed 25.02.2021]
S2. Lastline, Network Detection and Response Platform [accessed 25.02.2021]
S3. Lastline, Lastline Defender: AI-Powered Network Security, 2019 [accessed 13.11.2020]
S4. Lastline, Detecting Ransomware Using Behavioral Analysis [accessed 13.11.2020]
S5. Lastline Blog, Lastline Ranks Highest in Security Effectiveness in NSS Labs Breach Detection Systems Group Test – Again, 2017 [accessed 13.11.2020]
S6. Testimonial from Lastline, Chief Technological Officer
S7. Testimonial from Lastline, Chief Product Officer
S8. Lastline, Industry Partners [accessed 13.11.2020]
S9. Gwinnett County Public Schools Defends Against Advanced Malware with Lastline Enterprise – Case Study [accessed 7.12.2020]
S10. Lastline Supporting Evidence Website (case studies and quotes from the following: A Global Bank, A Technology Company, Fin Tech Services, GTMaritime, Lastline Detonator, Aerospace, Education, CorporateFactSheet, TeleComms Company, A Managed Security Service Provider, Major Card Processor, Media Conglomerate)
S11. Crunchbase, Total Funding Overview [accessed 13.11.2020]
S12. Lastline Awards [accessed 13.11.2020]
S13. Inc. 5000 List of America’s Fastest-Growing Private Companies, Lastline Ranks Among Top 10 Security Companies on the 2018 [accessed 13.11.2020]
- Submitting institution
- The University of Birmingham
- Unit of assessment
- 11 - Computer Science and Informatics
- Summary impact type
- Societal
- Is this case study continued from a case study submitted in 2014?
- Yes
1. Summary of the impact
Professor Sorge’s research on scientific document analysis led to the creation of a Speech-Rule-Engine (SRE) which in turn has led to improved educational inclusion of visually impaired groups engaged in mathematical subjects. Overcoming the inability of screen readers to meaningfully interpret mathematical notation has significantly enhanced equality of access for these groups.
The innovative SRE accessibility features stimulated entrepreneurial activities through being incorporated into new products and online services by companies and organisations worldwide, including Google’s ChromeVox, learning management systems (Moodle, WeBWorK), and commercial educational support providers (Benetech, Texthelp). Major Learned Societies and STEM publishers (e.g. IEEE, Elsevier, OSA) adopted Mathjax with SRE Assistive Technology Extension as the software of choice, enhancing and improving delivery of accessible online mathematics to millions of readers globally.
2. Underpinning research
The fundamental contribution of research underpinning this impact case study was the definition and construction of a generic representation of mathematical formulae that enables them to be accessible to visually and print-impaired readers over a wide range of platforms and in commonly used web browsers.
Working with Google’s Accessibility Engineering Group in 2012/13, Sorge pioneered a rule-based approach to speaking mathematical expressions on the web and implemented the Speech-Rule-Engine (SRE) system that is now embedded as a core feature of ChromeVox [R1]. On the strength of this research, Sorge was invited in 2015 to join the MathJax Consortium as the lead of assistive technology: “We were impressed by Volker’s research ideas and work, and so after he finished at Google and returned to his post at Birmingham University we recruited him part-time to help integrate his Speech-Rule Engine […] into an extension to MathJax that would make MathJax output accessible to users with visual impairments” [MathJax Lead Developer, S1]. Sorge has since been carrying out further development of SRE as an open-source standalone system [R2].
A semantic tree transformation for MathML elements is the key concept originally designed and implemented by Sorge in the context of making mathematical notation accessible in the screenreader ChromeVox [R1]. It is a homogeneous, semantically correct and syntactically unambiguous representation of a mathematical expression derived from its original syntactic markup by the use of pattern recognition techniques [R1, R3]. It overcomes the limitations of Presentation MathML which is insufficiently expressive to enable accessible rendering of formulae. The semantic tree provides a sufficiently rich structure for generating various forms of accessible output such as speech descriptions, Braille, simplifications, and summarisation.
Sorge further developed a novel semantic enrichment procedure [R3] to embed the semantic tree of a mathematical expression into its original syntactic representation. This yields semantically rich documents without altering their syntactic markup and subsequent display. It allows different applications to generate a variety of outputs (speech, tactile output, magnification, highlighting) from the same internal document format.
