Lectures

(Note this is a rough schedule and things are subject to change.)

Aug 26, 2020 Security Principles: Introduction, Ethics, and Course Overview (Instructor: Bryan) | [Notes]
This lecture will give a high-level overview of the course, including topics covered, learning goals, and course mechanics. We will also discuss ethical challenges associated with computer security.
Reading:
- On Trusting Trust
Aug 28, 2020 Security Principles: Threat Models and Trusted Computing Bases (Instructor: Bryan) | [Notes]
This lecture will present techniques to reason systematically about an attacker's capabilities and a system's security dependencies.
Reading:
- Computer Security and the Internet, Ch. 1 (up to and including 1.8)
Aug 30, 2020 Security Principles: Recitation: Designing Secure Systems (Instructor: Bryan) | [Notes]
This lecture will focus on principles of secure system design, and the three “AU”’s: authentication, authorization, and audit.
Reading:
- Computer Security and the Internet, Ch. 5 (sections 5.2-5.4,5.7)
Optional Reading:
- Computer Security in the Real World
- Protection of Information
Sep 2, 2020 : No Class
University holiday: Labor day. Enjoy the day off!
Sep 4, 2020 Software Security: Execution Semantics and Buffer Overflows (Instructor: Bryan) | [Notes]
This lecture will review the material up through Chapter 3 of CS:APP from 15-213. Consider reviewing the course notes linked below as well. We will cover the parts of the compilation tool chain and operations at the assembly level, including control flow, the memory model, and stack frames. We will also present control-flow-hijacking attacks that gain control of the instruction pointer, with a focus on buffer overflows.
Reading:
- Chapter 3 of Computer Systems A Programmers Perspective Volume 2
- Smashing the Stack for Fun and Profit
Optional Reading:
- 15-213 Course Schedule (review the "Machine Prof" lectures )
Sep 6, 2020 Software Security: Recitation: Thinking Up Exploits - Part 1 (Instructor: Bryan)
Sep 9, 2020 Software Security: Control-Flow Attacks and Defenses (Instructor: Bryan) | [Notes]
In this lecture we will present additional control-flow-hijacking attacks that gain control of the instruction pointer, e.g., format-string exploits, and integer overflows. We will then introduce control flow hijack defenses found in practice today, including canaries, DEP, and randomization (ASLR). We will also discuss methods for bypassing these defenses.
Reading:
- Exploiting Format String Vulnerabilities
- Smashing the Stack in 2011
- Design of ASLR in PAX
- ASLR Smack and Laugh Reference
Optional Reading:
- Effectiveness of ASLR
Sep 11, 2020 Software Security: Return Oriented Programming (Instructor: Bryan) | [Notes]
This lecture will review Return Oriented Programming attacks.
Reading:
- The Geometry of Innocent Flesh on the Bone Return-into-libc without Calls (on the x86)
Optional Reading:
- Return-Oriented Programming Systems, Languages, and Applications
- Q Exploit Hardening Made Easy
- ropasaurusrex a primer on return-oriented
Sep 13, 2020 Software Security: Recitation: Thinking Up Exploits - Part 2 (Instructor: Bryan)
Sep 16, 2020 Software Security: Retrofitting Memory Safety (Instructor: Bryan) | [Notes]
This lecture will cover techniques to retrofit memory safety on legacy C code, including Control Flow Integrity (CFI). CFI is a security property that specifies real executions should follow the static CFG. We will explore CFI, focusing on what "the" CFG is.
Reading:
- CCured: Type-Safe Retrofitting of Legacy Software (Sections 4-6 are optional)
- Control Flow Integrity Principles, Implementations, and Applications
Sep 18, 2020 Software Security: Type Systems and Verification (Instructor: Bryan) | [Notes]
We will cover programming language techniques to eliminate entire classes of vulnerabilities and even prove strong properties about software.
Reading:
- Using Dafny, an Automatic Program Verifier (Sections 0 and 1)
- Dafny Tutorial (Complete the main tutorial, plus the tutorials on Sequences and Lemmas)
Sep 20, 2020 Software Security: Recitation: Provably Correct Software (Instructor: Bryan)
Sep 23, 2020 Software Security: Code Analysis and Isolation Techniques (Instructor: Bryan) | [Notes]
This lecture will cover techniques to analyze code for memory vulnerabilities. To mitigate vulnerabilities we cannot or do not find, we will cover various system mechanisms for achieving isolation: sandboxing, Software Fault Isolation (SFI), program partitioning, and airgaps.
