Readings

Date	Topic
01/28/11	Buffer overflows
02/04/11	Control hijacking
02/11/11	Security requirements
02/18/11	None (Milestone 1)
02/25/11	Applied cryptography
03/04/11	Applied cryptography
03/11/11	None (Milestone 2)
03/18/11	TLS
03/25/11	Spring break
04/01/11	Assurance
04/08/11	None (Milestone 3)
04/15/11	Assurance
04/22/11	Web security
04/29/11	None (Milestone 4)
05/06/11	Web security

Buffer overflows

• Required reading:
  • Smashing the Stack for Fun and Profit. Aleph One. Phrack 47(9), file 14. Aug. 11, 1996.
• Optional reading:
  • Buffer overflows demystified. Murat Balaban. Available from http://www.enderunix.org/documents/eng/bof-eng.txt. Accessed Jan. 27, 2011.
  • The frame pointer overwrite. klog. Phrack 55(9), file 8. Sept. 9, 1999.
  • Public enemy #1: The buffer overrun. Chapter 5 in Writing Secure Code, second edition. Michael Howard and David LeBlanc. Microsoft Press, Redmond, Washington, 2003.
  • The Shellcoder's Handbook, second edition. Chris Anley, John Heasman, Felix "FX" Lindner, and Gerardo Richarte. Wiley Publishing, Indianapolis, Indiana, 2007.
  • Intel 64 and IA-32 Architectures Software Developer's Manual. Volume 1: Basic Architecture. Intel Corporation. Order number 253665-037US, Jan. 2011. Availble from http://download.intel.com/design/processor/manuals/253665.pdf. Accessed Jan. 29, 2011.

Control hijacking

• Required:
  • Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade. Crispin Cowan, Perry Wagle, Calton Pu, Steve Beattie, and Jonathan Walpole. In Proc. OASIS, 2003.
• Optional:
  • StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. Crispin Cowan et al. In Proc. USENIX Security Symposium, 1998. Available from http://www.usenix.org/publications/library/proceedings/sec98/full_papers/cowan/cowan_html/cowan.html. Accessed Feb. 2, 2011.
  • Protecting from stack-smashing attacks. Hiroaki Etoh and Kunikazu Yoda. June 19, 2000. Available from http://www.trl.ibm.com/projects/security/ssp/main.html. Accessed Feb. 3, 2011.
  • PaX Documentation. PaX Team. Available from http://pax.grsecurity.net/docs/. Accessed Feb. 2, 2011.
  • Exploiting format string vulnerabilities, version 1.2. scut / teacm teso. Sept. 1, 2001. Available from http://julianor.tripod.com/bc/formatstring-1.2.pdf. Accessed Jan. 29, 2011.
  • Format string attacks. Tim Newsham. Sept. 2000. Available from julianor.tripod.com/bc/tn-usfs.pdf. Accessed Jan 31, 2011.
  • Analysis of format string bugs. Andreas Thuemmel. Feb. 2001.
  • Run-time Detection of Heap-based Overflows. William Robertson, Christopher Kruegel, Darren Mutz, and Fredrik Valeur. In Proc. USENIX LISA, 2003. Available from http://www.usenix.org/event/lisa03/tech/full_papers/robertson/robertson_html/index.html. Accessed Feb. 2, 2011.
  • Low-level Software Security: Attacks and Defenses. Úlfar Erlingsson. Microsoft Research Technical Report MSR-TR-2007-153, Nov. 2007.

Security requirements

• Required:
  • Lecture notes.
• Optional:
  • none

Applied cryptography

Warning: the older a source is, the more likely it is to contain out-of-date information about current best practices in applied cryptography.

• Required:
  • none
• Recommended:
  • Cryptography Engineering: Design Principles and Practical Applications. Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno. Wiley Publishing, Indianapolis, Indiana, 2010. On reserve at the Engineering Library.
  • Network Security: Private Communication in a Public World, Part I: Cryptography. Charlie Kaufman, Radia Perlman, and Mike Speciner. Prentice Hall, Englewood Cliffs, New Jersey, 1995. On reserve at the Engineering Library.
  • Java Cryptography Architecture Reference Guide: For Java Platform Standard Edition 6. Oracle. Available from http://download.oracle.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html. Accessed Feb. 24, 2011.
• Optional:
  • Handbook of Applied Cryptography, fifth printing. Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone. CRC Press, Boca Raton, Florida, 2001. Available from http://www.cacr.math.uwaterloo.ca/hac/.
  • Practical Cryptography. Niels Ferguson, Bruce Schneier. Wiley Publishing, New York, 2003. This book is the previous edition of Cryptography Engineering. On reserve at the Engineering Library.
  • Applied Cryptography: Protocols, Algorithms, and Source Code in C. Bruce Schneier. New York, Wiley, 1996. On reserve at the Engineering Library.
  • CS 5430 notes on cryptography: Introduction to cryptography, Hashes and message digests, Symmetric-key cryptosystems, Asymmetric-key cryptosystems, Secret sharing.