As a direct application of the above concepts, and with the aim of supporting users with reading disorders and visual impairments, Sorge has devised and developed the Assistive Technology Extension for MathJax. The impact of this work comes from the fact that mathematical web content is automatically converted into fully accessible documents regardless of their source (LaTeX, AsciiMath, MathML) and of rendered display (SVG, HTML, CSS), in the majority of web browsers. Embeddings into the rendered markup are implemented as data attributes, providing fast and standardised means of retrieval fully consistent with the HTML5 and ARIA standards, thus ensuring platform independence [R3]. The SRE-based speech module translates both single symbols and complex expressions. The embedded semantics enable the provision of diverse assistive features in MathJax including the following [R4 and R5]:
An innovative responsive rendering of mathematical content through interactive collapsing and exploration of subexpressions;
Aural rendering, including changes in intonation that provide a more natural reading experience;
Meaningful exploration of mathematical content, providing multiple highlighting features, magnification and synchronised aural rendering;
Personalisation, enabling the user to choose preferred styles of magnification, voicing, exploration, etc;
Providing on-the-fly switching of speech rules using automatically selected domain-specific heuristics for mathematics, physics, computer science, or logic;
Tactile rendering, enabling Nemeth Braille output on connected Braille displays.
Without SRE, the equation
is spoken in a standard screen reader (in e.g. Safari) as “ x equals b plus or minus b 2 4 a c 2 a displace tile equals x b pm sqrt b 2 minus 4 over 2 a”; with SRE using ClearSpeak, it is “ x equals the fraction with numerator negative b plus or minus the square root of b squared minus 4 a c and denominator 2 a” [R4].
To assist learning and editing mathematics in LaTeX, Sorge extended Emacspeak Audio Desktop by providing facilities to write and rearrange expressions and hear the effect, and, by using MathJax’s error reporting mechanism, to indicate incorrect expressions and by enabling interactive exploration of rendered expressions on the fly, while editing. Syntax highlighting (e.g. bold typeface or section heading) is provided aurally and SRE summarisation features are exploited to simplify aural summaries of the input [R6].
3. References to the research
R1. Sorge, V., Chen, C., Raman, T.V., Tseng, D. Towards making mathematics a first class citizen in general screen readers. In Proceedings of the 11th Web for All Conference 7 April 2014 (p. 40). ACM. DOI: 10.1145/2596695.2596700.
R2. Speech-rule-engine, GitHub speech rule engine [accessed 15 October 2020].
R3. Cervone, D., Krautzberger, P., Sorge, V. Employing semantic analysis for enhanced accessibility features in MathJax. In 13th IEEE Annual Consumer Communications & Networking Conference (CCNC) 9 January 2016 (pp. 1129–1134). IEEE. DOI: 10.1109/CCNC.2016.7444948.
R4. Cervone, D., Sorge, V. Adaptable Accessibility Features for Mathematics on the Web. In Proceedings of the 16th Web For All 2019 Personalization-Personalizing the Web 13 May 2019 (p. 17). ACM. DOI: 10.1145/3315002.3317567.
R5. Cervone, D., Krautzberger, P., Sorge, V. Towards universal rendering in MathJax. In Proceedings of the 13th Web for All Conference 11 April 2016 (p. 4). ACM. DOI: 10.1145/2899475.2899494.
R6. Sorge, V. Supporting visual impaired learners in editing mathematics. In Proceedings of the 18th International ACM SIGACCESS Conference on Computers and Accessibility 23 October 2016 (pp. 323–324). ACM. DOI: 10.1145/2982142.2982212.
4. Details of the impact
Accessibility tools provided by SRE have improved educational inclusion and improved equality of access to educational opportunities. They have been adopted by global companies and thus contributed to innovation and to the improvement of standard industry practices in science publishing. This collectively benefits millions of impaired users around the world. As a WeBWorK co-founder stated, “I cannot think of any developments in recent years that have had a bigger impact on STEM education and on-line mathematics communication in general” [S2].
Improving inclusion through access to educational and research STEM resources for visually impaired users by provision of free, open-source tools
MathJax [S3.1] is an open-source JavaScript platform for rendering mathematics in web browsers. SRE [S3.2] forms a core feature of its inbuilt Assistive Technology Extension [S3.3]. SRE’s inclusion in MathJax [S3.1] led to it becoming a preferred accessibility solution. It is used in educational tools (e.g. WeBWorK, Moodle), online scientific publishing (see below), informational websites (e.g. Wikipedia, StackExchange), and blogging sites (e.g. PhysicsForums). The MathJax Lead Developer and Project Manager stated that “Because of [Sorge’s] work, all of these are accessible with no extra work on the part of the site administrators; if they are using MathJax, the accessibility comes automatically. The importance of this technology to both education and scientific research cannot be overstated” [S1]. The American College Board, based in USA and associating educational institutions in over 85 countries worldwide, recommended the use of MathJax and its Assistive Technology Extension for students with disabilities as an accessibility solution for stay-home exams during the Covid-19 pandemic.
