16:198:671:01: Seminar in Computer Security

General Information

• Course number: 16:198:671:01, Index: 33102.
• Instructor: Vinod Ganapathy (contact information).
• Class hours: Mondays from noon-3pm.
• Class location: Core-305.
• Instructor's office hours: By arrangement.

• Teaching assistant: TBD.
• Teaching assistant's office hours: TBD.

• Textbooks: We will read papers from recent conferences. For the basics of computer security, I recommend the following freely-available book, which is quite fun to read: Security Engineering, by Ross Anderson.

• Sakai site: Here. We will use the Sakai site for discussions, to post paper reviews, for homeworks/exams, etc.

Notes

Course overview

We are surrounded by computer systems that we interact with on a daily basis---the Web, social networks, compute clouds, our mobile devices, our vehicles, and even our home appliances. When these computer systems are vulnerable to security attacks, as they invariably are, they place our privacy and security at risk.

The goal of this course is to sample a variety of topics covering recent research trends in computer security, both in terms of attacks and defenses, covering the spectrum of topics from Web and browser security, to cloud security, and mobile/pervasive computing security. We will also cover many "traditional" attacks and defenses that are by now folklore in the computer security community. The course will be based upon readings of research papers, both classics as well as from recent security conferences.

Reading list

Please see the class schedule for the assigned readings for each week. Students are expected to read and review the papers before they come to class. These reviews must be mailed to the instructor before class each week (latest by noon on the day of class). We will use class hours to summarize the paper, discuss its key ideas and shortcomings. Reading the paper before class will ensure that we will have more meaningful in-class discussions.

As you read the assigned papers, try to distill each paper as follows:

• Problem description: What problem does the paper address? Why is the problem important?
• Solution description: What is the solution proposed by the paper? Does it solve the problem in its entirety? If not, what are the assumptions under which the solution works? Are these assumptions reasonable? What aspects of the solution were evaluated in the paper? What aspects were not evaluated? Why not?
• Pros and cons -- your opinion: What did you like about the paper? (i.e., What is the "Aha!" point in the paper?) Did you learn any new tricks from this paper that you can add to your toolbox? What did you dislike about the paper? Did the authors hype their solution?
• Extensions: What is the next logical step? Did you get any project ideas from this paper? What about longer-term/more ambitious extensions?

Class schedule

Each week, we will discuss two (sometimes three) papers according to the schedule below. Papers to be presented by students are marked "S". (to be decided in the first two weeks). I will present the other papers in class. Please access the papers below from a Rutgers machine or via Rutgers VPN.

• September 8, 2011: Logistics and administrivia. Vulnerabilities and exploits.
  • E. Spafford, Crisis and aftermath CACM, 32(6), 1989.
  • S. Staniford, V. Paxson, N. Weaver, How to 0wn the Internet in your spare time USENIX Security, 2002.
  • Aleph One, Smashing the stack for fun and profit, Phrack Magazine 7(49), 1996.

• September 12, 2011: (More) Vulnerabilities and exploits.
  • Defenses such as ASLR, W^X, etc. Return to LibC exploits.
  • H. Shacham, The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86) ACM CCS 2007.
  • D. Brumley, P. Poosankam, D. Song, J. Zheng, Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications, Oakland 2008.

• September 19, 2011: Strengthening software.
  • M. Abadi, M. Budiu, U. Erlingsson, J. Ligatti, Control-flow integrity, ACM CCS 2005.
  • W. Xu, S. Bhatkar, R. Sekar, Taint-enhanced policy enforcement: A practical approach to defeat a wide range of attacks, USENIX Security 2006.

• September 26, 2011: Virtualization and OS Security.
  • Background reading on virtual machines. (no need to summarize this paper; it is for your benefit. Only read sections 1-5).
  • T. Garfinkel, M. Rosenblum, A Virtual Machine Introspection Based Architecture for Intrusion Detection, NDSS 2003.
  • A. Srivastava, J. Giffin, Tamper-resistant, application-aware blocking of malicious network connections, RAID 2008.