Reading:
- Computer Security and the Internet, Ch. 5 (section 5.1)
- Software Fault Isolation
Optional Reading:
- A Few Billion Lines Of Code Later: Using Static Analysis To Find Bugs In The Real World
- Native Client
Sep 25, 2020 Systems Security: Modern OS Security and Authorization Logic (Instructor: Bryan) | [Notes]
This lecture will focus on modern OS security, covering topics such as access control and capabilities, as well as a logical framework for reasoning about authorization.
Reading:
- A Calculus For Access Control In Distributed Systems
- A Graduate Course in Applied Cryptography (Ch. 13.8)
Sep 27, 2020 Review: Software & Systems Security (Instructor: Bryan)
This slot will be a review period. We will provide approximately a 30 minute review, and then will open up the floor for questions. Please think ahead of time what would be good questions; we are happy to answer anything. If there are no questions, it will be a short meeting.
Sep 30, 2020 Systems Security: Trusted Computing (Instructor: Bryan) | [Notes]
This lecture will cover techniques for bootstrapping trust in systems.
Reading:
- Bootstrapping Trust in Commodity Computers
Oct 2, 2020 Exam: Software & Systems Security (Instructor: Bryan)
We will have the first exam of the course. It will cover all information covered to date except Trusted Computing. This will be a closed book, closed notes, closed neighbor exam.
Oct 4, 2020 Crypto: Recitation: Crypto Background (Instructor: Bryan)
We will review the mathematics needed to understand modern cryptographic algorithms and discuss the basics of writing rigorous proofs.
Reading:
- A Graduate Course in Applied Cryptography (Appendix A.1, A.2 (except A.2.3), A.3, Appendix B)
Oct 7, 2020 Crypto: Introduction to Cryptography (Instructor: Bryan) | [Notes] | [Details]
In this lecture we will provide a high-level introduction to cryptography, including an overview of primitives and security models. We will touch on the rich power offered by modern cryptographic tools. Finally, we will discuss (in)secure sources of randomness.
Reading:
- A Graduate Course in Applied Cryptography (Ch. 2.1, 2.2, and 3.10)
Optional Reading:
- Coursera Course on Cryptography
- Handbook of Applied Cryptography Chapter 1
Oct 9, 2020 Crypto: (Pseudo)Randomness (Instructor: Lujo Bauer) | [Notes] | [Details]
We will cover the principles of pseudorandom functions, permutations, and introduce the notion of adversarial games to prove security properties of cryptographic constructions.
Reading:
- A Graduate Course in Applied Cryptography (Ch. 4.4)
Oct 11, 2020 Crypto: Recitation: Proof by Reduction (Instructor: Nick)
We will review game-based definitions of security and practice determining whether a scheme is secure, either by demonstrating an adversary with non-trivial advantage or by proving that no such adversaries exist.
Oct 14, 2020 Crypto: Secrecy and Symmetric Key Ciphers (Instructor: Bryan) | [Notes] | [Details]
We will cover definitions of computations secrecy, block ciphers, and block cipher modes.
Reading:
- A Graduate Course in Applied Cryptography (Ch. 2.3, 2.4, 4.1, 4.2, 4.5, 5.1, 5.3-5.5)
Oct 16, 2020 Crypto: Integrity, Hashes, and MACS (Instructor: Bryan) | [Notes] | [Details]
This lecture will look at the property of integrity, and the crypto primitives hashes and macs. We will also cover basics of authenticated encryption, which is a commonly used operation.
Reading:
- A Graduate Course in Applied Cryptography (Ch. 6.1-6.3, 8.1-8.4, 8.6-8.7, 9.1-9.2,9.4)
Optional Reading:
- Message Authentication using Hash Functions: The HMAC Construction
- The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
Oct 18, 2020 : No Recitation
Mid-semester break
Oct 21, 2020 Crypto: Public Key Cryptography (Instructor: Bryan) | [Notes] | [Details]
In this lecture we will cover the fundamentals of public key cryptography, focusing on RSA and Diffie-Hellman as examples.
Reading:
- A Graduate Course in Applied Cryptography (Ch. 10.1-10.5, 10.7, 11.1-11.4, 13.1-13.2)
Optional Reading:
- Remote Timing Attacks are Practical
Oct 23, 2020 Crypto: Blockchains, Cryptocurrencies, and Smart contracts (Instructor: Bryan) | [Notes]
We will cover the basics of blockchains (what they are, what they are and are not good for), cryptocurrencies and, time permitting, smart contracts
Reading:
- Bitcoin and Cryptocurrency Technologies (Pages 3-21)
Optional Reading:
- Bitcoin and Cryptocurrency Technologies (Chapters 1-2)
Oct 25, 2020 : No Recitation
Community Engagement Day
Oct 28, 2020 Network Security: Introduction to Network Security (Instructor: Bryan) | [Notes]
This lecture will give a broad overview of network security, including general principles, denial-of-service attacks, and intrusion detection (and prevention) systems. The latter will cover some basic detection theory, focusing on the base rate fallacy.