TLS (Transport Layer Security)

• Required:
  • none
• Optional:
  • The TLS Protocol, version 1.0. T. Dierks and C. Allen. RFC 2246, 1999. Available from http://www.ietf.org/rfc/rfc2246.txt. Accessed Mar. 18, 2011.
  • Java Secure Socket Extension Reference Guide: For Java Platform Standard Edition 6. Oracle. Available from http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html. Accessed Mar. 18, 2011.

Assurance

• Required:
  • Evaluating Static Analysis Defect Warnings on Production Software. Nathaniel Ayewah, William Pugh, J. David Morgenthaler, John Penix and YuQian Zhou. In Proc. Workshop on Program Analysis for Software Tools and Engineering, p. 1-8, June 2007.
  • Testing. Chapter 10 in An Integrated Approach to Software Engineering, third edition. Pankaj Jalote. Springer, New York, 2005.
  • An Empirical Study of the Robustness of MacOS Applications using Random Testing. Barton P. Miller, Gregory Cooksey, and Fredrick Moore. In Proc. RT, 2006. Available from ftp://ftp.cs.wisc.edu/paradyn/technical_papers/Fuzz-MacOS.pdf. Accessed Apr. 14, 2011.
• Optional:
  • Using Static Analysis For Software Defect Detection. Bill Pugh. Google TechTalk, July 6, 2006. Available from http://video.google.com/videoplay?docid=-8150751070230264609. Accessed Mar. 30, 2011.
  • Department of Defense Trusted Computer System Evaluation Criteria. (Also known as the Orange Book.) DoD 5200.28-STD, Dec. 1985.
  • Technical Guide to Information Security Testing and Assessment. NIST Special Publication 800-115, Sept. 2008.
  • FindBugs website.
  • The Art of Software Testing, second edition. Glenford J. Myers; revised and updated by Tom Badgett and Todd Thomas, with Corey Sandler. Wiley, Hoboken, New Jersey, 2004.
  • Fuzzing for Software Security Testing and Quality Assurance. Ari Takanen, Jared DeMott, and Charlie Miller. Artech House, Boston, Mass., 2008.
  • Barton Miller's website on fuzz testing, including papers on fuzzing Unix, Windows NT, and Mac OS X.
  • Automated Whitebox Fuzz Testing. Patrice Godefroid, Michael Y. Levin, and David Molnar. In Proc. NDSS, 2008. Available from http://research.microsoft.com/en-us/um/people/pg/public_psfiles/ndss2008.pdf. Accessed Apr. 14, 2011.

Web security

• Required:
  • A Classification of SQL Injection Attacks and Countermeasures. William G.J. Halfond, Jeremy Viegas, Alessandro Orso. In Proc. Intl. Symp. on Secure Software Engineering, 2006. Available from http://www.cc.gatech.edu/~orso/papers/halfond.viegas.orso.ISSSE06.pdf. Accessed April 21, 2011.
  • Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. Florian Nentwich, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. In Proc. NDSS, 2007. Available from http://www.seclab.tuwien.ac.at/papers/xss_prevention.pdf. Accessed April 21, 2011.
• Optional:
  • The Web Application Hacker's Handbook. Dafydd Stuttard and Marcus Pinto. Wiley, Indianapolis, Indiana, 2008.
  • XSS. In the Open Web Application Security Project. Accessed April 21, 2011.
  • SQL Injection. In the Open Web Application Security Project. Accessed April 21, 2011.
  • Browser Security Handbook. Michal Zalewski. Available from http://code.google.com/p/browsersec/wiki/Main. Accessed May 5, 2011.
  • Isolating Web Programs in Modern Browser Architectures. Charles Reis and Steven D. Gribble. In Proc. EuroSys, 2009.
  • The Security Architecture of the Chromium Browser. Adam Barth, Collin Jackson, Charles Reis, and The Google Chrome Team. Technical report, 2008. Available from http://seclab.stanford.edu/websec/chromium/chromium-security-architecture.pdf. Accessed May 5, 2011.