CSE509: Schedule

Schedule

Recommended reading material is listed under each lecture.

Tue 1/24

Introduction and Basic Concepts slides

Why Offensive Security Needs Engineering Textbooks

Thu 1/26

Ethicsslides

About Penetration Testing
Markets for Zero-Day Exploits: Ethics and Implications
Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws
Project Zero: Policy and Disclosure: 2021 Edition

Tue 1/31

Threat Landscape and Basic Security Principlesslides

The Protection of Information in Computer Systems

Thu 2/2

Policy, Models, and Trustslides

Reflections on Trusting Trust

Tue 2/7

Operating System Security Primitives and Principlesslides

Multics Security Evaluation: Vulnerability Analysis
Thirty Years Later: Lessons from the Multics Security Evaluation

Thu 2/9

Software Vulnerabilitiesslides

Low-level Software Security: Attacks and Defenses
OWASP: Vulnerabilities
Heap Exploitation Part 1: Understanding the Glibc Heap Implementation
Format String Attacks
Vudo malloc tricks
Once upon a free()...
Basic Integer Overflows

Tue 2/14

Memory Corruption: Code Injection slides part 1 slides part 2

Smashing The Stack For Fun And Profit
Tao of Windows Buffer Overflow
The Internet Worm Program: An Analysis
Crash course on buffer overflows by the 10K Students initiative
Using GDB to Develop Exploits - A Basic Run Through

Thu 2/16

Memory Corruption: Code Reuseslides

Getting around non-executable stack (and fix)
non-exec stack
The advanced return-into-lib(c) exploits: PaX case study
x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique
Return-Oriented Programming: Systems, Languages, and Applications

Tue 2/21

Vulnerability Discoveryslides

Fuzz Testing of Application Reliability
Evaluating Fuzz Testing
The Fuzzing Book: Tools and Techniques for Generating Software Tests
Awesome Fuzzing
American Fuzzy Lop
SoK: Sanitizing for Security
Undefined Behavior in 2017
Static Source Code Analysis Tools for C
Automated vulnerability auditing in machine code
Dynamic Program Analysis and Software Exploitation: From the crash to the exploit code
Cyber Grand Shellphish

Thu 2/23

Exploit Mitigationsslides

StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
Documentation for the PaX project
Scraps of notes on remote stack overflow exploitation
Bypassing StackGuard and StackShield
Control-flow Integrity: Principles, Implementations, and Applications
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization
SoK: Eternal War in Memory
Exploitation Mitigations
Mitigating Software Vulnerabilities
Windows 10 Mitigation Improvements

Tue 2/28

Symmetric Key Cryptographyslides

Handbook of Applied Cryptography
The Joy of Cryptography
A Graduate Course in Applied Cryptography
Crypto 101
How (not) to use symmetric encryption
An Empirical Study of Cryptographic Misuse in Android Applications

Thu 3/2

Public Key Cryptographyslides

Applied Crypto Hardening
WhatsApp Encryption Overview
ECDSA: The digital signature algorithm of a better internet
The Matasano Crypto Challenges

Tue 3/7

Authenticationslides

A Framework for Comparative Evaluation of Web Authentication Schemes
Dos and Don’ts of Client Authentication on the Web
Designing an Authentication System: a Dialogue in Four Scenes
zxcvbn

Thu 3/9

Midterm

Tue 3/14

No Class: Spring Recess

Thu 3/16

No Class: Spring Recess

Tue 3/21

Authenticationslides

Thu 3/23

Reverse Engineering

Tue 3/28

Reverse Engineering

Thu 3/30

Malware

Tue 4/4

Malware

Thu 4/6

Intrusion Detection

Tue 4/11

No Class

Thu 4/13

Social Engineering

Tue 4/18

Hardware Vulnerabilities

Thu 4/20

Web Browser Security

Tue 4/25

Server Security

Thu 4/27

Container Security

Tue 5/2

Cloud Security

Thu 5/4

Physical Security