• October 3, 2011: Cloud security.
  • T. Ristenpart, E. Tromer, H. Shacham, S. Savage, Hey you, get off my cloud: exploring information leakage in third-party compute clouds, ACM CCS 2009.
  • R. Geambasu, T. Kohno, A. Levy, H. Levy, Vanish: Increasing Data Privacy with Self-Destructing Data , USENIX Security 2009.

• October 10, 2011: Network security.
  • M. Handley, V. Paxson, C. Kreibich, Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics, USENIX Security 2001.
  • B. Stone-Gross et al., Your botnet is my botnet: analysis of a botnet takeover ACM CCS 2009.

• October 17, 2011: Telecommunication network security.
  • W. Enck, P. Traynor, P. McDaniel, T. LaPorta, Exploiting Open Functionality in SMS-Capable Cellular Networks, ACM CCS 2005.
  • P. Traynor, M. Lin, M. Ongtang, V. Rao, T. Jaeger, P. McDaniel, T. LaPorta, On Cellular Botnets: Measuring the Impact of Malicious Devices on a Cellular Network Core, ACM CCS 2009.

• October 24, 2011: Android and app security.
  • W. Enck, M. Ongtang, P. McDaniel, Understanding Android Security, IEEE Security and Privacy 7(1), 2009.
  • W. Enck, D. Octeau, P. McDaniel, S. Chaudhuri, A Study of Android Application Security, USENIX Security 2011.
  • A. Porter Felt, E. Chin, S. Hanna, D. Song, D. Wagner, Android Permissions Demystified, ACM CCS 2011.

• October 31, 2011: Dealing with stolen and lost mobile devices.
  • T. Ristenpart, G. Maganis, A. Krishnamurthy, T. Kohno, Privacy-preserving Location Tracking of Lost or Stolen Devices: Cryptographic Techniques and Replacing Trusted Third Parties with DHTs, USENIX Security 2008.
  • R. Geambasu, J. John, S. Gribble, T. Kohno, H. Levy, Keypad: An auditing file system for theft-prone devices, EuroSys 2011.

• November 7, 2011: Social networks, spam.
  • A. Narayanan, V. Shmatikov, Deanonymizing social networks, Oakland 2009.
  • K. Levchenko et al., Click Trajectories: End-to-end analysis of the spam value chain, Oakland 2011.

• November 14, 2011: Web security: attacks and defenses.
  • Basics: JavaScript security model, Same-origin policy, Cross-site scripting and Cross-site request forgery.
  • M. T. Louw, V. Venkatakrishnan, Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers, Oakland 2009.
  • A. Barth, C. Jackson, J. Mitchell, Robust defenses against CSRF, ACM CCS 2009.

• November 28, 2011: JavaScript and browser security.
  • L. A. Meyerovich, V. B. Livshits, ConScript: Specifying and Enforcing Fine-Grained Security Policies for JavaScript in the Browser, Oakland 2010.
  • N. Provos, D. McNamee, P. Mavrommatis, K. Wang, N. Modadugu, The Ghost In The Browser: Analysis of Web-based Malware, HotBots 2007.
  • P. Ratanaworabhan, V. B. Livshits, B. G. Zorn, Nozzle: A defense against heap-spraying code-injection attacks, USENIX Security 2009.

• December 5, 2011: Securing Web browsers
  • C. Grier, S. Tang, S. King, Secure Web Browsing with the OP Web Browser, Oakland 2008.
  • M. Dhawan, V. Ganapathy, Analyzing Information Flow in JavaScript-Based Browser Extensions, ACSAC 2009.
  • S. Bandhakavi, S. T. King, P. Madhusudan, M. Winslett, VEX: Vetting Browser Extensions for Security Vulnerabilities, USENIX Security 2010.

