CIS 331, Spring 2014
Introduction to Networks & Security


Instructor:
  Nadia Heninger (464 Levine GRW)
  Office Hours Tuesdays 1:30-2:30 464 Levine GRW

TAs:
Yang (Jack) Wu
  Office Hours Mondays 1-2pm Levine 6th floor lounge
Gang Xiang
  Office Hours Fridays 2-3pm Levine 6th floor lounge
Sikai Zhang
  Office Hours Wednesday 1:30-2:30pm Levine 6th floor lounge

Lectures:
  Tuesday/Thursday 10:30am-12pm DRLB A5

Canvas

Piazza


Announcements

4/15/14 - There will only be four projects, so we have one homework left in the semester.

If you are unable to register for this course, you can email Jackie Caliman and ask to be put on a waiting list.


Course Overview

This course introduces principles and practices of computer and network security.

Grading will be based on homework (25%), projects (40%), a final (30%), and class participation (5%).

Schedule

Topic Assignments Resources
1/16 Introduction
Threat modeling, thinking like an attacker
1/21 Symmetric encryption
Pseudorandom functions, pseudorandom generators, stream ciphers, block ciphers
Homework 1 available
1/23 Message integrity
Message authentication codes, hash functions, birthday attacks, length extension attacks
Project 1 available
1/28 Public-key cryptography
Diffie-Hellman key exchange, RSA encryption
New Directions in Cryptography by Whitfield Diffie and Martin E. Hellman
1/30 Digital signatures and authentication
More RSA, RSA digital signatures, RSA gotchas, key management
Homework 1 due at 6pm
2/4 HTTPS
RSA and DH key exchange, certificates, CAs, public-key infrastructure, trust model
2/6 Passwords and authentication
Authentication factors, usability, password hygiene, challenge-response authentication, biometrics
Project 1 due at 6pm
Homework 2 is available.
2/11 Web overview
Web threat model, HTTP, HTML, Javascript, same-origin policy, SQL injection
2/13 Snow day Project 2 is available.
2/18 Web attacks
Session management, cookies, XSS, CSRF
2/20 Networking overview
OSI architecture, Ethernet, IP, ICMP, ARP, DHCP, routing basics
Homework 2 due at 6pm
2/25 Networking overview
UDP, TCP, congestion control, DNS
2/27 Network attacks
TCP injection, denial of service, SYN flooding, SYN cookies, CAPTCHA, client puzzles
Homework 3 available
3/4 Guest Lecture: Perry Metzger
Buffer overflows and worms
Project 2 due at 6pm
3/6 Guest Lecture: Perry Metzger
P25 radios
3/11 Spring Break
3/13 Spring Break
3/18 Network attacks
DNS hijacking, ARP spoofing, BGP routing issues, DNSSEC, IPsec, S-BGP
Project 3 available
3/20 Network defenses
Firewalls, packet filtering, application proxies, tunneling, VPNs, intrusion detection
Homework 3 due at 6pm
3/25 Control hijacking
Normal control flow, buffer overflow, integer overflows, format string vulnerabilities, DEP, ASLR
Project 4 available Smashing the stack for fun and profit by Aleph One
Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade by Crispin Cowan, Perry Wagle, Calton Pu, Steve Beattie, and Jonathan Walpole
Low-level Software Security by Example by Ulfar Erlingsson, Yves Younan, and Frank Piessen
3/27 Control hijacking, defenses, and malware
Stack canaries, heap spraying, malware
Project 3 due Friday 3/28 at 6pm
4/1 Access control and OS security
ACLs, capabilities, unix file privileges, confinement
Operating System Security by Trent Jaeger
4/3 OS security, DRM
Isolation, sandboxing, virtual machines, digital rights management
Lessons from the Sony CD DRM Episode by J. Alex Halderman and Edward W. Felten
4/8 The underground economy
Spam, phishing, botnets, measurement studies
Measuring the cost of cybercrime by Ross Anderson et al.
Spamalytics: An empirical analysis of spam marketing conversion by Chris Kanich et al.
PharmaLeaks: Understanding the business of online pharmaceutical affiliate programs by Damon McCoy et al.
4/10 Advanced threats
Government-sponsored malware, spearphishing, advanced persistent threats
Project 4 due at 6pm W32.Stuxnet Dossier Symantec Report
APT1: Exposing one of China's cyber espionage units Mandiant Technical Report
Counter-cryptanalysis by Marc Stevens
4/15 Anonymity
Anonymous remailers, Tor, Tor hidden services, data deanonymization
Tor: The Second-Generation Onion Router by Roger Dingledine, Nick Mathewson, and Paul Syverson
Robust De-anonymization of Large Sparse Datasets by Arvind Narayanan and Vitaly Shmatikov
4/17 Privacy
PGP, the crypto wars, key management, web of trust, usability, OTR
Homework 4 available Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 by Alma Whitten and Doug Tygar
Bernstein v. United States
Off-the-Record Communication, or, Why Not To Use PGP by Nikita Borisov, Ian Goldberg, and Eric Brewer
4/22 Emissions security and side channels
TEMPEST/van Eck phreaking, timing attacks, power analysis, fault attacks, remanence, cold boot attack
Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk? by Wim van Eck
Electromagnetic Eavesdropping Risks of Flat-Panel Displays by Markus Kuhn
Compromising Electromagnetic Emanations of Wired Keyboards by Martin Vuagnoux and Sylvain Pasini
Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems by Paul Kocher
Timing Analysis of Keystrokes and Timing Attacks on SSH by Dawn Song, David Wagner, and Xuqing Tian
Cache-timing attacks on AES by Daniel Bernstein
Cross-VM Side Channels and Their Use to Extract Private Keys by Yinqian Zhang, Ari Juels, Michael Reiter, and Thomas Ristenpart
Differential Power Analysis by Paul Kocher, Joshua Jaffe, and Benjamin Jun
Using Memory Errors to Attack a Virtual Machine by Sudhakar Govindavajhala and Andrew Appel
Lest We Remember: Cold Boot Attacks on Encryption Keys by J. Alex Halderman, Seth Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph Calandrino, Ariel Feldman, Jacob Appelbaum, and Edward Felten
4/24 Entropy
Shannon entropy, min-entropy, cryptographic and non-cryptographic pseudorandomness, software RNGs, Netscape, Debian OpenSSL, Linux
Randomness and the Netscape Browser by Ian Goldberg and David Wagner
Mining your Ps and Qs: Detection of Widespread Weak Keys in Network Devices by Nadia Heninger, Zakir Durumeric, Eric Wustrow, and J. Alex Halderman
4/29 Special Requests
Ethics of disclosure, privacy principles, quantum security, Bitcoin
Homework 4 due at 6pm Privacy and the Limits of Law by Ruth Gavison
Bitcoin: A Peer-to-Peer Electronic Cash System by Satoshi Nakamoto
5/13 Final exam
12pm-2pm LRSM Auditorium

Assignments

There will be four homework assignments to be done individually and four projects to be done in teams of two.

Homework

Projects

Late Work: You will have a budget of five late days (24-hour periods) over the course of the semester that you can use to turn assignments in late without penalty and without needing to ask for an extension. Late pair projects will be charged to both partners. Once your late days are used up, extensions will only be granted in extraordinary circumstances.


Additional Resources

No textbook is required, but if you would like additional resources the following may be useful:

Course materials have been adapted from J. Alex Halderman and are available under a Creative Commons License.