Computer Systems Security

Graduate · Historical course

Fall 2014

Topics

Introduction, Threat Models
Control Hijacking Attacks
Buffer Overflow Exploits and Defenses
Privilege Separation
Guest Lecture: Paul Youn from iSEC Partners
Capabilities
Sandboxing Native Code
Web Security Model
Securing Web Applications
Symbolic Execution
Ur / Web
Network Security
Network Protocols
SSL and HTTPS
Medical Software
Side-Channel Attacks
User Authentication
Private Browsing
Anonymous Communication
Mobile Phone Security
Data Tracking
Guest Lecture: Mark Silis and David LaPorte from MIT IS&T
Security Economics
Project Presentations

Readings

LEC #: 1 · READINGS: No readings · READING QUESTION: No question
Reading assignment
LEC #: 2 · READINGS: Akritidis, Periklis, Manuel Costa, et al. “ Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors .” USENIX Security Symposium (2009): pp. 51–66. · READING QUESTION: Lecture 2 Question (PDF) ↗
Reading assignment
LEC #: 3 · READINGS: Bittau, Andrea, Adam Belay, et al. “ Hacking Blind .” Proceedings of the IEEE Symposium on Security & Privacy (2014). · READING QUESTION: Lecture 3 Question (PDF) ↗
Reading assignment
LEC #: 4 · READINGS: Krohn, Maxwell. “ Building Secure High-Performance Web Services with OKWS (PDF) .” USENIX Technical Conference (2004): pp. 185–198. · READING QUESTION: Lecture 4 Question (PDF) ↗
Reading assignment
LEC #: 5 · READINGS: No readings · READING QUESTION: No question
Reading assignment
Hardy, Norm. “The Confused Deputy.” ACM SIGOPS Operating Systems Review 22, no. 4 (1988): pp. 36–38.
Listed reading
Watson, Robert N. M., Jonathan Anderson, et al. “Capsicum: practical capabilities for UNIX.” (PDF) Proceedings of the 19th USENIX Security Symposium (2010). ↗
Listed reading
LEC #: 7 · READINGS: Yee, Bennett, David Sehr, et al. “ Native Client: A Sandbox for Portable, Untrusted x86 Native Code .” IEEE Symposium on Security and Privacy (2009): pp. 79–93. · READING QUESTION: Lecture 7 Question (PDF) ↗
Reading assignment
“ OWASP Top 10 - 2013: The Ten Most Critical Web Application Security Risks .” ↗
Listed reading
Zalewski, Michal. Chapters 9–13 in The Tangled Web: A Guide to Securing Modern Web Applications . No Starch Press, 2011. ISBN: 9781593273880.
Listed reading
LEC #: 10 · READINGS: Cadar, Cristian, Daniel Dunbar, et al. “ KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs .” Operating Systems Design and Implementation (2008): pp. 209–224. · READING QUESTION: Lecture 10 Question (PDF) ↗
Reading assignment
LEC #: 11 · READINGS: Chlipala, Adam. “ Ur / Web: A Simple Model for Programming the Web .” ACM SIGPLAN-SIGACT Symposium (2015): pp. 153–165. · READING QUESTION: Lecture 11 Question (PDF) ↗
Reading assignment
LEC #: 12 · READINGS: Bellovin, Steven M. “ A Look Back at ‘Security Problems in the TCP/IP Protocol Suite’ .” Computer Security Applications Conference (2004): pp. 229–249. · READING QUESTION: Lecture 12 Question (PDF) ↗
Reading assignment
LEC #: 13 · READINGS: Steiner, Jennifer G., Clifford Neuman, et al. “Kerberos: An Authentication Service for Open Network Systems.” USENIX Conference (1988). · READING QUESTION: Lecture 13 Question (PDF) ↗
Reading assignment
LEC #: 14 · READINGS: Jackson, Collin, and Adam Barth. “ ForceHTTPS: Protecting High-Security Web Sites from Network Attacks .” Proceedings of the 17th international conference on World Wide Web (2008): pp. 525–534. · READING QUESTION: Lecture 14 Question (PDF) ↗
Reading assignment
LEC #: 15 · READINGS: Fu, Kevin. “ Trustworthy Medical Device Software ,” 2011. · READING QUESTION: Lecture 15 Question (PDF) ↗
Reading assignment
LEC #: 16 · READINGS: Brumley, David, and Dan Boneh. “ Remote Timing Attacks are Practical .” Proceedings of the 12th USENIX Security Symposium 12, (2003): pp. 1. · READING QUESTION: Lecture 16 Question (PDF) ↗
Reading assignment
Bonneau, Joseph, Cormac Herley, et al. “ The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes .” IEEE Symposium on Security and Privacy (2012): pp. 553–567. ↗
Listed reading
LEC #: 18 · READINGS: Aggarwal, Gaurav, Elie Burzstein, et al. “ An Analysis of Private Browsing Modes in Modern Browsers .” USENIX Conference on Security (2010). · READING QUESTION: Lecture 18 Question (PDF) ↗
Reading assignment
Dingledine, Roger, Nick Mathewson, et al. “ Tor: The Second-Generation Onion Router .” Proceedings of the 13th USENIX Security Symposium 13 (2004): pp. 21. ↗
Listed reading
“Enck, William, Machigar Ongtang, et al. “ Understanding Android Security .” IEEE Security and Privacy 7, no. 1 (2009): pp. 50–57. ↗
Listed reading
LEC #: 21 · READINGS: Enck, William, Peter Gilbert, et al. “ TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones .” Communications of the ACM 57, no. 3 (2010): pp. 99–106. · READING QUESTION: Lecture 21 Questions (PDF) ↗
Reading assignment
LEC #: 22 · READINGS: No readings · READING QUESTION: No question
Reading assignment
LEC #: 23 · READINGS: Levchenko, Kirill, Andreas Pitsillidis, et al. “ Click Trajectories: End-to-End Analysis of the Spam Value Chain .” IEEE Symposium on Security and Privacy (2011): pp. 431–446. · READING QUESTION: Lecture 23 Question (PDF) ↗
Reading assignment
LEC #: 24 · READINGS: No readings · READING QUESTION: No question
Reading assignment

Sources

Course catalogue ↗Historical OpenCourseWare
MIT OCW readings ↗
MIT OCW calendar ↗
MIT OCW syllabus ↗
Historical MIT OpenCourseWare offering. Named reading entries and schedule topics are automatically extracted from the linked source pages.