CSE 127, Winter 2021
Intro to Computer Security

Instructor:
  Nadia Heninger (nadiah at cs dot ucsd dot edu)
  Office hours: Tuesday 3:30pm until there are no more questions on Zoom

TAs:
  Patrick Liu Office Hours: Wednesday 3pm
  Keegan Ryan Office Hours: Friday 1pm
  George Sullivan Office Hours: Thursday 11am
  Kevin Yu Office Hours: Monday 6pm

Lectures:
  Tuesday/Thursday 2:00pm-3:20pm, via Zoom (meeting information posted on Canvas; lectures will be recorded and posted to Canvas afterward)

Discussion:
  Wednesday 2:00pm-2:50pm, via Zoom

Class Resources:
  Lecture information and gradebook on Canvas
  Q&A on Piazza
  Assignment submission on Gradescope

Grading:
  60%: Homework assignments
  25%: Exam
  10%: Scribe notes
  5%: Participation

Course Overview

This course focuses on computer security, covering a wide range of topics on both the defensive and offensive side of this field. Among these will be systems security and exploitation (e.g., buffer overflows and return-oriented programming), sandboxing and isolation, side channels, network security, cryptography, privacy and anonymity, and legal and ethical issues. The goal of the course is to provide an appreciation of how to think adversarially with respect to computer systems as well as an appreciation of how to reason about attacks and defenses.

To complete the projects in this course, you will need to be able to write code in C and (some) C++, and have some understanding of x86 assembly, JavaScript, PHP and SQL. We will not teach these in lecture; you are expected to learn them on your own or ask for help in section or office hours. If you don't know C, K&R's The C Programming Language is a go to, but the Hacking book is probably enough and covers x86 assembly and many of the topics in this class.

Tentative Schedule

Assignments

We will have six programming assignments. These assignments are meant to both reinforce your knowledge of the concepts covered in lecture and get you to think about security in more depth, beyond what is covered lecture.

You are expected to work on the assignments by yourself. You may discuss the assignments with students from the course in general but not any specific solution. There are no late days, but you will receive an additional 10% if you turn in your assignment by the early date.

If you consult anything (books, academic papers, internet resources, people) when working on the assignments, note this in your submission. We encourage outside learning but expect you to not seek out specific details about a solution—anything submitted should be considered your own work. Similarly, you are expected to not publish or otherwise share your solutions at any point (even after the class is over). If you are unsure about what is allowed, please ask the course staff.

By taking this course, you implicitly agree to abide by the UCSD policies on Integrity of Scholarship and Student Conduct. See the Academic Integrity Support for Remote Learning. University rules on integrity of scholarship and code of conduct are taken seriously and will be enforced.

Scribe Notes

You will also be tasked with writing a set of lecture notes for one lecture during the quarter, in collaboration with 6 or 7 of your fellow students. Think of this as a short summary of the lecture, written in complete prose sentences, that should be understandable to a student who missed that class. There is no perfect textbook for this course, so we will share these scribe notes with your fellow students to help as a study aide.

Your scribe notes should be written in LaTeX. The first draft of your notes will be due two weeks from the lecture date. There is no extra credit for early turn-in, since we expect a few rounds of editing. You should submit both a PDF version of the notes as well as the source files to Gradescope. We will give feedback and continue iterating on edits until your notes are in good shape, and then we will post them to Canvas.

The draft that you turn in should be reasonably polished. This means that everyone in your group should make copy-editing, clarification, and organizational passes on everyone else's writing so that your notes read as a coherent whole. If you include images or diagrams that are in the lecture notes that were pulled from another source originally, you should add a citation to that source using bibtex, and your notes will have a bibliography section at the end. You may also need to refer to some of the readings or other materials to clarify, fix, or fill out additional details about what was covered in lecture; if you do this you should also cite your sources.

As motivational examples, David Wagner from Berkeley has written some beautiful lecture notes for some of the topics covered by this class that are longer than you need to write. Here is an example. A more typical example might be these scribe notes produced long ago for a random class when your professor was still a student.

Additional Resources

• Security Engineering by Ross Anderson
• Hacking: The Art of Exploitation by Jon Erickson

The course structure and many of the ideas and slides are influenced or directly from other courses taught at Berkeley (David Wagner and Raluca Popa), Michigan (J. Alex Halderman), Oberlin (Stephen Checkoway), Stanford (Dan Boneh, John Mitchell, and Zakir Durumeric), UT Austin (Hovav Shacham), UCSD (Stefan Savage, Deian Stefan) and UIUC (Michael Bailey and Kirill Levchenko).

Course materials adapted from Michael Bailey and J. Alex Halderman are available under a Creative Commons License.