Computer Security: Attacks and Defenses
(CMSC 311 at Haverford College)
Note that–especially since this is the first offering of 311–parts of this syllabus are subject to change with adequate notice.
- Experience in C programming:
- E.g., CMSC245 at Haverford or CMSC246 at Bryn Mawr
- 3 lecture hours per week
- 1 lab hour per week
- This will be a lab / project intensive class. Approximately 6-10 hours per week outside of class will be expected from students. I recommend against taking this course concurrent with other project-heavy courses.
Cap: 25 (may be lifted to 35)
This course will serve as a broad introduction to the field of computer security, from two concurrent perspectives: attacks on systems, and defenses against those attacks. The goal of this course will be to help build intuition so that–when designing your own systems–you can intelligently assess and mitigate security risks.
To understand how attackers think, we will learn about the attacks they employ. We will dissect a number of real-world attacks (such as Heartbleed or WannaCry) and reflect upon what could have been done to prevent them. But understanding a collection of attacks is not alone sufficient for helping us understand how to build secure systems. So alongside attacks, we will also learn the theoretical underpinnings of security, and use it to build defenses into our systems.
Labs will transition theory into practice. We will conclude with a group project exploring advanced topics relevant to the state of the art in computer security. The course will begin with a discussion on ethical application of techniques we learn.
We will cover parts of the following topics, adjusted for time and pace of the course, along with student interest in each area.
- Low-level memory attacks and defenses
- Buffer overflows
- Stack canaries
- Access space randomization / derandomization
- Return to libc / return-oriented-programming
- Symmetric and asymmetric-key cryptography
- Certificates, CAs, and PKI
- Web security
- SQL injections
- Cross-site scripting
- Cross-site request forgery
- Social engineering and security ethics
- UI design for security
- App permissions design
- Best practices for security UI
- Permission lifetime and revocation
- Case study in privacy controls:
- Facebook privacy controls
- Android permissions
- Information flow control in web apps
- Reverse engineering
- Theoretical underpinnings of security
- Full abstraction
- Information flow
Projects and Labs
Projects will be started in labs, and then continued individually. Some labs are structured so that they begin with a concrete assignment to work on as an individual in the first week, and then move on to a group assignment to complete a larger task.
Project 1: Memory attacks (Weeks 1-5 inclusive) (Uses C programming)
This project will cover low-level memory attacks using the C programming language. The students will begin by executing an attack from starter code provided. They will then implement their own buffer overflow attack, and demonstrate a way to prevent the attack by intelligent programming, and also facilities provided by the compiler. After completing this task, students will form groups to complete a more advanced attack studying ASLR or ROP. 1.5 weeks will be allocated for independent programming, and 1.5 weeks will be allocated for group work.
Project 2: Cryptography (weeks 6-8 incl.) (Uses Python programming)
This project will involve creating a public / private key pair and manually exchanging keys to collaborate secretly communicate with group members. The next week, students will either implement a secure chat using cryptographic primitives provided, or explore an attack on an insecure cryptographic hash.
Project 3: Web security (weeks 9-12 incl.) (Uses Python programming)
Students will be given an insecure web app written in Python and JS. This app will be vulnerable certain attacks (e.g., SQL injection, XSRF). They will then craft an input which causes the app to leak secret information (e.g.,, student grades from a synthetic gradebook consisting of fictitious students). They will then fix this attack in the app. Finally, students will attempt to break other students’ fixes.
Final project (weeks 13-14): Build it, Break it, Fix it
This will be a final project where groups break each other’s projects. Points will be allocated for both individual work and group work. Individuals must work to find bugs in other projects, and groups must work to fix to find bugs in their projects.
- Labs and projects: 70%
- Individual component: 42%
- Group component: 28%
- Two midterm exams: 30% (take home and open note)
- Given 1/3rd and 2/3rd of the way through the course
Evaluation for group projects will be based on mutual student feedback and may include oral exam with individual group members.
I don’t want you to spend any money on textbooks for this course.
Online resources will be distributed throughout the course. These include blog articles (e.g., by the Facebook privacy group), academic papers, and websites (e.g., the Android security internals). These will all be freely available.
- Security Engineering, Second Editing, by Ross Anderson
- This book is freely available online from the author
- The Web Application Hacker’s Handbook, by Dafydd Stuttard & Marcus Pinto
- Applied Cryptography, Second Edition, by Bruce Schneier