Tentative Syllabus (some dates will change)

Unless explicitly marked as Optional, all readings are considered required.

Date	Topic
Sept 25	Introduction
Sept 30	Threat Modeling and Risk Read by today: Thompson, Reflections on Trusting Trust
Oct 2	Control Flow Vulnerabilities: Buffer Overflows Read by today: Aleph One, Smashing the Stack for Fun and Profit. Optional: Richard Bonichon's Basic exploitation techniques slides
Oct 7	Control Flow Vulnerabilities: Format strings, Integers and Heap Read by today: van der Veen et al, Memory Errors: The Past, the Present, and the Future Optional: sploitfun, Understanding glibc malloc. Also, Cong Wang's explanation for how the unlink macro works and can be abused in (we are working with old glibc per his terminology)
Oct 9	Catch up
Oct 14	Control Flow Vulnerabilities: Defenses and evolution Read by today: Erlingsson et al, Low-level Software Security by Example Optional: Szekeres et al, Eternal War in Memory
Oct 16	Control Flow Vulnerabilities: ROP and CFI Optional: Shacham, The Geometry of Innocent Flesh on the Bone and Abadi et al, Control Flow Integrity.
Oct 21	System security I: Isolation and Privilege Jaeger, Security in Ordinary Operating Systems
Oct 23	System security II: Side channels (also slides excerpted from Schwarz and Lipp) Anderson, Security Engineering, Chap 19, Side Channels
Oct 28	Web Security I (guest lecture Deepak Kumar) Deian Stefan's lecture notes on CSRF, XSS and SQLi, SQL injection
Oct 30	Midterm. Some sample questions here.
Nov 4	Web Security II
Nov 6	Network Security I
Nov 11	Veterans Day holiday
Nov 13	Class cancelled
Nov 18	Network Security II
Nov 20	Crypto I Security Engineering, Chapter 5
Nov 25	Crypto II: Key distribution
Nov 27	No Class. Thanksgiving holiday
Dec 2	User Authentication
Dec 4	Malware and Botnets
Dec 11	Final Exam (Thursday, Dec 11th, 3pm-4:59pm, WLH 2005 (same room)). Some sample questions here.