Papers and Publications

Publications in peer-reviewed journals and conferences

Rennie deGraaf, Islam Hegazy, Jeffrey Horton, Reihaneh Safavi-Naini. Distributed Detection of Wormhole Attacks in Wireless Sensor Networks, Proc. ADHOCNETS 2009, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, Vol. 28, 2010, pp 208-223. (I did most of the work on this paper, but I left the research group before it was submitted for publication and my co-authors re-wrote most of it. I'm not sure if I've ever read the published version.)
John Aycock, Heather Crawford, Rennie deGraaf. Spamulator: the Internet on a laptop, Proc. ITiCSE '08 (June 2008), pp 142-147.
John Aycock, Rennie deGraaf, and Michael Jacobson, Jr. Anti-Disassembly using Cryptographic Hash Functions, Journal of Computer Virology, Vol. 2, No. 1 (August 2006), pp 79-85. (This is an extended version of the 2005 technical report the EICAR 2006 paper below.)
John Aycock, Rennie deGraaf, and Michael Jacobson, Jr. Anti-Disassembly using Cryptographic Hash Functions, Proc. 15th Annual EICAR Conference (April 2006), pp 38-47. Errata. (This is an extended version of the 2005 technical report below.)
Rennie deGraaf, John Aycock, and Michael Jacobson, Jr. Improved Port Knocking with Strong Authentication Proc. ACSAC 2005 (December, 2005), pp 409-418. Presentation slides. Errata.

I have an Erdős number of 4: I co-authored papers with Michael J. Jacobson (listed above). He co-authored papers with Hugh C. Williams, who co-authored with George B. Purdy, who co-authored with Paul Erdős. Now I just need to find a way to get a Bacon number.

Other publications

Rennie deGraaf. Demystifying AWS AssumeRole and sts:ExternalId, NCC Group Research Blog, December 2019.
Rennie deGraaf. Enhancing Firewalls: Conveying User and Application Identification to Network Firewalls. Computer Science Master's Thesis, Department of Computer Science, University of Calgary, May 2007. Errata.
John Aycock, Rennie deGraaf, and Michael Jacobson, Jr. Anti-Disassembly using Cryptographic Hash Functions, Technical Report 2005-793-24, Department of Computer Science, University of Calgary, 2005. Errata.

Presentations

Rennie deGraaf. The SVG Security Model. Amazon Friday Learning Series, 06 February 2015.
Rennie deGraaf. The SVG Security Model. iSEC Open Forum, 11 December, 2014.
Rennie deGraaf. The SVG Security Model. OWASP Seattle, 12 November, 2014.
Rennie deGraaf. SVG: Exploting browsers without image parsing bugs. Black Hat USA 2014, Las Vegas, NV, USA, August 2014.
Renie deGraaf. Constant Blinding. iSEC Seattle Open Forum, fall 2013.

Corrections and Clarifications

Enhancing Firewalls: Conveying User and Application Identification to Network Firewalls
- On the last line of page 159, the phrase "Target 3 dropped the 4^th packet" should be "Target 3 dropped the 7^th packet".

Anti-Disassembly using Cryptographic Hash Functions (EICAR 2006 and TR 2005-793-24 versions)
- In Table 1, the search time for the key "aycock" using the MD5 hash should be 68955 seconds, not 39615.

Improved Port Knocking with Strong Authentication
- Algorithms 1 and 2 are only secure against mafia frauds (aka "grandmaster postal-chess attack") if the keys associated with request sequences are unique. This problem can be solved by covering the request sequence in the response MACs.
- In the first paragraph of Section 6.2.2, the phrase "to compute the challenge" should be "to compute the response".
- Algorithms 2 and 3 don't actually protect against mafia frauds, despite my claims to the contrary. There is no reason to ever actually use them. See my thesis (above) for details.

Plagiarism

Like anyone who's ever done anything that anyone else cared about, I've been plagiarized:

Port–Knocking System using Unilateral Authentication Algorithm by Rashmi Tiwari, published in Volume 3, Issue 9 (September 2013) of the International Journal of Scientific and Research Publications is largely copied from my MSc thesis (above). Sections III and IV of that paper are copied word-for-word, except that a couple of the constants in the equations in section IV were changed and the tables re-calculated based on the new constants. Parts of sections V and VI are also copied from my thesis, and parts of the abstract are copied from my ACSAC 2005 paper (above). Tiwari did cite my ACSAC 2005 paper, but made no mention of what my contributions were or of the complete lack of her own contributions. I sent a letter to editor@ijsrp.org on 2014-03-12 requesting that this paper be withdrawn on the grounds of blatant plagiarism; I never received a response, but the paper seems to have been removed from the IJSRP web site.
In the fall of 2003, Sonny Chan, Garth Rowe, Aarti Punj, Matt Templeton, and I developed a simple simulation of blood clotting using swarm techniques for our term project in CPSC 533 (Artificial Intelligence) at the University of Calgary. The instructor of that course, Dr. Christian Jacob, later requested access to our sources and paid us each $500 to do some additional work on it over the winter and spring of 2004 with the goal of publishing a paper on it. To my knowledge, no paper was published at the time. However, it seems that Dr. Jacob has more recently integrated our blood clotting work into his LINDSAY Virtual Human project. He and some of his more recent students have published papers relating to the blood clotting model without attributing the original research to us. For instance, in An Agent-Based Simulation of Blood Coagulation Processes, by Iman Yazdanbod and S. Marcus, published in vol 1 (2010) of the Journal of Undergraduate Research in Alberta, the interaction model is pulled directly from our work, figure 1 appears to be a prettied-up version of a diagram that I have in a draft document last modified in July 2004, and figure 5 appears to be a version of our simulation with upgraded graphics. Similar material appears in a number of papers from Dr. Jacob's research group within the past few years, none of which attributes the original research to my group.