Reading:
- Computer Security and the Internet, Ch. 10 (sections 10.1-10.2) (10.6 is optional but possibly useful)
- Computer Security and the Internet, Ch. 11 (sections 11.1-11.2, 11.4)
Optional Reading:
- The Base Rate Fallacy and its implications for the difficulty of intrusion detection
- Security Problems in the TCP/IP Suite
- A Look Back Security Problems in the TCP/IP Suite
Oct 30, 2020 Network Security: Protocol Design and Analysis (Instructor: Bryan) | [Notes]
This lecture will cover design principles for secure protocols, common failures and defenses, and tools for analyzing protocol security. TLS will be used as a detailed case study.
Reading:
- Prudent Engineering Practice for Cryptographic Protocols
Optional Reading:
- A Comprehensive Symbolic Analysis of TLS 1.3
Nov 1, 2020 Review: Crypto (Instructor: Bryan)
This will be a review session for all lectures on cryptography plus Trusted Computing. Please think ahead of time what questions you may have.
Nov 4, 2020 Exam: Crypto (Instructor: Bryan)
We will have the second exam of the course. It will cover all information covered to date, but it will focus on Trusted Computing and Crypto. This will be a closed book, closed note, closed neighbor exam.
Nov 6, 2020 Web Security: Attacks (Instructor: Bryan) | [Notes]
This lecture will cover web security, including vulnerabilities such as injection attacks, XSS, and CSRF.
Reading:
- Computer Security and the Internet, Ch. 9
Optional Reading:
- Cross Site Scripting Explained
- Robust Defenses for Cross-Site Request Forgery
Nov 8, 2020 Web Security: Recitation: Web Hacking (Instructor: Bryan)
Nov 11, 2020 Web Security: Defenses (Instructor: Bryan) | [Notes]
This lecture will cover web security with a focus on principles, such as authentication vs. authorization, and best practices for establishing security on the web.
Optional Reading:
- Native Client: A Sandbox for Portable, Untrusted x86 Native Code
- Beware of Finer-Grained Origins
Nov 13, 2020 Human Factors: Making Security Usable (Instructor: Bryan) | [Notes]
The most secure system in the world can be subverted if users can't employ it correctly (or if they themselves are subverted!). This lecture will cover usable design, with case studies drawn from security warnings, authentication, and phishing. We will also cover attacks and defenses based on social engineering.
Reading:
- Why Johnny Can’t Encrypt A Usability Evaluation of PGP 5.0
Optional Reading:
- A Framework for Reasoning About the Human in the Loop
- Crying Wolf: An Empirical Study of SSL Warning Effectiveness
- The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
Nov 15, 2020 Web: Recitation: Homework 3 office hours (Instructor: TAs)
Come work on homework 3 with a gaggle of TAs stationed nearby to assist.
Nov 18, 2020 Human Factors: Privacy (Instructor: Bryan) | [Notes]
This lecture will cover general concepts and various mathematical definitions of privacy as well as how to achive them.
Reading:
- A Firm Foundation for Private Data Analysis
Optional Reading:
- Engineering Privacy
Nov 20, 2020 Human Factors: Law and Public Policy (Instructor: Bryan) | [Notes]
This lecture will cover legal frameworks and policies that govern security and privacy in practice.
Reading:
- Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications
Nov 22, 2020 Research: Recitation: State-of-the-Art Security Research (Instructor: Bryan)
Nov 25, 2020 Human Factors: Economics (Instructor: Bryan) | [Notes]
Many attackers are economically rational. Can we leverage this observation when designing our defenses? Many users are economically rational. What impact does that have on how we design our defenses?
Reading:
- So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users
Optional Reading:
- Why do Nigerian Scammers Say They are from Nigeria?
- Spamalytics: An Empirical Analysis of Spam Marketing Conversion
- The Economics of Spam
Nov 27, 2020 : No Class
Thanksgiving! Enjoy the break!
Nov 29, 2020 : No Recitation
Thanksgiving! Enjoy the break!
Dec 2, 2020 Review: Network, Web, and Human Factors (Instructor: Bryan)
We will have about a 30 minute review of all material in the third part of this class. The rest of the time will be devoted to questions and answers, so make sure you bring good questions.
Dec 4, 2020 Exam: Network, Web, and Human Factors (Instructor: Bryan)
This will be our third and final exam. Like previous exams it will be closed book, closed note, closed neighbor. The exam will focus on the last third of the course, but any material over the entire semester is game.