EECS 765, Fall 2023

Introduction to Cryptography and Computer Security

Course Goals

The overall goal of the course is to provide a solid theoretical foundation and hands-on experience in applying the theory to practice for cryptography, computer and communication security. The course materials cover common attack techniques, application of cryptography in security, authentication and authorization, network security, enterprise network defense, web security, and economics of cybersecurity. Besides the mechanisms for enhancing security that will be taught, a significant part of the course is dedicated to discussions on how design flaws in a system can be exploited to compromise security and, in general, the circumstances that lead to things going wrong. Students will have the opportunity to work on course projects that cover both the defense and offense aspects in the cyber space. Interesting research topics may be derived from course projects.

Course Schedule

Updated on a regular basis. Use your KU Online ID (all numeric is not correct) and password to access the slides and other materials.

Aug 22, 2023
on-campus		 Lecture 1

Introduction

Supplemental readings:
  • (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 1
video, slides
Aug 24, 2023
on-campus		 Lecture 2

Buffer Overflow Exploit
The source code getscore.c The sample score file score.txt
Supporting older ciphers and key exchange protocols on newer SSH clients.
Virtual machine used in the demonstration redhat8.

Supplemental readings: 		slides, video
Aug 29, 2023
on-campus		 Lecture 3

Buffer Overflow Exploit (continued)

Supplemental readings: 		slides, video
Aug 31, 2023
on-campus		 Programming Assignment 1 (Lecture 4) Remote Buffer Overflow Attack pa1, video
Sep 5, 2023
online		 Lecture 5 Mitigation of Buffer Overflow Exploits slides, video
Sep 7, 2023
on-campus		 Lecture 6

Mitigation of Buffer Overflow Exploits (continued)

Reading Assignment Presentations
Reading Assignment Evaluation Sheet

Reading assignment 1 (Presentation 1, Presentation 2): The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86).

Reading Assignment 2 (Presentation 3, Presentation 4): Hacking Blind.

Supplemental readings: 		slides, video
Sep 12, 2023
online		 Lecture 7 Guest lecture: Operations Math slides
Sep 14, 2023
on-campus		 Lecture 8

Basic Cryptography

Reading assignment 3 (Presentation 5, Presenation 6): Framing Signals - A Return to Portable Shellcode.

Reading Assignment 4 (Presentation 7, Presenation 8): ASLR-Guard: Stopping Address Space Leakage for Code Reuse Attacks.

Supplemental readings:
  • (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 10
slides, video
Sep 19, 2023
on-campus		 Lecture 9

Authentication and Authorization

Supplemental readings:
  • (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 13
slides, video
Sep 21, 2023
on-campus		 Programming Assignment 2 (Lecture 10)

Windows Remote Buffer Overflow Attack

Reading assignment 5 (Presenation 9, Presenation 10): Modeling and Discovering Vulnerabilities with Code Property Graphs.

Reading Assignment 6 (Presenation 11, Presenation 12): How to Make ASLR Win the Clone Wars: Runtime Re-Randomization.

Reading Assignment 7 (Presenation 13, Presenation 14): Shuffler: fast and deployable continuous code re-randomization.

pa2, slides, video
Sep 26, 2023
on-campus		 Lecture 11

Practical Authentication Protocols

Supplemental readings: 		slides, video
Sep 28, 2023
on-campus		 Lecture 12

Man-in-the-Middle Attacks

Reading assignment 8 (Presentation 15): FuzziFication: Anti-Fuzzing Techniques

slides, video
Oct 3, 2023
on-campus		 Homework 1
(Lecture 13)

Authentication in a Distributed Environment (Kerberos)

Supplemental readings: 		hw1, slides, video
Oct 5, 2023
on-campus		 Final Report
(Lecture 14)

Public-Key Infrastructure (PKI)

Final Report - Requirements, Guidelines, and Example Topics
Report Topics Due: Oct. 24, 2023
Final Report Due: Dec. 7, 2023

