Benjamin Mixon-Baca

My name is Benjamin Mixon-Baca. I am a PhD student at Arizona State University (ASU). I have been working in the security space for 10 years in various capacities. Early in my career, I was a seasonal OTF Fellow during the summer of 2015 and worked with Citizen Lab helping defend against targeted threats by deploying and maintaining IDS and analytics software to defend various NGOs. In 2016, I held a seasonal fellowship at ICSI where I worked on developing Zeek scripts to fingerprinting Tor based on byte patterns of the TLS four way handshake. I finished my Masters Degree in computer science in 2017.

From 2017 to 2020, I worked in the private sector leading different research efforts. I worked on a range of projects from automated attack frameworks similar to the Metasploit framework, to machine learning projects to rank vulnerabilities from most to least exploitable using open source intelligence (OSINT) from the national vulnerability database (NVD), Twitter, and similar, to performing penetration tests. At the end of 2019 my colleagues from UNM and I founded Breakpointing Bad, a non-profit focused on Internet freedom research.

In Spring 2020, I left the private sector to pursue my PhD and transferred to ASU under the mentorship of Dr. Jedidiah Crandall. My current research has focused broadly on developing attacks and defenses against computer systems. During this time, Jed and I developed multiple attacks against VPNs that we call Network Alchemy. These attacks allow the attacker to place himself between a VPN client and server from an initially off-path position, break the VPN anonymity, or reroute VPN client packets to an attacker. From 2021-2022 I worked as an OTF ICFP fellow with University of Michigan where we developed CryptoSluice, a tool for automatically identifying weak and unencrypted traffic at scale in an ethical way. CryptoSluice allows an analyst to process real network traffic at high speed and generate a list of candidate applications that an analyst can reverse engineer while protecting the privacy of the network being analyzed.

The goal of this project is provide information about who owns, operates, and develops VPNs popular to at-risk users in historically repressive countries according to Freedom House's Internet Freedom Score. Users place incredible trust in VPN operators so it is vital they know with whom they trust their data. It is surprisingly difficult to attribute specific persons or organizations to VPNs. Furthermore, few have investigated beyond the VPN owner, e.g., most existing information pertaining to VPN providers focuses solely on them and not on the different cloud providers in which their services run, who developed there VPN, their social media and advertising footprint, or related business units that underpin VPN operators. The second goal of this work is a technical analysis to determine if a lack of transparency and poor security are correlated. To achieve these goals, I will be building a tool to automate as much of the osint data collection as possible. This will then be used to build a transparency profile for each VPN. The data will also be used to rank VPNs based on their transparency. The ranking is then used to perform a comparative analysis between VPNs with high transparency and those with low transparency.