CIS 331, Fall 2017
Introduction to Networks & Security


Instructor:
  Nadia Heninger (604 Levine)
  Office Hours Tuesdays 1:00-2:00pm 604 Levine

TAs: Office Hours Location
Shaanan Cohney Mondays 11-1pm Levine 6th floor bump space
Alexander Haynes Wednesdays 1:30-3pm Levine 6th floor bump space
Nour Hussein Tuesdays 6:30-8pm Levine 6th floor bump space
Lauren Leung Mondays 12:30-2pm Levine 6th floor bump space
Graham Mosley Thursdays 4:30-6pm Levine 5th floor bump space

Lectures:
  Tuesday/Thursday 10:30am-12:00pm Fisher-Bennett 401

Piazza

Canvas


Course Overview

This course introduces principles and practices of computer and network security.

Prerequisites: CIS 160, CIS 240. We will be enforcing these prerequisites.

Grading will be based on homework (20%), projects (30%), two midterm exams (20% first), (25% second), and class participation (5%).

Syllabus and course policies


Lecture and Tutorial Schedule

Topic Assignments Resources
8/29 Introduction
Threat modeling, thinking like an attacker
Homework 1 available The Security Mindset by Bruce Schneier
The Security Mindset and "Harmless Failures" by Ed Felten
How to think like a security professional by Yoshi Kohno
Computer Fraud and Abuse Act
This World of Ours by James Mickens
Wikipedia: Aaron Swartz
8/31 Control hijacking
Normal control flow, buffer overflow, stack smashing, integer overflows, format string vulnerabilities, heap-based attacks
Smashing the stack for fun and profit by Aleph One
Memory Safety Attacks and Defenses Lecture notes by David Wagner
Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade by Crispin Cowan, Perry Wagle, Calton Pu, Steve Beattie, and Jonathan Walpole
Low-level Software Security by Example by Ulfar Erlingsson, Yves Younan, and Frank Piessen
9/5 Control hijacking defenses
Stack canaries, control flow integrity, NX bit, ASLR, testing, defensive programming
Project 1 available Smashing the Stack in 2011 by Paul Makowski
9/7 Return-oriented programming
Guest Lecture: Hovav Shacham
Homework 1 due Return-Oriented Programming: Systems, Languages, and Applications by Ryan Roemer, Erik Buchanan, Hovav Shacham, and Stefan Savage
9/12 Malware
9/14 Access control and OS security
ACLs, capabilities, unix file privileges, confinement, isolation, sandboxing, virtual machines
Operating System Security by Trent Jaeger
Android System and kernel security
iOS Security Guide
9/19 Networking overview
OSI architecture, Ethernet, IP, ICMP, ARP, DHCP
Guest Lecture: Nathan Dautenhahn
The Design Philosophy of the DARPA Internet Protocols by Clark
Brief History of the Internet
Wikipedia: OSI Model
Wikipedia: Ethernet
Wikipedia: Internet Protocol
Wikipedia: Address Resolution Protocol
Wikipedia: Dynamic Host Configuration Protocol
Computer Networks: A Systems Approach by Peterson and Davie
9/21 Networking overview
Routing basics, UDP, TCP, congestion control, DNS
Guest Lecture: Nathan Dautenhahn
Project 1 due Wikipedia: Autonomous System
Wikipedia: OSPF routing
Wikipedia: Border Gateway Protocol
Wikipedia: User Datagram Protocol
Wikipedia: Transmission Control Protocol
Wikipedia: Domain Name System
9/26 Network attacks and defenses
Eavesdropping, jamming, TCP injection, denial of service, SYN flooding
Mark Klein Declaration in Heptig v. ATT/NSA
APCO P25 digital two-way radio system by Blaze, Clark, Goodspeed, Metzger, Wasserman, Xu
Security problems in the TCP/IP protocol suite by Bellovin
9/28 Network attacks and defenses
DDOS, CAPTCHA, client puzzles, DNS hijacking, ARP spoofing, BGP routing issues
Homework 2 available China's Great Cannon by Marczak, Weaver, Dalek, Ensafi, Fifield, McKuen, Rey, Scott-Railton, Deibert, Paxson
10/3 Network defenses and firewalls
Firewalls, packet filtering, application proxies, tunneling
Project 2 available
10/5 Fall break
10/10 Network defenses and web overview
NAT, VPNs, intrusion detection, web threat model, HTTP, HTML, Javascript
Homework 2 due Web technology for developers
Browser Security Handbook: Basic concepts behind web browsers
10/12 Web intro and attacks
Same-origin policy, session management, cookies, SQL injection
SQL Injection cheat sheet
10/17 Web attacks, passwords and authentication CSRF, XSS and defenses, authentication and identification Project 2 Due Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet
XSS Filter Evasion Cheat Sheet
10/19 Passwords, password hashing, hash functions
Password attacks, usability, password hygiene, hash functions, birthday attacks
Project 3 available
10/24 Midterm Exam
10/26 Social engineering
Guest Lecture: Shaanan Cohney
10/31 Symmetric encryption
Pseudorandom functions, pseudorandom generators, stream ciphers, block ciphers
Communication Theory of Secrecy Systems by Shannon
Wikipedia: Vigenère cipher
11/2 Symmetric encryption and message integrity
Block cipher modes of operation, message authentication codes
Homework 3 available
11/7 Message authentication codes
Midterm 1 review, length extension attacks, modular arithmetic review
Project 3 due Wikipedia: Modular Arithmetic
Modular arithmetic lecture notes from Berkeley CS 70
Basic number theory lecture notes from Boaz Barak
11/9 Public-key cryptography
Diffie-Hellman key exchange, RSA encryption
Project 4 available New Directions in Cryptography by Whitfield Diffie and Martin E. Hellman
11/14 Digital Signatures
RSA signatures, PKCS padding, Bleichenbacher signature forgery attack

