Introduction
Reading:
K. Thompson Reflections on Trusting Trust
C. Miller The Legitimate Vulnerability Market. Inside the Secretive World of 0-day Exploit Sales
S. Inguva et al. Source Code Review of the Hart InterCivic Voting System (Chapter 3 only)
Project tutorial
No reading, but I will demonstrate how to solve part 1 of project 1.
Memory safety vulnerabilities 1
Reading:
Memory safety vulnerabilities 2
Reading:
scut / team teso Exploiting Format String Vulnerabilities
Format string vulnerabilities, attempt 1
Format string vulnerabilities, attempt 2
Slides: pdf
Return-Oriented Programming
Reading:
ROP defenses
Reading:
L. Davi, A-R. Sadeghi, and M. Winandy ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks.
V. Pappas kBouncer: Efficient and Transparent ROP Mitigation
Software Fault Isolation and Control-Flow Integrity
Reading:
S. McCamant and G. Morrisett Evaluating SFI for a CISC Architecture
M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti Control-Flow Integrity: Principles, Implementations, and Applications
Data as code
Reading:
N. Alramli Why Python Pickle is Insecure
J. Mason, S. Small, F. Monrose, and G. MacManus English Shellcode
S. Checkoway, H. Shacham, and E. Rescorla Are Text-Only Data Formats Safe? Or, Use This LaTeX Class File to Pwn Your Computer
Exam preperation
No Reading. Come with questions!
No class
Exam 1
No Reading.
Catch up
No reading.
Catch up
No reading.
Class cancelled
Heap spraying/ JIT spraying
Reading:
A. Sotirov Heap Feng Shui in JavaScript Part I only
F. Muttis and A. Sacco HTML5 Heap Sprays
D. Blazakis Interpreter Exploitation: Pointer Inference and JIT Spraying
Class Cancelled
Browsers and the Same-Origin Policy
Reading:
M. Zalewski Browser Security Handbook chapters 1 (basic concepts) and 2 (standard security features)
C. Jackson and A. Barth Beware of Finer-Grained Origins
Class cancelled
Catch up on reading.
Cross-Origin Attacks
Reading:
A. Barth, C. Jackson, and J. Mitchell Robust Defenses for Cross-Site Request Forgery
Thanksgiving vacation
No reading.
Frames: Communication and Clickjacking
Reading:
A. Barth, C. Jackson, and J. Mitchell Securing Frame Communication in Browsers
P. Stone Next Generation Clickjacking: New Attacks Against Framed Web Pages
HTTPS
Reading:
C. Jackson and A. Barth ForceHTTPS: Protecting High-Security Web Sites from Network Attacks
C. Soghoian and S. Stamm Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL
Exam preperation and a worm!
M. Eichin and J. Rochlis With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988
Exam 2
No reading.