CS491/591 Introduction to Computer Security Fall 2012

Instructor: Andrew Tolmach

Course Information

Final Exam

List of topics
The exam will be closed-book. However, you are allowed to bring one single-sided 8.5x11 sheet of notes (handwritten or typeset) to refresh your memory; you will need to hand this in with your exam.

Midterm

List of topics
The midterm will be closed-book. However, you are allowed to bring one 8.5x11 sheet of notes (handwritten or typeset) to refresh your memory; you will need to hand this in with your exam.

Course Schedule

Sep. 24: Introduction; fundamental terminology
- Read: Pf/Pf Ch. 1
- Video: Ed Felton (Princeton), Electronic Voting: Danger and Opportunity (Purdue CERIAS seminar, Jan. 2008).
- Video: Bruce Dang (Microsoft), Adventures in Analyzing Stuxnet (27C3, Dec. 2010)
Sep. 26: Authentication; human factors
- Read: Pf/Pf Ch. 2 and skim Ch. 5
- Discussion questions
Oct. 1: Software security; buffer overflow attacks
- Read: Pf/Pf Ch. 3 (just skim pp. 97-123) and Ch. 6 (through p. 260)
- Read: Aleph One, Smashing the stack for fun and profit (Phrack magazine 49, 1996)
- Discussion questions
- Project 1 issued
  - X86-64 resources
  - program to print main's sp
- rough lecture notes
Oct. 3/8: Tools and countermeasures against software exploits
- John Mitchell's slides on static analysis. (I went through slides 7-19.)
- Charlie Miller, "Babysitting an army of monkeys: an analysis of fuzzing 4 products with 5 lines of Python", video stream (part 1) (part 2).
- suggested reading: Bessey,...,Engler, "A few billion lines of code later: using static analysis to find bugs in the real world," CACM 53(2), Feb. 2010.
Oct. 10: Malware; virus detection; hacking tools
- Read: Pf/Pf Chs. 4 and 6 (from p. 261)
- Discussion questions
- Project 1 first part due (by 2pm!)
- optional reading: Avgerinos, Cha, Hao, Brumley"AIG: Automatic Exploit Generation", NDSS 2011 (updated version).
Oct. 15: Access control in theory and practice;
- NOTE: If you have trouble downloading these papers from home, try again from a .pdx.edu domain (e.g. by using the VPN). It is also easy to find unprotected copies elsewhere on the web.
- Read: Yee, et al. "Native Client: a sandbox for portable untrusted x86 native code", CACM 53(1), January 2010.
- Read: Li Gong, "Java Security architecture revisited", CACM 54(11), Nov. 2011.
- Read: Enck, et al., "Understanding Android Security", IEEE Security and Privacy, 7(1), Jan-Feg. 2009.
- Project 1 second part due
- Steve Zdancewic's slides on access control. I covered slides 2-9 and 11-27.
Oct. 17: Java security model; Information flow and multi-level security
- Steve Zdancewic's slides on Java security. I covered slides 3-9 and 12-38.
Oct. 22: Basic cryptography
- Read: Pf/Pf Chs. 7 and 11 (focus on Asymmetric Cryptography section)
- Discussion/Puzzle questions
Oct. 24: Shared and Public key algorithms
- slides
Oct. 29: Midterm Exam (in class)
Oct. 31: Guest lecture (Charles Wright, PSU)
- slides (large file!)
Nov. 5: Networks; port scanning; firewalls
- Read: Pf/Pf Chs. 9 and 11 and skim Ch. 10
- Tom Ristenpart's slides on port scanning.
- Discussion questions
- Term paper bibliographies due
- Project 2 issued
  - Traces for part 1 (large!)
  - Java bindings for pcap on linuxlab
    - The jpcap library is hosted here. (Warning: there is another, somewhat similar, library from uci.edu that is also called jcap.)
    - jpcap.jar (includes java classes, examples, etc.)
    - libjpcap.so (linux shared library for java-to-c glue layer)
    - javadoc for jpcap.
    - To compile or run a program using jpcap, include jpcap.jar in your CLASSPATH and put the directory containing libjpcap.so on your LD_LIBRARY_PATH.
  - For part 2: A 10 minute trace file and a 4 hours trace file collected by MIT Lincoln Labs in 1998. (Note: There are no port scans (I think!) in these traces.)
  - A 35 minute trace with a quick sequential SYN scan and a one hour trace with a slower random-order SYN port scan.
Nov. 7: Protocols for confidentiality and authentication
Nov. 12: Veteran's Day Holiday (no class)
- Read: Pf/Pf Chs. 12 and 14
- Discussion questions
Nov. 14: Protocol attacks: man-in-the-middle, replay, etc.
- Steve Zdancewic's slides on SHA-1.
- Steve Zdancewic's slides on Protocols. I covered slides 4-7 and 21-29.
Nov. 19: Digital signatures, PKI
- Steve Zdancewic's slides on key kistribution.
- Video: Moxie Marlinspike, SSL and the Future of Authenticity (BlackHat USA 2011)
Nov. 21: Kerberos, SSL/TLS.
- Read: Pf/Pf Ch. 13
- Tom Ristenpart's slides on TLS.
Nov. 26: Web security; some Term paper presentations (in class)
- Read: Pf/Pf Ch. 15
- Video: OWASP Appsec TUtorial on SQL INjection
- Video: OWASP Appsec TU torial on cross-site scripting
- Presentation by Nathan Collins on Information-flow Security.
- Presentation by Larry Diehl on Authorization Logics and Applications.
- Presentation by Shaun Brandt on Markets and Malware: Detecting Malicious and Privacy-stealing Apps in Smartphone Marketplaces.
Nov. 28: remaining Term paper presentations (in class)
- Project 2 due
- Presentation by Caylee Hogg on SPI calculus (no slides).
- Presentation by Charles Capps on Android Permissions.
- Presentation by Ahmed Osman: Cloud Computing Security Risk Analysis.
- Presentation by Max Garvey: Cloud Security Survey.
- Presentation by Samuel Heinith on Cross-Site Scripting (no slides).
Dec. 1: Term papers due
Dec. 5: Final Exam (Wednesday starting at 12:30pm)

Term Papers

Some possible topics