WeBWorK is an open-source online homework system for STEM courses used at over 1000 institutions worldwide [S3.4]. Accessibility for mathematics is provided by ChromeVox and MathJax. The co-founder of the The WeBWorK project states: “The work of Dr Sorge [...] has undoubtedly provided a vital benefit for STEM students with visual disabilities. [The] accessibility options are now ubiquitous for on-line mathematics material. The widespread advantage for mathematicians with visual impairments is enormous and continues to improve” [ S2]. WeBWorK is supported by Mathematical Association of America and the National Science Foundation.
Bringing innovation into commercial educational products and online services for the visually impaired through the adoption of new technology
Businesses with global reach have recognised the value of the SRE to their markets and incorporated it into their accessible products.
SRE has been incorporated as a core element of ChromeVox, a built-in screen reader for Google Chromebooks, which are widely used in education. They have an estimated 40 million users worldwide and over 20% market share in Europe. Google estimates that in the US around 1.5 million of visually impaired Chromebook users benefit from improved general educational inclusion and access to mathematics in the STEM subjects [S4]. As Chromebooks currently dominate primary and secondary education in the US, SRE is the dominant solution to make maths accessible for visually impaired or dyslexic high school students.
Texthelp is a market leader in assistive learning solutions whose technology is used by millions of people around the world [S5]. It uses SRE in its mathematics editor EquatIO®: “SRE is not an ordinary screen reader — it ‘understands’ formulae [...] Our users say that this makes a real difference [...] All this gives us competitive edge in the market. We [...] can confirm that the software has been deployed to over 3 million Google accounts” [S5].
Mathshare, Benetech’s interactive environment for mathematics in high schools, has employed SRE as its integral part since 2018 [S6]. SRE and MathJax also form the back-end of MathML Cloud platform — a free, open-source, web-based tool used by major publishers: “People from at least 81 countries, including India, UK and Germany, have accessed and used MathML Cloud. Over 5000 users have visited the site” [S6]. SRE-based technologies are also available via Benetech’s DIAGRAM Center, an R&D organisation disseminating best-practice accessible educational tools: “We believe that a proportion of [disabled] population has already benefited from the accessibility tools such as provided by SRE by gaining fair and equal access to scientific materials” [S6].
Improving standard practices in STEM publishing through the adoption of new technology to enhance provision for the visually impaired research community
At least 19 STEM publishers provide accessible mathematics for some of their online journals through the MathJax enabled browsers. They include the Institute of Electrical and Electronics Engineers (IEEE: as of 2018, the world’s largest association of technical professionals with more than 419,000 members in over 160 countries), The Optical Society of America (OSA), Elsevier, Oxford University Press, Institute of Physics (IOP) Publishing, and 17 others [S7].
IEEE provides web access to over 3 million documents with more than 8 million downloads each month. MathJax’s Assistive Technology tools “have become an invaluable, irreplaceable part of our publishing ecosystem, facilitating inexpensive and unmatched quality in online presentation of accessible math for our journals. There is no better solution to fully accessible math-on-the-web” [S8].
All OSA journals support accessible mathematics. MathJax and its Accessibility Extensions “provide tools and features that lend themselves well to the presentation of the math [...] making the math notation easier to read and understand. We found MathJax Accessibility Extensions particularly effective when we developed our EPUB article format, which was aimed specifically at providing improved visual and aural navigation for visually impaired users” [S9]. OSA readership spans 218 countries, with over 10,000 known institutions accessing OSA content.
Elsevier has been employing MathJax on its ScienceDirect platform since 2013. The Product Manager for SEO and Accessibility stated, “While we do not collect data on the use of accessibility features, we know that improved rendering and accessibility via MathJax is particularly valued by our customers and benefits millions of users on our site. On ScienceDirect, over 550 journals contain more than 1,000 articles with MathML elements. In 2019, those titles saw 288M visits from 95M unique visitors, for a total of 514M article page views” [S10].
