Software Vulnerabilities and Security is a graduate course covering common software programming, configuration, and design mistakes, and how to avoid them. The goals of the course are the following:
- Examine major vulnerability classes introduced in various software domains and levels of the software stack
- Understand effective techniques for defending against exploitation in situ
- Understand approaches for detecting the presence of vulnerabilities during development and deployment
- Gain hands-on experience in attacking and defending vulnerable software
Examples of topics covered by this course include:
- Memory corruption
- Web security
- Intrusion detection
- Reverse engineering and binary analysis
- Static and dynamic vulnerability discovery
- Malware classification and triage
- Class meets Wednesdays 6–9 PM in 220 Behrakis
- Office hours are by appointment
Grades will be assigned based on the completion of problem sets, quizzes, and a midterm and final exam. Points will also be awarded for class participation.
- Problem Sets
- Midterm Exam
- Final Exam
Quizzes and exams are performed in class, and are closed-book and closed-notes.
This course requires a solid background in programming, systems, and networking. Familiarity with the following systems, languages, and tools is highly beneficial.
- Bash scripting
- Python, Ruby, etc.
If you are uncertain of your abilities and cannot come up to speed quickly, you will most likely have significant difficulty with this course.
Cheating. Work submitted for grading must represent your own effort. Group work is not allowed unless a problem statement specifically states otherwise. There will be zero-tolerance for cheating; all cheating cases will be brought to OSCCR. Actions that constitute cheating are defined in the University Academic Integrity Policy, and students that participate in this course must acknowledge that they have read and understood this document.
Grading. Late assignments will be accepted, with the caveat that grading will be penalized by a full letter grade for each day that an assignment is late. Grades may be subject to a curve.
Reference Material. There is no official textbook for this course. Instead, we will rely on lectures and readings. If you need to brush up on background material, Google/Bing/insert your favorite search engine is your friend. If you are overly concerned with this, refer to the prerequisites statement.
Online Discussion. Online discussion and questions will be handled through Piazza, not via email. A best effort attempt will be made to respond to posts within 24 hours on weekdays during normal working hours. To ensure a timely response, do not wait to ask questions until the night before a submission deadline.
Ethics. This course covers sensitive material that includes information on how to exploit vulnerable software. Attack-oriented work must be restricted to the computing resources provided. Alternatively, students can perform this work using personal resources so long as other computing resources are not affected.
In particular, attacks performed against University resources or the open Internet are expressly prohibited. Students should also be familiar with the University Appropriate Use policy.
|Date||Module||Topics and Readings|
|Wed Jan 11||Foundations||Introduction, Foundations|
|Wed Jan 18||Systems||Users, Privilege|
|Wed Jan 25||Systems||Shells, Races, Sandboxing|
|Wed Feb 01||Networking||Link-, Network-, and Transport-Layer Attacks; Quiz|
|Wed Feb 08||Networking||Privacy and Anonymity|
|Wed Feb 15||Web||TLS, XSS, CSRF, SQL Injection|
|Wed Feb 22||Web||CSP, CORS, Browser Separation|
|Wed Mar 01||–||Midterm Exam|
|Wed Mar 08||–||Spring Break|
|Wed Mar 15||Applications||Architecture and Tools Review|
|Wed Mar 22||Applications||Memory Unsafety|
|Wed Mar 29||Applications||ASLR, DEP, CFI; Quiz|
|Wed Apr 05||Applications||Vulnerability Analysis|
|Wed Apr 12||Applications||Malware Analysis|
|Wed Apr 19||–||Final Exam|
|Warm Up||Fri Jan 27 18:00 -0500 2017|
|Users and Privilege||Fri Feb 24 18:00 -0500 2017|
|Network Evasion||Fri Mar 31 18:00 -0400 2017|
|Memory Corruption||Fri Apr 14 18:00 -0400 2017|