CSE466 -- Computer Systems Security, Fall  2008

Disclaimer:

This is a set of notes, that summarizes the class coverage of material. By no means is this comprehensive or is a substitute for class notes and attendance. Also, updating of this page is not guaranteed to be frequent.

 This page will be updated as class progresses....

Class 1: Aug 25

• Introductory class, about the course
• [class audio]

Class 2: Aug 27

• Basics of Security
• Attacks and Classes
• [class notes (jnt)] [class notes (pdf)] [class audio] // Note view the ".jnt" file you need a Journal Viewer, from Microsoft

Class 3: Sept. 3

• XSS, DNS and BGP attacks
• Shared secrets, and passwords
• PKI systems
• Multifactor authentication
• [class notes (jnt)] [class notes (pdf)] [class audio]

Class 4: Sept. 8

• Threat Models
• Ken Thompson Lecture
• Buffer Overflow Example [source code]
• [class notes (jnt)] [class notes (pdf)] [class audio]

Class 5: Sept. 10

• Vulnerabilities
• Attacks
• Passwords storage and dictionary attacks
• Network Attacks
• [class notes (jnt)] [class notes (pdf)] [No Audio (malfunction)]

Class 6 : Sept. 15

• Breaking encryption [difficulty]
• History of Encryption Breaking
• Histoy of Attacks -- WEP, GSM, CSS, HD-DVD, RFID,
• XSS attacks [reflection] [stored]
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 7 : Sept. 17

• Hacking and Ethics
• Rootkits
• Attacks - MITM, DoS, Pharming, etc
• Countermeasures
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 8 : Sept. 22

• Large Numbers [slide]
• Random Numbers
• Hashes [slide]
• Encryption [vignere] [DES]
• Coin tossing
• [class notes (jnt)] [class notes (pdf)]

Class 9 : Sept. 24

• Steganography
• Authentication
• Asymmetric Encryption and RSA
• Authentication using public keys
• Key Exchange using public keys
• Digital Signatures
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 10 : Sept. 29

• Public Key authentication and key exchange and signatures
• Hybrid Communications
• MITM attacks
• Digital Certificates
• Certificate Authorities
• Birthday attack (basic)
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 11 : Oct 1

• Birthday Paradox/Birthday Attack
• Attacks on Cryptosystems
• Systems attacks
• Data and key stealing
• Hardware and Virtual machine solutions
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 12 : Oct 6

• Finding keys in memory
• Malware, virus, trojans, adware, rootkits
• Types of viruses - parasitic, Macro, Encrypted, Polumorphic
• AV software and virus detection
• Rootkit technologies
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 13 : Oct 8

• Secure coding
• Strings, pointers, heap, integers, printf
• Examples of off by one and buffer overflows
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 14 : Oct 13

• Strings and problems
• Stack Structure (in assembly)
• Safe string libraries
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 15 : Oct 15

• Stack guarding libraries
• Randomization of address sapce
• Pointer problems
• [class notes (jnt)] [class notes (pdf)] [class audio] 

MID TERM: Oct 20 (MON)   

Class 16 : Oct 22

• Pointer issues, setjmp/longjmp
• Dynamic memory allocation
• unlink, double free attacks
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 17 : Oct 27

• malloc/free and memory management, revisited
• unlink and double free attacks
• integer types, ranks and conversions
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 18 : Oct 29

• Integer errors, examples
• Format string problems
• Arbitrary memory reads
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 19: Nov 3

• Arbitrary memory writes
• [class notes (jnt)] [class notes (pdf)] [class audio] 
• Reference material: [book1] [book2] [printf vulnerabilities]

Class 20: Nov 5

• Memory layouts and bytes
• Input output and conversions
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 21: Nov 10

• Ptrace Lecture by Raghu
• Notes will be posted as part of the project,
• Project posting is here

Class 22: Nov 12

• Operating Systems Structure
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Please note that PDF lecture notes are updated late.....still missing

Class 23: Nov 17

• SQL injection and XSS lecture by Christian Korscheck
• [slides]

Class 24: Nov 19

• Operating Systems
• Syscall vulnerabilities
• Rootkits
• Network Attacks
• Port scanning
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 25: Nov 24

• Rainbow Tables
• Virtual Machines
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 26: Nov 26

• Secure Hardware
• Debit cards, RFID cars, challenge response cards, PKI cards
• Protocols for challenge response and PKI
• TPM introduction
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 27: Dec 1

• Authentication (multifactor)
• Secure cards and secure processors
• TPM - slides [set1] [set2] [set3]
• Attacks on PKI, secure I/O
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 28: Dec 3

• Privacy
• Security Policies
• Standards documents (FIPS, Common Criteria)
• Malware resistance
• Remote Attestation
• Software Diversity
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Class 29: Dec 8 – Last Class….

• Review Class
• [class notes (jnt)] [class notes (pdf)] [class audio] 

Exam: Wed Dec 17 12:10 - 2:00 PM