The following recent statistics (13 October 2020) illustrate the scope and continuing active interest in the MathJax and its Assistive Technology Extension [S3.5]:
1.7 billion monthly hits for all versions of MathJax on jsDelivr (a Content Delivery Network);
9th most popular package on jsDelivr;
7 million hits for the A11y extensions of the latest version only of MathJax v2.7.5;
and in the Speech-Rule-Engine alone:
380 million monthly hits for all versions of SRE on jsDelivr [S3.6];
45th most popular package on jsDelivr [S3.6];
29,300 monthly downloads of the SRE software via Facebook’s package manager Yarn [S3.7];
over 8,000 weekly downloads of SRE from Node Package Manager (NPM), 1,738,160 total downloads since SRE was first published on NPM [S3.8].
5. Sources to corroborate the impact
S1. MathJax: Testimony from MathJax Lead Developer and Project Manager.
S2. WeBWorK: Testimony from co-founder of the The WeBWorK project, Professor, Department of Mathematics, University of Rochester (dated 5 February 2020).
S3. Sources evidencing the scope and uptake of software:
3.1 MathJax Accessibility Features [accessed 13 January 2021]
3.2 GitHub speech rule engine [accessed 13 January 2021]
3.3 MathJax Accessibility Extension [accessed 13 January 2021]
3.4 WeBWorK Sites [accessed 30 November 2020].
3.5 JSDelivr MathJax [accessed 16 October 2020]
3.6 JSDelivr speech rule engine [accessed 13 October 2020]
3.7 Yarn speech rule engine [accessed 13 October 2020]
3.8 NPMJS speech rule engine [accessed 13 October 2020]
S4. Google: Testimony from Director of Google AI, formerly Google Director of Accessibility Engineering (dated 26 May 2020)
S5. Texthelp: Testimony from CTO and co-Founder (dated 11 February 2020).
S6. Benetech: Testimony from Director of Educational Research and Development.
S7. STEM publishers providing accessible mathematics via MathJax [accessed 6 January 2021].
S8. IEEE: Statement from IEEE Senior Director of Publishing Technologies [accessed 6 January 2020].
S9. OSA: Testimony from Senior Director, Publishing Production and Technology (dated 24 February 2020).
S10. Elsevier: Testimony from Product Manager SEO and Accessibility (dated 10 November 2020).
- Submitting institution
- The University of Birmingham
- Unit of assessment
- 11 - Computer Science and Informatics
- Summary impact type
- Technological
- Is this case study continued from a case study submitted in 2014?
- No
1. Summary of the impact
We achieved significant commercial and economic impact by directly enabling security updates to the mobile phone apps of some of the largest banks, and financial and VPN service providers in the world, including HSBC, Bank of America, [text removed for publication]. We developed a new methodology and an automated tool, Spinner, which identified critical security vulnerabilities** in 28 apps (e.g., the ability to access PIN codes and usernames). Through our responsible disclosure of these vulnerabilities, the affected banks were able to swiftly patch their insecure software, thus improving technology, mitigating against future losses and protecting tens of millions of users worldwide from fraud. It also enabled the National Cyber Security Centre to push for a coordinated vulnerability disclosure policy within the banking sector.
2. Underpinning research
Transport Layer Security (TLS) is a cryptographic protocol that underpins the security of most online traffic, from Facebook to banking and critical infrastructure. To determine which cryptographic key should be used to talk to a specific server securely, TLS relies on public key certificates. These are public statements that bind the server’s identity to its public key and are signed by a trusted party called a Certificate Authority (CA). Often, a chain of such certificates is used where the first one (called root CA) represents the ultimate trust anchor. But there are hundreds of CAs globally and, if a single one acts maliciously or is compromised (as DigiNotar was in 2011, for example), then the security of TLS is lost. To mitigate this, high-security applications use a technique called “certificate pinning” through which developers can choose to only accept certificates issued by a single, pre-arranged CA in their applications.
Most security-critical applications are tested for security vulnerabilities by a penetration testing (pentesting) company before deployment. One drawback of using certificate pinning is that traditional testing techniques require owning a certificate from the same CA (with accompanying ID checks and fees). This makes it difficult for pentesting companies to test the security of the TLS connection. Certificates are not only expensive, but some CAs only issue certificates to very large organisations and/or government, not to pentesting companies, thus preventing them from conducting proper TLS testing.
