COMP 4634: Cybersecurity (Fall 2024) 

Date

Topics

Lecture slides & Reading

03/09 

Introduction  

05/09 

Control hijacking attacks: exploits 

• Hacking blind, A. Bittau et al.
• Basic Integer Overflows, blexim
• Use after free exploit example, K. Winterborn
• Bypassing Browser Memory Protections, A. Sotirov, M. Dowd

10/09 

Control hijacking attacks: exploits (cntd.) 

12/09 

Control hijacking attacks: defenses 

• Return oriented programming, H. Shacham et al.
• Control flow integrity, M. Abadi et al.
• ARM Memory Tagging Extension and How It Improves C/C++ Memory Safety, K. Serebryany

17/09 

Control hijacking attacks: defenses (cntd.) 

19/09 

Principle of least privilege, access control, and operating systems security 

• SetUID Demystified, Chen, Dean, and Wagner, 2002.
• Operating Systems Security, T. Jaeger, 2008. Chapter 4, Security in Ordinary Operating Systems.

24/09 

Principle of least privilege, access control, and operating systems security (cntd.) 

26/09 

Isolation and sandboxing 

• Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools, T. Garfinkel
• Efficient Software-Based Fault Isolation, Robert Wahbe, et al.

03/10 

Isolation and sandboxing (cntd.) 

08/10

Processor and microarchitecture security: Intel SGX and the Spectre attack

• Shielding Applications from an Untrusted Cloud with Haven
• Spectre Attacks: Exploiting Speculative Execution
• Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX

10/10

Web Security Model  

• Securing Browser Frame Communication. Adam Barth, Collin Jackson, and John C. Mitchell
• Analyzing and Defending Against Web-based Malware. J. Chang et al.
• Exposing private information by timing web applications. A. Bortz, D. Boneh, and P. Nandy
• Web workers
• Content Security Policies
• Sandboxed iFrames
• cors

15/10

Midterm

17/10

Web Attacks

• Cross site scripting explained, Amit Klein
• SQL Injection attacks, Chris Anley
• Robust Defenses for Cross-Site Request Forgery. Adam Barth, Collin Jackson, and John C. Mitchell

22/10

Web Attacks (cntd.)

24/10

Web Defenses

• Secure Session Management With Cookies for Web Applications. Chris Palmer
• Origin Cookies: Session Integrity for Web Applications. by Bortz et al.

29/10

Web Defenses (cntd.)

31/10

Network Security

• A Security Evaluation of DNSSEC with NSEC3, J. Bau and J.C. Mitchell
• Distributed Firewalls, S. Bellovin
• Bro: A System for Detecting Network Intruders in Real-Time, V. Paxon

05/11

Network Security (cntd.)

07/11

DoS Attacks and Network Defenses

• DDoS amplification attack statistics, 2017
• The real cause of large DDoS - IP Spoofing, Marek Majkowski, 2018.
• Practical network support for IP Traceback, S. Savage, et al.
• A DoS-Limiting Network Architecture, Yang, Wetherall, and Anderson

12/11

DoS Attacks and Network Defenses (cntd.)

14/11

Privacy, Anonymity, and Censorship

• Tor: the second-generation onion router

19/11

Machine Learning Security: Adverserial Attack

21/11

Machine Learning Security: Adverserial Training and Verification

26/11

Large Language Model Security: Jailbreak and Defense

28/11

Large Language Model Security: Jailbreak and Defense (cntd.)

TBD

Final