Course Description

This course introduces the principles and practical considerations of computer and network security. It covers the following:

• Basic concepts: threat models, security principles, x86-64 assembly, gdb
• Application Attacks: buffer and integer overflow, format string vulnerabilities, return-oriented/jump-oriented/call-oriented programming
• Application Defenses: stack canaries, DEP, ASLR, RELRO, shadow stack, IBT,  PAC
• Penetration testing with AI: how to use AI Agents to speed up identifying and fixing vulnerabilities
• Reverse Engineering: program obfuscation principles, Ghidra, IDA
• Program analysis: static analysis, information flow, taint tracking, fuzzing
• Privilege separation: sandboxing, filesystem permissions, SUID binaries, capabilities, namespaces
• Applied cryptography: symmetric and asymmetric encryption, digital signatures, hash functions
• Basics of networks and the Web: TCP/IP, routing, DNS, HTTP, cookies
• Network and Web attacks: BGP Hijacking, DNS forgery, SQL injection, CSRF, XSS
• Network security: firewalls, packet filtering, certificates, TLS
• Broader issues: surveillance, censorship, anonymity, legal issues, ethics

Prerequisites

• CIS 1600: Mathematical Foundations of Computer Science
• CIS 2400: Introduction to Computer Systems

Textbook

There is no required textbook for this course. The following books (available for free) are good extra sources:

• Operating Systems: Three Easy Pieces by Remzi and Andrea Arpaci-Dusseau
• Security Engineering by Ross Anderson
• A Graduate Course in Applied Cryptography by Dan Boneh and Victor Shoup
• Handbook of Applied Cryptography by Menezes, van Oorschot, and Vanstone

Projects

There will be 5 projects to be completed individually.

• Project 1: Pwnnsylvania platform, x86_64 assembly, pwntools
• Project 2: Advanced debugging with gdb, buffer overflows, integer overflows, format string exploits
• Project 3: Fuzzing, sandboxing, reverse engineering with Ghidra/IDA
• Project 4: Hash collisions and length extension attacks, block ciphers modes and AES, RSA encryption and signatures, Diffie-Hellman key exchange
• Project 5: SQL injection, Cookie hijacking, CSRF, XSS

Each project will have a live in-person audit. Students will be expected to solve one of the challenges in the project live in front of a TA or Instructor and demonstrate understanding of the concepts.

Late submissions: You can submit a project late by 2 days at the cost of a 10% late penalty. Projects submitted more than 2 days late will not receive any credit.

If you have an extenuating circumstance, you must contact the course staff before the assignment is due.

Exams and Quizzes

There are two non-cumulative exams.

There will be 1 short ungraded quizz each week to be completed online through Canvas. These are optional but highly encouraged. The purpose of these quizzes is to keep you on track throughout the semester and make sure that you are understanding the material.

AI Policy

You are expected to complete the work on your own. You may use AI to better understand the material and study for exams.

We will provide you with access to models and AI Agents that you may use for specific parts of the projects that we have designed explicitly to be solved with AI. For parts of the projects that are not designated as AI Challenges, you are expected to complete them on your own without the help of AI.

WARNING: Do not attempt to use commercial models like GPT, Gemini, Claude, etc. to solve the projects in this class. Since we deal with cybersecurity concepts and program exploitation, our projects will trigger safeguards in these commercial models that will lead to your account being suspended. From past experience, it is very hard (near impossible) to get your account unsuspended.

Grading

• Projects: 50%
• Exam 1: 25%
• Exam 2: 25%

Academic Honesty

We encourage you to discuss the problems and your general approach with other students in the class. However, the answers you turn in must be your own original work, and you must adhere to Penn’s Code of Academic Integrity.

For more information, see the Office of Student Conduct.

Students with disabilities

The University of Pennsylvania provides reasonable accommodations to students with disabilities who have self-identified and received approval from the Office of Student Disabilities Services (SDS). If SDS has approved your request for accommodations, please discuss with me the necessary arrangements for your accommodations. SDS services are free and confidential.