Between September 2014 and June 2017, we (Chothia and Garcia) researched a solution to the problems with existing pentesting processes. We developed a new methodology [R1] and a zero-cost, open-source, automated tool called Spinner [R2] which enables testing of TLS connections at scale, even when certificate pinning is being used. For this, we leveraged a large database of internet servers and the TLS certificates they use. By redirecting an app’s traffic to a server using the same certificate as the one pinned by the app, we are able to conduct a thorough analysis of the encrypted traffic between the app and the server. The tool performs a series of tests and then pinpoints the exact step of the TLS handshake that fails. Based on this information, it detects a number of vulnerabilities such as the lack of proper hostname verification. This discovery that certificate pinning obscures the lack of proper hostname verification is termed key finding 1 [KF1].
Using Spinner, we carried out an analysis of 400 Apple iOS and Android high-security applications including banking, stock trading, cryptocurrency and VPN apps. In this sample set, we identified 11 apps that were using certificate pinning but failed to perform hostname verification. A further 6 apps accepted self-signed certificates and another 9 did not verify the hostname correctly. These failures enabled adversaries to decrypt communications, retrieve users’ credentials and perform operations as if they were customers. See Table 1, below, for an overview of the vulnerable apps found. The development of our new methodology that can perform pentesting without a certificate from the relevant host CA is termed key finding 2 [KF2].
3. References to the research
R1. Tom Chothia, Flavio D. Garcia, Christopher Heppel, and Chris McMahon-Stone.‘Why banker Bob (still) can’t get TLS right: A Security Analysis of TLS in Leading UK Banking Apps’. In 21st International Conference on Financial Cryptography and Data Security (FC 2017). Lecture Notes in Computer Science , Vol. 10322. Springer, Cham. 2017. DOI: 10.1007/978-3-319-70972-7_33.
R2. Chris McMahon Stone, Tom Chothia and Flavio D. Garcia.‘Spinner: Semi-Automatic Detection of Pinning without Hostname Verification’.In 33rd Annual Computer Security Applications Conference (ACSAC 2017). ACM. 2017.ACM, 2017. DOI: 10.1145/3134600.3134628.
4. Details of the impact
We have directly benefited global banks, stock traders, cryptocurrency and VPN service providers, and their millions of customers across four continents by developing an automated tool, Spinner, which detects cryptographic protocol failures in security applications. Spinner has significantly mitigated against future losses by improving methods in security-critical applications and improving existing technology. This commercial and economic impact is a consequence of the responsible disclosure we made to banks, with the support of the Government Communications Headquarters (GCHQ) and the Centre for the Protection of National Infrastructure (CPNI), of the vulnerabilities identified by the underpinning research [KF1, KF2].
As we move towards a cashless society, the security of our internet banking infrastructure is becoming more critical. The magnitude and likelihood of potential losses due to security failures is enormous. In 2019, more than 25,000 incidents of internet banking fraud amounted to losses of over £111M in the UK alone [S1]. Besides the economic impact on the banks, there is also a socioeconomic aspect, as banks typically refuse to refund transactions where the right credentials have been input [S2]. We have shown that existing flaws in the banks’ own apps enable fraud [KF1]. [text removed for publication] Our research and subsequent intervention prevented this negative impact and protected tens of millions of customers globally from falling victim to fraud.
Table 1 shows the apps that we identified as vulnerable in the underpinning research [KF2] together with their respective numbers of users. They all had insecure TLS connections that exposed their users’ credentials, and therefore their bank accounts, to attackers and fraudsters.