Homework 3 due
11/16 HTTPS and cryptographic network defenses
HTTPS, RSA and DH key exchange, certificates, CAs, public-key infrastructure, trust model, SSH, IPsec, VPNs, S-BGP
The First Few Milliseconds of an HTTPS Connection
11/21 Privacy and anonymity
PGP, the crypto wars, key management, web of trust, Signal, Tor
Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 by Alma Whitten and Doug Tygar
Bernstein v. United States
Off-the-Record Communication, or, Why Not To Use PGP by Nikita Borisov, Ian Goldberg, and Eric Brewer
Forward Secrecy for Asynchronous Messages by Moxie Marlinspike Tor: The Second-Generation Onion Router by Roger Dingledine, Nick Mathewson, and Paul Syverson
11/23 Thanksgiving
11/28 The underground economy
Spam, phishing, botnets, measurement studies
Project 4 due Measuring the cost of cybercrime by Ross Anderson et al.
Spamalytics: An empirical analysis of spam marketing conversion by Chris Kanich et al.
PharmaLeaks: Understanding the business of online pharmaceutical affiliate programs by Damon McCoy et al. Bitcoin: A Peer-to-Peer Electronic Cash System by Satoshi Nakamoto
11/30 Advanced threats
Government-sponsored malware, spearphishing, advanced persistent threats
W32.Stuxnet Dossier Symantec Report
APT1: Exposing one of China's cyber espionage units Mandiant Technical Report
Counter-cryptanalysis by Marc Stevens
12/5 Ethics, law, and policy
Privacy and the Limits of Law by Ruth Gavison
Cyber-security Research Ethics Dialog & Strategy Workshop (CREDS 2013)
Going Bright: Wiretapping without Weakening Communications Infrastructure by Steve Bellovin, Matt Blaze, Sandy Clark, and Susan Landau
12/7 Second midterm

Assignments

There will be five homework assignments to be done individually and four projects to be done in teams of two.

Homework

Homework 1

Homework 2

Homework 3

Projects

Project 1

Project 2

Project 3

Project 4

Late Work: You will have a budget of five late days (24-hour periods) over the course of the semester that you can use to turn assignments in late without penalty and without needing to ask for an extension. You may use a maximum of two late days per assignment. Late pair projects will be charged to both partners. Once your late days are used up, extensions will only be granted in extraordinary circumstances.


Additional Resources

No textbook is required, but if you would like additional resources the following may be useful:

Course materials have been adapted from Michael Bailey and J. Alex Halderman and are available under a Creative Commons License.