• December 12, 2011: Automotive security
  • K. Koscher et al., Experimental Security Analysis of a Modern Automobile, Oakland 2010.
  • R. A. Popa, H. Balakrishnan, A. Blumberg, VPriv: Protecting Privacy in Location-Based Vehicular Services, USENIX Security 2009.

Grading

• Readings and paper presentation (15%): Each student will be expected to present one or two papers during the course of the semester. In addition, each student will have to send a critical review of the papers assigned for each class. Reviews are due before class each week. When you present a paper in class, you are expected to prepare slides on your own, i.e., you cannot use the authors' slideset, even if they have made it available on the Web.
• Homework(s) (10%): There will be a couple of homeworks, to be done individually.
• Exams (25%): There will be take-home mid-term and final exams that will test you on the material covered in class.
• Research project (50%): The research project is the most important aspect of this class. The course will be front-loaded so that students are exposed to key ideas early and can apply them to their course projects. Front loading the course will also mean that students can invest more time on their projects in the latter half of the semester. Projects are to be done individually or in teams of two.

Project

The final project is the main ingredient of this course. Students are expected to conduct original research and report their findings in a conference paper-style project report. The project can either be a new security system, extension of a previously-proposed system, or security analysis of an existing system. Although I will suggest project ideas, students are welcome and are encouraged to suggest their own projects. Project teams must be of size one or two.

The project will have the following checkpoints:

• Choosing a project topic. You will first form a team and decide on the project topic. During this phase, you will meet meet as a team, brainstorm ideas, and meet with me to refine the project proposal.

• Project proposal. You will submit a short (1-2 page) document stating (i) the problem that you propose to solve; (ii) why the problem is relevant; (iii) proposed solution methodology; and (iv) the research challenges that you expect to face. Once you have submitted the project proposal and have it approved by me, you will begin work on your project. Please start early and work regularly! Don't put things off until the last minute.

• Midpoint review + Related work. By this time, you are expected to have made significant progress toward achieving the goals stated in your project proposal, or must have a clear idea of the difficulties that are hampering your progress. You will meet with me to discuss your progress. You are also expected to have conducted a thorough survey of related work in the area, and are expected to have a writeup of related work (you will reuse this in your final project report as well).

• Presentation. You will present your work to the rest of the class. Depending on the number of class projects, we will either have class presentations, posters, or you will present individually to me. Please make your presentations clear and concise. Please follow the links from the resources section of the class webpage for advice on effective presentation.

• Submission of final project report. Your final project report must provide a clear description of the problem and solution, and your evaluation. It must closely mimic the style of a conference paper. Since we will have discussed several papers in class, you will be familiar with the format expected. The resources section of the class webpage also contains several links with advice on writing good research papers.

Important dates

Other Resources

Useful links

• CERT -- Carnegie Mellon Computer Emergency Response Team
• US-CERT -- US Computer Emergency Readiness Team
• MITRE Common Vulnerabilities and Exposures
• Finding Rogue Networks, a project at UCSB
• Spamhaus register of known spam operations

Tips to read an academic paper

• How to read a paper, by Professor S. Keshav, Univerity of Waterloo.

Tips for good technical writing

• Writing a technical paper, by Professor Michael Ernst.
• Tips for writing technical papers, by Professor Jennifer Widom.
• Writing suggestions, by Professor Barton Miller.
• Three sins of authors in Computer Science and Math, by Professor Jonathan Shewchuk.
• How to write a dissertation, by Professor Douglas Comer (most of the content on this page applies to all forms of technical writing).
• The elements of style by William Strunk Jr. and E. B. White (follow the "External links" at the bottom of this page for online copies of this book).

Tips for effective presentation

• Giving a technical talk, by Professor Michael Ernst.
• Tips for a good conference talk, by Professor Jennifer Widom.
• Oral presentation advice, by Professor Mark Hill.
• Giving an Academic Talk, by Professor Jonathan Shewchuk.