EC 521: CyberSecurity, Spring 2020

Manuel Egele

For correspondence, post to the piazza course site.

Graduate Student Teacher (GST)

• Sumatra Dhimoyee

GST Office Hours:

• Thu 06:00pm -- 08:00pm, Fri 06:00pm -- 08:00pm, @PHO305/307

Instructor's Office Hours:

• Mon 3pm -- 4:30pm, Wed 09:00am -- 10:00am @ PHO337

Internet security has become part of everyday life where security problems impact practical aspects of our lives. Even though there is a considerable corpus of knowledge about tools and techniques to protect systems, information about what are the actual vulnerabilities and how they are exploited is not generally available. This situation hampers the effectiveness of security research and practice. Understanding the details of attacks is a prerequisite for the design and implementation of secure systems.

This course deals with common programming, configuration, and design mistakes and ways to detect and avoid them. Examples are used to highlight general error classes, such as stack and heap overflows. Possible protection and detection techniques are examined. The course includes a number of practical lab assignments where participants are required to apply their knowledge as well as a discussion of the current research in the field. Students will learn how the security of systems can be violated, and how such attacks can be detected and prevented.

The course aims to make the students "security aware", and gain an in-depth understanding about security issues.

Tentative Syllabus

• Introduction & Principles
• Reconnaissance
• Unix Security Part
• Web Security Part
• Memory - Operational Semantics & Stack
• Memory - Assembly Primer
• Memory Corruption - Vulnerabilities
• Reverse Engineering
• Mobile Security
• Malware

With Topics On

• Operating system security and vulnerabilities (UNIX, Windows, stack and heap overflows)
• Windows Security
• Buffer Overflows (including Heap overflow)
• Testing
• Reverse engineering and binary analysis
• Viruses, worms, malware and malicious code
• Botnets
• Language security
• Web security