Table 1: Vulnerable banking apps identified by the underpinning research
| App name | Vulnerability | OS | No. of installs |
|---|---|---|---|
| [text removed for publication] | Pinning w/o hostname verification | Android | 100k–500k |
| [text removed for publication] | Pinning w/o hostname verification | Android | 5M–10M |
| HSBC | Pinning w/o hostname verification | iOS | 5M–10M |
| HSBC Business | Pinning w/o hostname verification | iOS | 10k–50k |
| HSBC Identity | Pinning w/o hostname verification | iOS | 10k–50k |
| HSBCnet | Pinning w/o hostname verification | iOS | 10k–50k |
| HSBC Private | Pinning w/o hostname verification | iOS | 10k–50k |
| Bank of America Health | Pinning w/o hostname verification | Android | 100k–500k |
| Meezan Bank | Pinning w/o hostname verification | Android | 10k–50k |
| Smile - the internet bank | Pinning w/o hostname verification | Android | 10k–50k |
| TunnelBear VPN | Pinning w/o hostname verification | Android | 1M–5M |
| Emirates NBD | Accepts self-signed certificates | iOS | n/a |
| Kotak Bank | Accepts self-signed certificates | iOS | n/a |
| Al Rajhi Bank | Accepts self-signed certificates | iOS | n/a |
| Britline | Accepts self-signed certificates | Android | 1k–5k |
| Opal Transfer | Accepts self-signed certificates | Android | 100k–500k |
| Aman Bank | Accepts self-signed certificates | Android | 10k–50k |
| Santander UK | No hostname verification | iOS | n/a |
| CommBank Property | No hostname verification | iOS | n/a |
| American Bank of Sydney | No hostname verification | Android | <1k |
| Ulster Bank NI | No hostname verification | Android | 100k–500k |
| Ulster Bank RI | No hostname verification | Android | 100k–500k |
| BofAML Research Library | No hostname verification | Android | 10k–50k |
| First Financial Bank | No hostname verification | Android | 10k–50k |
| ACU Mobile | No hostname verification | Android | 5k–10k |
| Bitcoin.co.id | No hostname verification | Android | 100k–500k |
After identifying these flaws, we initiated a process of responsible disclosure that directly led to changes in existing technologies (the apps) and the adoption of improved security methods. Using the knowledge and recommendations we provided to them, financial and VPN service providers were able to patch their software.
We first informed [text removed for publication] on 27 February 2015 of the vulnerabilities in their app. These vulnerabilities, identified using Spinner [KF2], had been missed by two pentesting companies. One week later, [text removed for publication] pushed a fix. Afterwards, a similar process was carried out with [text removed for publication]. After these disclosures, it was evident that a more scalable approach to vulnerability disclosure was needed. [text removed for publication]
The reach and significance of our work is attested by improvements across global banking and financial service providers and by the stimulation of policy debate between [text removed for publication] and the UK financial sector on responsible disclosure. [text removed for publication]
As a result of our disclosures, all of the affected apps have been fixed, to the benefit of both the respective banks and their customers. Some of the largest affected banks have made public statements acknowledging our contribution to fixing their apps, including HSBC: ‘We thank the University of Birmingham for the opportunity to work together, and we have already taken steps to address this’ [S4] and Bank of America: ‘The vulnerability identified in this report [R1] was resolved in Bank of America’s health app in January 2016’ [S4].
To ensure the continued impact of our research, we released the Spinner tool as open source in December 2017 so that pentesting companies are free to use it. Spinner’s availability and a wide range of national media coverage in late 2017 [S5, S6, S7, S8, S9], led to international recognition of the importance of our research and impact. [text removed for publication]
Taken together, we have improved the security of mobile apps across the sector, benefiting companies, customers and the economy more broadly. A measurement study of 20 banking apps conducted by one of our students shows a sharp increase in the prevalence of certificate pinning [S10, section 3.2.2]. Significantly, the study quantifies the impact by showing that each of the banking apps using certificate pinning in 2019 does so correctly and securely [S10, section 3.4].
5. Sources to corroborate the impact
S1. UK Finance , Fraud - The Facts 2020: The definitive overview of payment industry fraud, [accessed 20/8/2020].
S2. ‘ Disputed Transactions’, Ombudsman News, March/April 2014 [accessed 20/8/2020].
[text removed for publication]
S4. Maria LaMagna, ‘ The apps of these major banks were found to have security flaws’, MarketWatch, 2017 [accessed 13/7/2020].
S5. ‘ Flaw discovered in banking apps leaving millions vulnerable to hack’, The Telegraph, 2017 [accessed 10/7/2020].
S6. ‘ Newly created tool spots TLS vulnerability in major banking and VPN apps’, SC Magazine, 2017 [accessed 13/7/2020].
S7. ‘ Security flaw puts 10 million banking app users at risk’, SC Magazine, 2017, [accessed 13/7/2020].
S8. ‘ Man-in-the-middle flaw left smartphone banking apps vulnerable’, ZDNet, 2017, [accessed 13/7/2020].
S9. ‘ Security Flaw In Banking Apps Make Millions Of Users Vulnerable’, International Business Times, 2017 [accessed 13/7/2020].
S10. Andreea Gabriela Petcu, ‘Security Analysis of TLS in Android Banking Applications’, Final Year Project, University of Birmingham, 2019.