| Mon, Apr. 2 |
Introduction
|
| Wed, Apr. 4 |
Memory Safety, Exploitation, and Mitigations
Reading:
- How memory safety violations enable exploitation of programs,
by Mathias Payer,
chapter 1 of Larsen and Sadeghi, 2018.
- Diversity and information leaks,
by Stephen Crane, Andrei Homescu, Per Larsen, Hamed Okhravi, and Michael Franz,
chapter 3 of Larsen and Sadeghi, 2018.
|
| Mon, Apr. 9 |
Memory Safety, Exploitation, and Mitigations (II)
Reading:
- Return-oriented programming:
Systems, languages, and applications,
by Ryan Roemer, Erik Buchanan, Hovav Shacham, and Stefan Savage,
ACM TISSEC 15(1), 2012.
- Counterfeit
Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks
in C++ Applications,
by Felix Schuster, Thomas Tendyck, Christopher Liebchen, Lucas Davi, Ahmad-Reza Sadeghi, and Thorsten Holz,
in proc. Oakland 2015.
|
| Wed, Apr. 11 |
Control-Flow Integrity
Reading:
- Control-Flow Integrity: Precision, Security, and
Performance,
by Nathan Burow, Scott A. Carr, Joseph Nash, Per Larsen, Michael Franz,
Stefan Brunthaler, and Mathias Payer,
ACM Computing Surveys 50(1), 2017.
|
| Mon, Apr. 16 |
Control-Flow Integrity (II)
Reading:
- Control-Flow Bending:
On the Effectiveness of Control-Flow Integrity,
by Nicolas Carlini, Antonio Barresi, Mathias Payer, David Wagner, and
Thomas R. Gross,
in proc. Usenix Security 2015.
- Control Jujutsu:
On the Weaknesses of Fine-Grained Control Flow Integrity,
by Isaac Evans, Fan Long, Ulziibayar Otgonbaatar, Howard Shrobe,
Martin Rinard, Hamed Okhravi, and Stelios Sidiroglou-Douskos,
in proc. CCS 2015.
|
| Wed, Apr. 18 |
ASLR and XOM
Reading:
- Breaking
CFI: Exploiting CVE-2015-5122 using COOP,
by Oshri Sela and Shlomi Levin,
2018.
- Just-in-Time
Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization,
by Kevin Z. Snow, Fabian Monrose, Lucas Davi, Alexandra Dmitrienko,
Christopher Liebchen, and Ahmad-Reza Sadeghi,
in proc. Oakland 2013.
- Hacking Blind,
by Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières,
and Dan Boneh,
in proc. Oakland 2014.
|
| Mon, Apr. 23 |
ASLR and XOM (II)
Reading:
- Address-Oblivious
Code Reuse: On the Effectiveness of Leakage-Resilient Diversity,
by Robert Rudd, Richard Skowyra, David Bigelow, Veer Dedhia, Thomas Hobson,
Stephen Crane, hristopher Liebchen, Per Larsen, Lucas Davi, Michael Franz,
Ahmad-Reza Sadeghi, and Hamed Okhravi,
in proc. NDSS 2017.
- The Dynamics
of Innocent Flesh on the Bone: Code Reuse Ten Years Later,
by Victor van der Veen, Dennis Andriesse, Manolis Stamatogiannakis, Xi Chen,
Herbert Bos, and Cristiano Giuffrida,
in proc. CCS 2017.
|
| Wed, Apr. 25 |
No class
|
| Mon, Apr. 30 |
Software Fault Isolation
Reading:
|
| Wed, May 2 |
Software Fault Isolation (II)
Reading:
- Dune: Safe User-level Access to Privileged CPU Features,
by Adam Belay, Andrea Bittau, Ali Mashtizadeh, David Terei, David Mazières,
and Christos Kozyrakis,
in proc. OSDI 2012.
- Sandboxing
libraries in Chrome using SFI: zlib proof-of-concept,
by Mark Seaborn,
2013.
- Bringing
the Web up to Speed with WebAssembly,
by Andreas Haas, Andreas Rossberg, Derek L. Schuff, Ben L. Titzer,
Michael Holman, Dan Gohman, Luke Wagner, Alon Zakai, and JF Bastien,
in proc. PLDI 2017
|
| Mon, May 7 |
Side Channels
Reading:
|
| Wed, May 9 |
Side Channels: ASLR
Reading:
- Jump
Over ASLR: Attacking Branch Predictors to Bypass ASLR,
by Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh,
in proc. MICRO 2016
- Prefetch
Side-Channel Attacks: Bypassing SMAP and Kernel ASLR,
by Daniel Gruss, Clémentine Maurice, Anders Fogh,
Moritz Lipp, and Stefan Mangard,
in proc. CCS 2016
- ASLR
on the Line: Practical Cache Attacks on the MMU,
by Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and
Cristiano Giuffrida,
in proc. NDSS 2017
|
| Mon, May 14 |
Timing Channels
Reading:
|
| Wed, May 16 |
Timing Channels in Browsers
Reading:
|
| Mon, May 21 |
Speculative Execution
Reading:
|
| Wed, May 23 |
Speculative Execution: Software
Reading:
- What
Spectre and Meltdown Mean for WebKit,
by Filip Pizlo,
Blog post, Jan. 2018
- Retpoline:
A Software Construct for Preventing Branch-target-Injection,
by Paul Turner,
Knowledge base post, Jan. 2018
- Spectre
Mitigations in MSVC,
by Andrew Pardoe,
Blog post, Jan. 2018
Speculative
Execution Side Channel Mitigations,
Intel whitepaper, Jan. 2018
|
| Mon, May 28 |
No class—Memorial Day
|
| Wed, May 30 |
Speculative Execution: Hardware
Reading:
- Securing
Processors from Time Side Channels,
by Jose Renau,
presented at AMW 2018
- DAWG: A Defense
Against Cache Timing Attacks in Speculative Execution Processors,
by Vladimir Kiriansky, Ilia Lebedev, Saman Amarasinghe,
Srinivas Devadas, and Joel Emer,
Manuscript, May 2018
- Precision
Timed Machines,
by Isaac Liu,
Ph.D. thesis, 2012
(focus on chapter 2 and section 4.2)
|
| Mon, Jun. 4 |
Rowhammer
Reading:
- Using
Memory Errors to Attack a Virtual Machine,
by Sudhakar Govindavajhala and Andrew W. Appel,
in proc. Oakland 2003
- Flipping
Bits in Memory Without Accessing Them:
An Experimental Study of DRAM Disturbance Errors,
by Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee,
Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu,
in proc. ISCA 2014
- Exploiting
the DRAM Rowhammer Bug to Gain Kernel Privileges,
by Mark Seaborn and Thomas Dullien,
Presented at Black Hat 2015
|
| Wed, Jun. 6 |
Recent Developments
Reading:
|