642: Introduction to Computer Security

This Google Doc will have the most up to date information about the course materials, topics, and schedule.

Professor: Rahul Chatterjee (he/him)

Instruction: In-person. Time: Tue, Thu (9:30-10:45 am CT) Location: Humanities 1111

TAs:

Sophie Stephenson (she/her)
Nick Ceccio

Peer Mentors:

Yizhou Chen

Office hours:

Rahul: Wed 11-12pm CT (On Zoom from Nov 18 CS 7373 or by the lake in Memorial union terrace)
Sophie: Mon 1-2pm CT (Room 3242)
Nick: Wed 11am-12pm CT (Room 3215 ONLY Zoom on Nov 24)
Yizhou: Tue 3pm-4pm CT, Fri 2:50 pm-3:50 pm CT(Room 2201 or by the lake in Memorial union terrace)

Zoom link: If you cannot attend office hours in person, you can connect to this office hours zoom meeting during the scheduled office hours time slots: https://uwmadison.zoom.us/j/92123003269.

Class discussions: Piazza (https://piazza.com/wisc/fall2021/cs642)

Homeworks/assignments: Canvas (https://canvas.wisc.edu/courses/271196/assignments)

Textbooks:

There is no required textbook for this course. Here are some reference textbooks that might help.

Assignments and Midterms:

There will be two midterms and no final. Midterm 1 will be in class, and Midterm 2 will be take-home. There will be five homework assignments. You may pair-up with another student for homework assignments.

If you cannot take the exam on the below-mentioned dates, you have to take it earlier. Please let me know at least 3 weeks in advance. (Exceptions are possible, but only in exceptional circumstances.)

Late submission policy for homeworks:

Everyone gets 2 late days without penalty
One-fourth of the obtained points will be deducted for every additional late day (rounded up).
Homeworks submitted after four late days will not be graded (unless you notify me early with proper justification).

Grades

Course grade will be determined based on these components

Homework assignments: 50% (5 assignments)
Midterm-1: 20%
Midterm-2: 20%
Class participation: 10% *

* Class participation includes interacting in the class, with instructor/TAs, and on Piazza on a regular basis. If I don’t remember your name, you will not get full credit.

The grade cutoffs are:

A:91-100
AB: 84-90

B: 77-83
BC: 70-76

C: 61-69
D: 51-60

F: 0-50

The grading would be absolute --- if you meet the cutoff you get the grade.
For graduate students each grade cutoff is increased by 2 points. That is if you are a graduate student you have to get at least 93 to get an A.

Academic misconduct

Academic misconduct is taken very seriously in this course. You are encouraged to collaborate with your peers by helping them understand topics, sharing study materials, and helping them set up computing environments for assignments. However, you are NOT allowed to share answers, solutions, or any specifics about them for any assignments and midterms.

You are also allowed to search on the Internet about security related topics we discuss in the class or of your interest. If you are using an online resource that helps you solve an assignment, please cite the resource. But you are NOT allowed to search for solutions about the assignments or midterm questions online. There are incorrect answers posted online, and if your answer matches with a (incorrect) solution on the Internet, you will be reported to the university for academic misconduct and might obtain an F in the whole course. Please refer to https://conduct.students.wisc.edu/academic-misconduct/ for more information.

Diversity and inclusion

Diversity is a source of strength, creativity, and innovation for UW-Madison. We value the contributions of each person and respect the profound ways their identity, culture, background, experience, status, abilities, and opinion enrich the university community and this class. We commit ourselves to the pursuit of excellence in teaching, research, outreach, and diversity as inextricably linked goals. The University of Wisconsin-Madison fulfills its public mission by creating a welcoming and inclusive community for people from every background – people who as students, faculty, and staff serve Wisconsin and the world.

If you need to miss any exam due to religious observance, please get in touch with me in advance and we will find an alternate date for the make-up exam.

Tentative day-by-day lesson plan

This is a tentative lesson plan/syllabus. The readings and the topics for each day might change as we proceed through the semester.

Some reading materials are required, others are optional. As we progress through the course, [required] tags will be added to the readings that are required.

