CS 315 Computer Security

Fall 2024 -- Fengwei Zhang

  • Instructor: Fengwei Zhang
  • Class Time: Monday 10:20PM - 12:10PM
  • Class Location: Room 301, Teaching Building I
  • Lab Time: Monday, 16:20PM - 06:10PM
  • Lab Location: Room 508, Teaching Building III

Course Description

This course aims help students to learn the principles of computer security and understand how various security attacks and countermeasures work. It provides hands-on experience in playing with security software and network systems in a live laboratory environment, with the purpose of understating real-world threats. The course will take both offensive and defense methods to help student explore security tools and attacks in practice. It will focus on attacks (e.g., buffer overflow, dirty COW, format-string, XSS, and return oriented programming), hacking fundamentals (e.g., scanning and reconnaissance), defenses (e.g., intrusion detection systems and firewalls). Students are expected to finish intensive lab assignments that use real-world malware, exploits, and defenses

Course Objectives

This course offers an in depth experience of real-world threats and defenses. Upon successful completion of this class, the student will gain experience in:

Prerequisites

Familiar with Unix/Linux systems; or permission of the instructor.

Recommended Book

Wenliang Du, Computer Security: A Hands-on Approach, 3rd Edition (ISBN: 978-17330039-5-7)

Grading Policy

The grades for the course will be based upon the tables given below

Academic Dishonesty

Please read and fill the Undergraduate Students Assignment Delcaration Form in Chinese and English. More details on Regulations.

Student Disabilities Services

If you have a documented disability that requires accommodations, you will need to register with the University for coordination of your academic accommodations, or let me know.

Class Schedule

Date Topic Reading & Notes (tentative) Slides & Labs
Week 01, 09/09 Course overview and Packet Sniffing
  • Computer network basics.
  • Kali Linux - Penetration Testing Linux Distribution. [Link]
  • Wireshark: Network protocol analyzer. [Link]
  • TCPDump and LibPCAP. [Link]
  • Packet Sniffing Basics. In Linux Journal. [Link]
[Slides and Lab]
Week 02, 09/14 Secure Coding and Buffer Overflows Lab 1 Due
  • Smashing the Stack for Fun and Profit. Aleph One. In Phrack Volume 7, Issue 49. [Link]
  • Local Stack Overflow (Basic Module). [Link]
  • Debugging Under Unix: gdb Tutorial. [Link]
  • Understanding DEP/NX [Link]
  • DynaGuard: Armoring Canary-based Protections against Brute-force Attacks. Theofilos Petsios, Vasileios P. Kemerlis, Michalis Polychronakis, and Angelos D. Keromytis. In ACSAC'15. [Link]
    中秋节:9月15日至9月17日放假,共3天。9月14日(周六)为工作日,上双周周一的课。
[Slides and Lab]
Week 03, 09/23 Secure Coding and Format-String Vulnerability Lab 2 Due
  • Chapter 6 of the recommended book -- Wenliang Du, Computer Security: A Hands-on Approach.
[Slides and Lab]
Week 04, 09/30 Term/Team Project Proposal Discussion Term/Team Project Proposal Due
Lab 3 Due
[Slides and Lab]
Week 05, 10/07 NO CLASS
  • National Holiday
  • Week 06, 10/14 Scanning, Reconnaissance, and Penetration Testing
    • Nmap: the Network Mapper - Free Security Scanner. [Link]   Nmap man page. [Link]
    • OpenVAS: Open Vulnerability Assessment System. [Link]   Setting up OpenVAS on Kali Linux. [Link]
    • NESSUS: Vulnerability Scanner. [Link]
    • ZMap: Fast Internet-Wide Scanning and its Security Applications. Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. In UsenixSecurity'13. [Link]   Souce Code. [Link]
    • Metasploit Framework Project Page. [Link]
    • Metasploitable2 (Linux). [Link]
    • Armitage: Cyber Attack Management for Metasploit. [Link]
    [Slides and Lab]
    Week 07, 10/21 Reverse Engineering and Obfuscation Lab 4 Due
    • DexLego: Reassembleable Bytecode Extraction for Aiding Static Analysis. Zhenyu Ning and Fengwei Zhang In DSN'18. [Link]
    • DexHunter: Toward Extracting Hidden Code from Packed Android Applications. Yueqian Zhang, Xiapu Luo , Haoyang Yin. In ESORICS'15. [Link]
    • Android Software Development Kit (SDK) [Link]
    • smali/baksmali: an assembler/disassembler for the Dex. [Link]
    [Slides and Lab]
    Week 08, 10/28 IoT Security and Wireless Exploitation Lab 5 Due
    • Zephyr: Real Time OS for IoT - A Linux Foundation Collaborative Project [Link]
    • Brillo: Google's Operating System for the Internet of Things. [Link]
    • Contiki: The Open Source OS for the Internet of Things. [Link]
    • IoT S&P slides from Prof. Steven M. Bellovin at Colubmia University. [Link]
    • How to Hack Wi-Fi: Cracking WPA2-PSK Passwords Using Aircrack-Ng. [Link]
    • Security of the WEP Algorithm. [Link]
    [Slides and Lab]
    Week 09, 11/04 Nailgun Attack Lab 6 Due
    • Nailgun Attack Paper [Link]
    • Communication of CCF [Link]
    • Nailgun project webistie [Link]
    • PoC source code [Link]
    • Demo Video 1 [Link]
    • Demo Vidoe 2 [Link]
    • CVE Number: 2018-18068 [Link]
    [Slides and Lab]
    Week 10, 11/11 Nailgun Defense Lab 7 Due
    • Nailgun Defense Paper [Link]
    [Slides and Lab]
    Week 11, 11/18 Dirty COW Attack Lab 8 Due
    • This lab has been tested on our pre-built SEEDUbuntu12.04 VM. [Link]
    • SEED Labs Prject by Dr. Wenliang (Kevin) Du at Syracuse University. [Link]
    • Chapter 8 of the recommended book -- Wenliang Du, Computer Security: A Hands-on Approach.
    [Slides and Lab]
    Week 12, 11/25 Web Security Lab 10 Due
    • Chapter 9, 10 of the recommended book -- Wenliang Du, Computer Security: A Hands-on Approach.
    [Slides and Lab]
    Week 13, 12/02 Return-to-libc and Return Oriented Programming Lab 11 Due
    • The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). Hovav Shacham. In CCS'07. [Link]
    • Chapter 5 of the recommended book -- Wenliang Du, Computer Security: A Hands-on Approach.
    [Slides and Lab]
    Week 14, 12/09 TBA Lab 11 Due
    [Slides and Lab]
    Week 15, 12/16 Security Research and Term Project Discussion Lab 12 Due
    [Research Slides]
    Week 16, 12/23 Term/Team Project Presentations Final Project Report Due

    Invited Lunch/Dinner if your final score is 96% or more
    [Slides and Lab]