CSE 227: Computer Security

Course Syllabus

Apr 4 Class Introduction:
Apr 6 Low-level control-flow Vulnerabilities:
Low-Level Software Security by Example,” (just this chapter) Handbook of Information and Communication Security 2010.
Apr 11 Low-level Software Defenses:
Control-Flow Integrity: Principles, Implementations, and Applications,” ACM CCS 2005 and “NOZZLE: A Defense Against Heap-spraying Code Injection Attacks,” USENIX Sec. 2009.

Related papers [not assigned]:
Counterfeit Object-oriented Programming IEEE Security and Privacy '15 and ROP is Still Dangerous: Breaking Modern Defenses, USENIX Sec '14.

Apr 13 Software vulnerabilities in aggregate
Milk or Wine: Does Software Security Improve with Age?USENIX Sec. 2006. and Before We Knew It: An Empirical Study of Zero-Day Attacks in the Real World, ACM CCS 2012.

Related papers [not assigned]:
An Empirical Study of Vulnerability Rewards Programs, USENIX Sec '13, Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits, RAND report and Is finding security holes a good idea?IEEE S&P 2005.

Apr 18 Usability and human factors in security
A Framework for Reasoning about the Human in the Loop, UPSec '08, and Allice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness, USENIX Security '13.

Related papers [not assigned]:
Users are not the Enemy, CACM v42no12, and So Long, and No Thanks for the Externalities: The Rational Rejection of Security Advice by Users, NPSW '09, and The Psychology of Security, CACM v51no4.

Apr 20 Usability II
Network-in-a-Box: How to Set Up A Secure Wireless Network in Under a Minute, USENIX Security '04, and Why Johnny Can't Encrypt: a Usability Evaluation of PGP 5.0, USENIX Sec '99

Related papers [not assigned]:
The Emperor's New Securituy INdicators: An evaluation of website authentication and the effect of role playing on usability studies, IEEE Security and Privacy '07

Apr 25 Side Channels I: Keyboard Acoustic Emanations Revisited, CCS 2005 and Lest we Remember: Cold Boot Attacks on Encryption Keys, USENIX Security 2008.
Apr 27 Other Channels II: Exploioting the DRAM rowhammer bug to gain kernel privileges, ?Google Project Zero Blog post and Neuroscience Meets Cryptography: Designing Crypto Primitives Secure against Rubber Hose Attacks, USENIX Security '12.
May 2 (guest lecture: Geoff Voelker)

Ecosystem I: Click Trajectories: End-to-End Analysis of the Spam Value Chain IEEE S&P 2011 and Re: CAPTCHAs -- Understanding CAPTCHA-Solving from an Economic Context USENIX Sec. 2010.

May 4 Ecosystem II: Examining the Impact of Website Take-down on Phishing, APWG eCrime Summit, 2007. and The Underground Economy of Fake Antivirus Software, WEIS 2011.

Related papers [not assigned]:
Pricless: the Role of Payments in Adbuse-advertised Goods, CCS 2012 and Empirically Characterizing Domain Abuse and the Revenue Impact of Blacklisting, WEIS 2014.

May 9 SSL/TLS I: The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software, CCS 2012 and Analysis of the HTTPS Certificate Ecosystem, IMC 2013.
May 11 SSL/TLS II: The Security Impact of HTTPS Interception, NDSS 2017 and DROWN: Breaking TLS using SSLv2, USENIX Security '16.
May 16 Cyber-Physical Security: Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses, IEEE Securoty and Privacy '08 and Comrehensive Experimental Analyses of Automative Attack Surfaces, USENIX Security '11.
May 18 Web Security I: XSS-Guard: Precise Dynamic Prevention of Cross-Site Scripting Attacks, DIMVA '08 and Robust defenses for cross-site request forgery, CCS '08

Background (not required) reading on XSS and CSRF

May 23 Cancelled
May 25 Also cancelled due to flight delay
May 30 Web Privacy I: I Still Know What you Visited Last Summer: Leaking browsing history via user interaction and side channel attacks and XRay: Enhancing the Web's Transparency with Differential Correlation
June 1 Web Privacy II: An Analysis of Private Browsing Modes in Modern Browsers, USENIX Sec '10 and Internet Jones and the Raiders of the Lost Trackers: An Archaelogical Study of Web Tracking from 1996 to 2016, USENIX Sec '16
June 6 Science of Security: Science, Security and the Elusive Goal of Security as a Scientific Pursuit, IEEE Security and Privacy '17
June 8 Alternative viewpoints of security's failures: This World of Ours, Mickens, USENIX login 2014 and Looking Back:AddendumDavid Bell, 2006
June 13 Research papers (no more than 6 pages, two column format) delivered via e-mail. Send to me by midnight
June 15 Final presentations, 7-10pm CENTR 214

Send me slides by 3pm same day (ppt, odp, or pdf accepted) so we can use one laptop.

Presentation order here.