| Date | Topic | Reading |
| Thur. 1/08 | Introduction | No written synopsis
required. Complete the reading by 1/13: How to Read a Paper, S. Keshav, University of Waterloo, 2013. Writing reviews for systems conferences, Timothy Roscoe, ETH Zurich, 2007. |
| Tues. 1/13 | Capabilities and Access Control | Capsicum: Practical Capabilities for UNIX, R.N.M. Watson, J. Anderson, B. Laurie, K. Kennaway, USENIX Sec 2010.Background (no written synopsis required):The Confused Deputy: (or why capabilities might have been invented), N. Hardy, OSR 1988. |
| Thurs. 1/15 | Low-level SW Attacks & Defenses | StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks, C. Cowan, USENIX Sec 1998.Background (no written synopsis required):Smashing The Stack For Fun And Profit, Aleph One, Phrack 1996.Basic Integer Overflows, blexim, Phrack 2002.Exploiting Format String Vulnerabilities, scut / team teso, 2001. |
| Tues. 1/20 | Privilege Separation | Preventing Privilege Escalation, N. Provos, USENIX Sec 2002. |
| Thurs. 1/22 | Reference Monitors | A Secure Environment for Untrusted Helper Applications (Confining the Wily Hacker), I. Goldberg, D. Wagner, R. Thomas, E. Brewer, USENIX Sec 1996.Background (no written synopsis required):Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools, T. Garfinkel, NDSS 2003. |
| Tues. 1/27 | ||
| Thurs. 1/29 | Sandboxing | Efficient Software-based Fault Isolation, R. Wahbe, S. Lucco, T.E. Anderson, S.L. Graham, SOSP 1993. |
| Tues. 2/03 | Sandboxing | Adapting Software Fault Isolation to Contemporary CPU Architectures, D. Sehr, et al., USENIX Sec 2010. |
| Thurs. 2/05 | Return Oriented Programming | Project proposals due.The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86), H. Shacham, CCS 2007. |
| Tues. 2/10 | Control Flow Integrity | Control-Flow Integrity Principles, Implementations, and Applications, M. Abadi, M. Budiu, U. Erlingsson, J. Ligatti, CCS 2005. |
| Thurs. 2/12 | CFI and ROP | Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection, L. Davi, A-R Sadeghi, D. Lehmann, F. Monrose, USENIX Sec 2014. |
| Tues. 2/17 | Snow Day |
Additional reading (no synopsis required): A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World, A. Bessey, et al. CACM 2010. |
| Thurs. 2/19 | Project Meetings | No class |
| Tues. 2/24 | Snow Day |
|
| Thurs. 2/26 | Snow Day |
VEX: Vetting Browser Extensions for Security Vulnerabilities, S. Bandhakavi, S.T. King, P. Madhusudan, M. Winslett, USENIX Sec 2010. |
| Tues. 3/03 | Dynamic Analysis | Purify: Fast Detection of Memory Leaks and Access Errors, R. Hastings, B. Joyce, USENIX 1992. |
| Thurs. 3/05 | Smartphone Security | A System and Language for
Building System-Specific, Static Analyses, S. Hallem, B. Chelf, Y. Xie,
D. Engler, PLDI 2002. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, W. Enck, et al. OSDI 2010. PiOS: Detecting Privacy Leaks in iOS Applications, M. Egele, C. Kruegel, E. Kirda, G. Vigna, NDSS 2011. Additional reading (no synopsis required): A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World, A. Bessey, et al. CACM 2010. |
| Tues. 3/10 | Spring Break | No class |
| Thurs. 3/12 | Spring Break | No class |
| Tues. 3/17 | Traveling | First security review
due. |
| Thurs. 3/19 | Smartphone Security | Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks, Q. Chen, Z. Qian, Z. Morley Mao, USENIX Sec 2014. |
| Tues. 3/24 | Symbolic Execution | EXE: Automatically
Generating Inputs of Death, C. Cadar, et al., CCS 2006. FIE on Firmware: Finding Vulnerabilities in Embedded Systems Using Symbolic Execution, D. Davidson, B. Moench, S. Jha, T. Ristenpart, USENIX Security 2013. |
| Thurs. 3/26 | Browser Security | The
Multi-Principal OS Construction of the Gazelle Web Browser, H.J. Wang,
et al., USENIX Sec
2009.The
Security Architecture of the Chromium Browser, A. Barth et al., TR 2008. VEX: Vetting Browser Extensions for Security Vulnerabilities, S. Bandhakavi, S.T. King, P. Madhusudan, M. Winslett, USENIX Sec 2010. |
| Tues. 3/31 | Software Verification | Modular Verification of Software Components in C, S. Chaki, et al. ICSE 2003. |
| Thurs. 4/02 | OS Security | seL4: From General Purpose to a Proof of Information Flow Enforcement, T. Murray, et al., IEEE SP 2013. |
| Tues. 4/07 | Trusted Path | Second security review
due. Building Verifiable Trusted Path on Commodity x86 Computers, Z. Zhou, V.D. Gligor, J. Newsome, J.M. McCune, IEEE SP 2012. |
| Thurs. 4/09 | Isolated Execution | TrustVisor: Efficient TCB Reduction and Attestation, J.M. McCune, et al., IEEE SP 2010. |
| Tues. 4/14 | Chip and Pin | Chip and Skim: Cloning EMV Cards with the Pre-Play Attack, M. Bond, et al., IEEE SP 2014. |
| Thurs. 4/16 | Measuring Attacks | Measuring Pay-per-Install: The Commoditization of Malware Distribution, J. Caballero, C. Grier, C. Kreibich, V. Paxson, USENIX Sec 2011. |
| Tues. 4/21 | Measuring Attacks | When Governments Hack Opponents: A Look at Actors and Technology, W. Marczak, J. Scott-Railton, M. Marquis-Boire, V. Paxson, USENIX Sec 2014. |
| Thurs. 4/23 | Presentations | Please fill out the online Carolina Course Evaluation. Bring your laptops to class, we will end early so you can complete the evaluation during class time. |
| Fri. 4/24 | Final paper due | No class, project reports due by 11:59 pm. |