CSE508: Network Security, Fall 2017

Threat Landscape slides

Recommended Reading

The Internet Worm Program: An Analysis
Smashing The Stack For Fun And Profit
The advanced return-into-lib(c) exploits: PaX case study
Hacker Curriculum
Crash course on buffer overflows by the 10K Students initiative

No Class: Labor Day Holiday

Lower Layers slides

Recommended Reading

Packets Found on an Internet
A look back at “Security problems in the TCP/IP protocol suite”
IP-spoofing Demystified

Homework 1 is out (due 9/22): Passive Network Monitoring

Lower Layers (cont.) slides

Core Protocols: BGP slides

Recommended Reading

A Survey of BGP Security Issues and Solutions

Core Protocols: DNS slides

Recommended Reading

Using the Domain Name System for System Break-ins
Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority
Hold-On: Protecting Against On-Path DNS Poisoning
An Illustrated Guide to the Kaminsky DNS Vulnerability

Denial of Service slides

Recommended Reading

Inferring Internet Denial-of-Service Activity
A Taxonomy of DDoS Attack and DDoS Defense Mechanisms
Amplification Hell: Revisiting Network Protocols for DDoS Abuse
China’s Great Cannon

Homework 2 is out (due 10/13): Programming with Libpcap

Firewalls and Gateways slides

Recommended Reading

Firewalls and Internet Security: Repelling the Wily Hacker (Second Edition)
Walls and Gates

Symmetric Key Cryptography slides

Recommended Reading

Handbook of Applied Cryptography
How (not) to use symmetric encryption
The Matasano Crypto Challenges

Public Key Cryptography slides

Recommended Reading

Applied Crypto Hardening
WhatsApp Encryption Overview

Authentication slides

Recommended Reading

The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
Dos and Don’ts of Client Authentication on the Web
Designing an Authentication System: a Dialogue in Four Scenes
Keybase Crypto Documents
How To Add A Security Key To Your Gmail

Authentication (cont.) + Hands-on Session slides

TLS slides

Recommended Reading

Transport Layer Security (TLS)
Analyzing Forged SSL Certificates in the Wild
Analysis of the HTTPS Certificate Ecosystem
An Experimental Study of TLS Forward Secrecy Deployments
Killed by Proxy: Analyzing Client-end TLS Interception Software

Homework 3 is out (due 11/10): Plugboard Proxy

Midterm

No Class

Hands-on Session

Encrypted Communication Part 3: Failures

Recommended Reading

The Matter of Heartbleed
An Empirical Study of Cryptographic Misuse in Android Applications
Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice
A Comprehensive Study of BEAST, CRIME, TIME, BREACH, Lucky 13 & RC4 Biases
FREAK, POODLE, DROWN, KRACK, ROCA

Reconnaissance slides

Recommended Reading

nmap
ZMap: Fast Internet-Wide Scanning and its Security Applications
A Brief History of Scanning
An Internet-Wide View of Internet-Wide Scanning

Malware slides

Recommended Reading

The Art of Computer Virus Research and Defense
How to 0wn the Internet in Your Spare Time
Your Botnet is My Botnet: Analysis of a Botnet Takeover
Manufacturing Compromise: The Emergence of Exploit-as-a-Service
Beheading Hydras: Performing Effective Botnet Takedowns

Malware (cont.) + Hands-on Session slides

Intrusion Detection slides

Recommended Reading

Bro: A System for Detecting Network Intruders in Real-Time
Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection

Homework 4 is out (due 12/8): DNS Injection

Email slides

Recommended Reading

Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0
End-To-End
A Critique Of Lavabit
Off-the-Record Communication, or, Why Not To Use PGP
Forward Secrecy for Asynchronous Messages
Neither Snow Nor Rain Nor MITM... An Empirical Analysis of Email Delivery Security

Spam and Phishing slides

Recommended Reading

Understanding the Network-Level Behavior of Spammers
@spam: The Underground on 140 Characters or Less
Click Trajectories: End-to-End Analysis of the Spam Value Chain
The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape

Web Security: Client Side slides background (courtesy of Nick Nikiforakis)

Recommended Reading

App Isolation: Get the Security of Multiple Browsers with Just One
Regular Expressions Considered Harmful in Client-Side XSS Filters
Robust Defenses for Cross-Site Request Forgery

No Class: Thanksgiving

Web Security: Server Side (check Piazza - slides courtesy of Nick Nikiforakis)

Recommended Reading

SQLrand: Preventing SQL Injection Attacks
Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications
One-Way Web Hacking
35 Pentesting Tools Used for Web Vulnerability Assessment
CGI Security Holes
NT Web Technology Vulnerabilities
Perl CGI problems

Privacy slides

Recommended Reading

Detecting and Defending Against Third-Party Tracking on the Web
Adnostic: Privacy Preserving Targeted Advertising
Privacy-Preserving Social Plugins
Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting

Anonymity slides

Recommended Reading

Tor: The Second-Generation Onion Router
Low-Cost Traffic Analysis of Tor
Detecting Traffic Snooping in Tor Using Decoys
Internet Censorship in China: Where Does the Filtering Occur?