Week 1
Introduction
Reading:
K. Thompson Reflections on Trusting Trust
Week 2
Assembly primer and stack smashing
Reading:
Aleph One Smashing The Stack For Fun And Profit
Week 3
No class
No reading.
No class
No reading.
Week 4
Memory safety vulnerabilities 1
Reading:
Memory safety vulnerabilities 2
Reading:
Week 5
Code reuse attacks
No reading.
Return-Oriented Programming
Reading:
Week 6
ROP defenses
Reading:
L. Davi, A.-R. Sadeghi, and M. Winandy ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks
V. Pappas kBouncer: Efficient and Transparent ROP Mitigation
Software Fault Isolation and Control-Flow Integrity
Reading:
S. McCamant and G. Morrisett Evaluating SFI for a CISC Architecture
M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti Control-Flow Integrity: Principles, Implementations, and Applications
Week 7
Data as code
Reading:
N. Alramli Why Python Pickle is Insecure
J. Mason, S. Small, F. Monrose, and G. MacManus English Shellcode
S. Checkoway, H. Shacham, and E. Rescorla Are Text-Only Data Formats Safe? Or, Use This LaTeX Class File to Pwn Your Computer
Heap spraying/JIT spraying
Reading:
A. Sotirov Heap Feng Shui in JavaScript Part I only
F. Muttis and A. Sacco HTML5 Heap Sprays
D. Blazakis Interpreter Exploitation: Pointer Inference and JIT Spraying
Week 8
Browsers and the Same-Origin Policy
Reading:
M. Zalewski Browser Security Handbook chapters 1 (basic concepts) and 2 (standard security features)
C. Jackson and A. Barth Beware of Finer-Grained Origins
No class
No reading.
Week 9
Cross-origin Attacks: CSRF
Reading:
A. Barth, C. Jackson, and J. Mitchell Robust Defenses for Cross-Site Request Forgery
Cross-origin Attacks: XSS
Reading:
D. Bates, A. Barth, and C. Jackson Regular Expressions Considered Harmful in Client-Side XSS Filters
Week 10
Frames: Communication and Clickjacking
Reading:
A. Barth, C. Jackson, and J. Mitchell Securing Frame Communication in Browsers
P. Stone Next Generation Clickjacking: New Attacks Against Framed Web Pages
Frames 2: Framebusting
Reading:
G. Rydstedt, E. Bursztein, D. Boneh, and C. Jackson Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites
Week 11
Class canceled
No reading.
Class canceled
No reading.
Week 12
HTTPS
Reading:
C. Jackson and A. Barth ForceHTTPS: Protecting High-Security Web Sites from Network Attacks
C. Soghoian and S. Stamm Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL
TBD
No reading.
Week 13
TBD
No reading.
Class canceled
No reading.
Week 14
Thanksgiving: No class
No reading.
Thanksgiving: No class
No reading.
Week 15
TBD
No reading.
TBD
No reading.