Week	Date	Topics	Readings	HW/Exam?
0	Sept 9 (THU)	Introduction and Logistics Security mindset Threat modeling	Reflections on Trusting Trust Saltzer and Schroeder, The Protection of Information in Computer Systems Gray hat hacking: Ethical Hacker’s Handbook
1	Sept 14 (TUE)	Symmetric-key encryption Threat modeling Symmetric encryption,	[required] Cryptography Engineering -- Ch: 2.6, 4.1-4.3, 4.5	HW1 released Finding issues with encryption function DH Pw cracking
1	Sept 16 (THU)	Asymmetric Key Crypto Block ciphers, different block cipher modes of operations Hashing, MAC	[required] Cryptography Engineering -- Ch: 2.6, 4.1-4.3, 4.5
2	Sept 21 (TUE)	Key management Background on number theory, Discrete log RSA Why Textbook RSA is not secure Sharing keys	[required] Number theory primer (Reference) Cryptography Engineering (Ch: 11-12) Twenty Years of Attacks on the RSA Cryptosystem
2	Sept 23 (THU)	User authentication Diffie-Hellman key exchange Source of randomness Passwords and PINs Guessing attacks Entropy Leaked passwords, HIBP	The password thicket: technical and market failures in human authentication on the web
3	Sept 28 (TUE)	Biometric authentication Different types Fingerprint auth Iris Issues with Biometrics	Biometrics: A Grand Challenge Computer security impaired by legitimate users Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q)	HW1 due
3	Sept 30 (THU)	Human Aspects of security Email security Case studies Principal of secure design	Why Johnny Can't Encrypt, Whitten and Tiger Guest lecture: Prof. Dorothea Salo
4	Oct 5 (TUE)	Web security 1 Browser security Same-origin policy, cookies, isolation	[Interesting] Securing Frame Communication in Browsers, Barth et al. Browser Security: Lessons from Google Chrome,	HW2 released (Web security)
4	Oct 7 (THU)	Web security 2 SQL Injection Cross-site scripting and request forgery Clickjacking Defenses	Cross Site Scripting Explained Robust Defenses for Cross-Site Request Forgery, Barth et al. Clickjacking Vulnerability and Countermeasures Advanced SQL Injection In SQL Server Applications
5	Oct 12 (TUE)	Network security 1: TLS Trust in the Internet How do certificate authorities work? Certificate issuance and revocation	[required] Networking 101: Transport Layer Security (TLS)
5	Oct 14 (THU)	Network Security 2: DNS, Mac DNS, DNSsec SYN flood Wireless security, Wireshark, Firewall, IDS	[required] DNS cache poisoning, by Steve Friedl A survey of BGP security, Butler et al. Wireshark tool (for reference) Nmap tutorial Insertion, Evasion, and Denial of Service
6	Oct 19 (TUE)	Miscellaneous network security and attacks Cyber security operation at UW-Madison (focusing on CS)	Guest lecture: David Parter, Sue Weier	HW2 due
6	Oct 21 (THU)	Topics for midterm: Crypto, user auth, HCI security Web security Network Security (excl. Wireless security)		Midterm 1 (in-class exam) HW3 released
7	Oct 26 (TUE)	Censorship, Anonymity network, Tor	Tor: The Second-Generation Onion Router, by Dingledine et al. Ignoring the Great Firewall of China, by Clayton et al.
7	Oct 28 (THU)	Operating system security UNIX and Multics security File system vulnerabilities Access control	Multics Security Evaluation: Vulnerability Analysis TOCTTOU Vulnerabilities in UNIX-Style File Systems
8	Nov 2 (TUE)	Low-Level software security 1 X86 basics VM Setup	A Crash Course in x86 Assembly for Reverse Engineers [required] Smashing the stack for fun and profit Low-level Software Security by Example	Return Midterm 1 and discuss
8	Nov 4 (THU)	Low-Level software security 2 Buffer overflow Demo	Basic integer overflows Improving Integer Security for Systems with KINT Format string vulnerabilities	HW3 due, HW4 released
9	Nov 9 (TUE)	Low-Level software security 3 Heap overflow Integer overflow Format-string vulnerabilities Detecting vulnerabilities	Real-world fuzzing Syzkaller
9	Nov 11 (THU)	Memory protection and attacks Stack canary ASLR W^X Software Fault Isolations	Address Sanitizer The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) StackGuard On the Effectiveness of Address-Space Randomization Adapting Software Fault Isolation to Contemporary CPU Architectures - David Sehr, Robert Muth, Cliff Biffle, Victor Khimenko
10	Nov 16 (TUE)	Android security Android permission model	https://arxiv.org/pdf/1904.05572.pdf	Guest lecture: Earlence Fernandes
10	Nov 18 (THU)	Hardware security TEE, TPM, SGX, Bitlocker	Intel Trusted Execution Technology Introduction to the TPM Attestation and Trusted Computing	(On Zoom)
11	Nov 23 (TUE)	Virtualization and cloud security Virtual machines Docker and LXC’s security Sandboxing		(On Zoom) HW4 due - Wed (Nov 24)
11	Nov 25 (THU)	Thanksgiving break		No class
12	Nov 30 (TUE)	Cloud Security (contd.)	Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds Cross-VM Side Channels and Their Use to Extract Private Keys	(On Zoom)
12	Dec 2 (THU)	Censorship, Tor OS security, Software security Virtualization, Cloud security Hardware security		Midterm 2 (Take home exam) HW5 released Sunday 12/5
13	Dec 7 (TUE)	IoT Security	SoK: Security Evaluation of Home-Based IoT Deployments	(On Zoom) Guest lecture by: Sophie Stephenson
13	Dec 9 (THU)	No class	No class	No class
14	Dec 14 (TUE)	Cryptocurrency	DigiCash: Blind Signature for untraceable payment A Peer-to-Peer Electronic Cash System Ethereum White Paper	(On Zoom) HW5 due Last class