CS496/596: Network Security

Location: EB 92 (MW 11:00-12:40)

Instructor: D. Kevin McGrath

• PDX username: dmcgrath
• Office hours:
  • Location: FAB 120-15
  • Times:
    • Wednesday: Code Party! 18:00 - 22:00 FAB 86-01
    • Whenever you see me in my office with the door open
    • TBD

Teaching Assistant: Chris Lu

• PDX username: chlu
• Office hours:
  • Location: FAB 140 (Lab next to the fishbowl)
  • Times: Tuesday: 10:30 - 12:30

• CS496/596: Network Security
  • Recorded Lectures
  • Homework
    • Submission
    • Assignments
  • Pages
    • Lecture content
    • Other stuff
    • Useful links for learning
  • Previous offerings

Syllabus

Recorded Lectures

All of these are raw recordings, and have not been edited.

• Week 1 - Lecture 1: no recording
• Week 1 - Lecture 2
• Week 2 - Lecture 1
• Week 2 - Lecture 2
• Week 3 - Lecture 1
• Week 3 - Lecture 2
• Week 4 - Lecture 1
• Week 4 - Lecture 2
• Week 5 - Lecture 1
• Week 5 - Lecture 2
• Week 6 - Lecture 1
• Week 6 - Lecture 2
• Week 7 - Lecture 1
• Week 7 - Lecture 2
• Week 8 - Lecture 1: no recording
• Week 8 - Lecture 2: no recording
• Week 9 - Lecture 1: no recording
• Week 9 - Lecture 2: no recording
• Week 10 - Lecture 1: no recording
• Week 10 - Lecture 2: no recording

Homework

Each homework will build in some fashion on the previous homework. This may be conceptually, but may be directly. These aren’t your typical “write answers to questions” type assignments, but rather are intended to be more hands-on. Nearly all the work I’m asking you to do is taken from tasks I had to perform professionally as a security vulnerability engineer. The first assignment will be to get the environment set up and configured. Subsequent assignments will build on this.

Submission

All work will be submitted via MarkDown documents within an internal gitlab repo. You will be using this repo for the rest of the term. This repo exists on the CECS intranet. You will need to add the TA and me to this repo as Developers. Grades and feedback will be done via a merge request from the TA.

Assignments

• Homework 1
• Homework 2
• Homework 3
• Homework 4
• Homework 5
• Final Paper: CS496
• Final Project: CS596 – this can be done by 496 students in place of the paper, for extra credit.

Pages

Lecture content

• Background Concepts Reference – quick reference for networking, crypto, binary analysis, and exploit concepts assumed across the course
• SSH setup – setting up SSH keys for use with the VM
• SSH Tunnel XRDP – free VPN-like capabilities
• tmux cheatsheet
• tmux config – configuration file for tmux from the Software Configuration page
• Linux Handbook on tmux
• Introduction to Networking – a brief introduction to networking concepts
• Unix Text Processing: sed and awk – substitution, in-place editing, validation, and pipeline patterns
• Introduction to network reconnaissance – a brief introduction to network reconnaissance and using nmap
• nmap cheatsheet
• Network Traffic Capture – capture points, strategies, and physical tools
• Capturing packets – a brief introduction to capturing packets
• Lua in Network Security – using Lua in Wireshark, Nmap NSE, and Suricata
• Windows Packet Capture – netsh trace, pktmon, PowerShell capture, Wireshark, tshark, dumpcap
• Cracking WiFi – a brief introduction to cracking WiFi
• Using wireshark – a brief introduction to using wireshark
• Introduction to scapy – a brief introduction to scapy
• scapy cheatsheet (PDF)
• dpkt library
• Pcap Analysis and Manipulation Tools – tcpreplay, tcpflow, ngrep, Zeek, editcap, argus
• Network Flow Analysis: NetFlow, Zeek, and Argus – NetFlow/IPFIX protocol, nfdump, Zeek log analysis and scripting, Argus flow capture and aggregation
• Network-Based Fuzzing – protocol fuzzing tools and techniques
  • demo_server.c
  • demo_fuzzer.py
• Defensive measures – a brief introduction to firewalls and IPS/IDS
• Packet Mangling with NFQUEUE – rewriting packets in flight from userspace: the nftables queue statement, checksums, and why TCP length changes corrupt streams
• FreeBSD Netgraph – graph-based kernel networking: theory, ngctl/nghook usage, and how it differs from Linux
• Network Simulation with ns-3 – measuring attacks you cannot run on a real network: discrete-event simulation, FlowMonitor, pcap output, and quantifying a volumetric DoS against different queueing disciplines
• Suricata IDS/IPS – installation, IDS and IPS modes, rule writing, Lua scripting, EVE log analysis
• Working with SQLite – CLI, schema inspection, timestamp conversion, Python integration, and network tool databases
• 80 to 0 in Under 5 Seconds: Falsifying a Medical Patient’s Vitals – an article detailing a real-world attack on a medical device, including how he reversed the protocol (RWHAT).
• TunnelVision exploit against VPNs – an exploit a malicious network admin could use to render most VPNs useless.
• Ripple20 RH0 bug pcap file – a pcap file demonstrating the Ripple20 RH0 bug
• Ripple20 RH0 bug description – a description of the Ripple20 RH0 bug

Other stuff

• Deprecated Linux network commands – a list of deprecated Linux networking commands and their replacements
• Useful SANS resources
• Software configuration – not required, but possibly useful information on environment setup
• Powershell profile – powershell profile from the Software Configuration page
• Technical Writing – if unfamiliar with markdown or LaTeX, this page will help
• VM Setup on Windows
• Kali on macOS
• Kali configuration

Useful links for learning

• The Art of Packet Crafting with Scapy
• Markdown
• The C Book
• The GNU make manual (PDF)
• Managing projects with make (PDF)
• The chmod calculator
• The Python tutor
• The Linux Command Line (direct PDF download)
• Adventures with the Linux Command Line (PDF)
• The Linux Development Platform
• gdb tutorial
• gef manual

Previous offerings

• Winter 2024
• Spring 2024