CSE331: Computer Security Fundamentals, Fall 2017

Threat Landscape and Basic Security Principles slides

Recommended Reading

The Protection of Information in Computer Systems

No Class: Labor Day Holiday

Policy, Models, and Trust slides

Recommended Reading

Reflections on Trusting Trust

Homework 1 is out (due 9/22) - check Piazza

OS Security Primitives and Principles slides

Recommended Reading

Gustavo Duarte's Software Illustrated blog posts

Program Security slides

Recommended Reading

Low-level Software Security: Attacks and Defenses
Format String Attacks
Vudo malloc tricks
Once upon a free()...
Basic Integer Overflows

Code Injection (Hands-on Session) part 1 part 2

Recommended Reading

Smashing The Stack For Fun And Profit
Tao of Windows Buffer Overflow
Crash course on buffer overflows by the 10K Students initiative
Using GDB to Develop Exploits - A Basic Run Through

Exploit Mitigations and Code Reuse part 3

Recommended Reading

Bypassing StackGuard and StackShield
Getting around non-executable stack (and fix)
non-exec stack
The advanced return-into-lib(c) exploits: PaX case study
x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique
Bypassing PaX ASLR protection

Homework 2 is out (due 10/13) - check Piazza

Symmetric Key Cryptography slides

Recommended Reading

Handbook of Applied Cryptography
How (not) to use symmetric encryption
The Matasano Crypto Challenges

Public Key Cryptography slides

Recommended Reading

Applied Crypto Hardening

Authentication slides

Recommended Reading

The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
Dos and Don’ts of Client Authentication on the Web
Designing an Authentication System: a Dialogue in Four Scenes
How To Add A Security Key To Your Gmail

Authentication (cont.) + Hands-on Session slides

Lower Network Layers slides

Recommended Reading

Packets Found on an Internet
A look back at “Security problems in the TCP/IP protocol suite”
IP-spoofing Demystified

Lower Network Layers (cont.) + Hands-on Session slides

Recommended Reading

Building Network Tools with Scapy

Homework 3 is out (due 11/10) - check Piazza

Network Scanning and DoS Attacks slides

Recommended Reading

nmap
A Brief History of Scanning
Inferring Internet Denial-of-Service Activity
A Taxonomy of DDoS Attack and DDoS Defense Mechanisms
China’s Great Cannon

No Class

Midterm

DNS slides

Recommended Reading

Using the Domain Name System for System Break-ins
An Illustrated Guide to the Kaminsky DNS Vulnerability

Firewalls and Gateways slides

Recommended Reading

Firewalls and Internet Security: Repelling the Wily Hacker (Second Edition)
Walls and Gates

TLS slides

Recommended Reading

Transport Layer Security (TLS)
Analysis of the HTTPS Certificate Ecosystem

Tunnels and MitM Attacks (Hands-on Session)

Intrusion Detection slides

Recommended Reading

Bro: A System for Detecting Network Intruders in Real-Time
Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection

Malware slides

Recommended Reading

The Art of Computer Virus Research and Defense
How to 0wn the Internet in Your Spare Time
Manufacturing Compromise: The Emergence of Exploit-as-a-Service

Email slides

Recommended Reading

Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0
End-To-End
A Critique Of Lavabit
Off-the-Record Communication, or, Why Not To Use PGP
Forward Secrecy for Asynchronous Messages
Neither Snow Nor Rain Nor MITM... An Empirical Analysis of Email Delivery Security

Web Security: Client Side slides background (courtesy of Nick Nikiforakis)

Recommended Reading

App Isolation: Get the Security of Multiple Browsers with Just One
Regular Expressions Considered Harmful in Client-Side XSS Filters
Robust Defenses for Cross-Site Request Forgery

No Class: Thanksgiving

Web Security: Server Side (check Piazza - slides courtesy of Nick Nikiforakis)

Recommended Reading

SQLrand: Preventing SQL Injection Attacks
Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications
One-Way Web Hacking
35 Pentesting Tools Used for Web Vulnerability Assessment
CGI Security Holes
NT Web Technology Vulnerabilities
Perl CGI problems

Privacy slides

Recommended Reading

Detecting and Defending Against Third-Party Tracking on the Web
Privacy-Preserving Social Plugins
Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting

Anonymity slides

Recommended Reading

Tor: The Second-Generation Onion Router
Detecting Traffic Snooping in Tor Using Decoys
Internet Censorship in China: Where Does the Filtering Occur?