Supplemental readings: 		final-report, slides, video
Oct 10, 2023
on-campus		 Presentations
(Lecture 15)

Reading Assignment Presentations:

Reading Assignment 1 (Presentation 1, Presentation 2): slides, slides

Reading Assignment 2 (Presentation 3): slides

 pa2-feedback, video
Oct 12, 2023
on-campus		 Presentations
(Lecture 16)

Reading Assignment Presentations:

Reading Assignment 2 (Presentation 4): slides

Reading Assignment 3 (Presentation 5, Presentation 6): slides, slides
Oct 17, 2023 Fall Break
(No Lecture)		 Enjoy the break!
Oct 19, 2023
on-campus		 Programming Assignment 3
(Lecture 17)

Heap Buffer Overflow Attacks
Source code: heap.c
Exploit code: heap_exploit.c

Supplemental readings: 		pa3, slides, video
Oct 24, 2023
on-campus		 Lecture 18

Introduction to Network Security

Supplemental readings: 		slides, video
Oct 26, 2023
on-campus		 Lecture 19

Windows Exception Overwrite Attack

Supplemental readings: 		slides, video
Oct 31, 2023
on-campus		 Programming Assignment 4
(Lecture 20)

Windows Exception Overwrite Attack (continued)

 pa4, lecture-video, helper-video
Nov 2, 2023
on-campus		 Lecture 21

DNS Security

Supplemental readings: 		slides, video
Nov 7, 2023
on-campus		 Lecture 22

Return Oriented Programming
Virtual machine used in the demonstration: Ubuntu-16-04LTS

Supplemental readings: 		slides, video
Nov 9, 2023
on-campus		 Programming Assignment 5
(Lecture 23)		 ROP and Heap Spray pa5, slides, video
Nov 14, 2023
on-campus		 Presentations
(Lecture 24)

Reading Assignment Presentations:

Reading Assignment 4 (Presentations 7 and 8): slides, slides

Reading Assignment 5 (Presentation 9): slides
Nov 16, 2023
on-campus		 Presentations
(Lecture 25)

Reading Assignment Presentations:

Reading Assignment 5 (Presentations 10): slides

Reading Assignment 6 (Presentations 11 and 12): slides, slides

 pa5-hints-and-more, video
Nov 21, 2023
online		 Lecture 26

Firewalls
No in-class lecture, please watch the recorded lecture
(Deadline for PA5)

slides, video
Nov 23, 2023 Thanksgiving
(No Lecture)		 Happy Thanksgiving!
Nov 28, 2023
on-campus		 Homework 2
(Lecture 27)		 Software Vulnerabilities hw2, slides, video
Nov 30, 2023
on-campus		 Presentations
(Lecture 28)

Reading Assignment Presentations:

Reading Assignment 7 (Presentations 13 and 14): slides, slides

Reading Assignment 8 (Presentation 15): slides

 slides, video
Dec 5, 2023
on-campus		 Lecture 29

Final Exam Review
(Deadline for HW2)

slides, video
Dec 7, 2023
on-campus		 Final Report
(Lecture 30)

Advice and Q&A

 slides, video
Dec 13, 2023
on-campus		 Final Exam Time slot allocated by the University Registrar Office: Wednesday (12/13), 1:30 - 4:00 pm
Location: 1420 LEEP2 (our regular lecture classroom)

Instructor and Course Meeting Times

Lectures Tuesday & Thursday 1:00pm - 2:15pm, LEEP2 1420
Instructor Alex Bardas
Office: 2040 Eaton Hall
Office Hours: Tuesday and Thursday 11:50am - 12:50pm, and by email appointment
Email appointment is needed to schedule a meeting over Zoom: meeting details
: alexbardas ku edu
Teaching Assistant / Co-Instructor Shawn Robertson
Office: 2435 LEEP2
Office Hours: Wednesday 2:00pm - 3:00 pm and by email appointment
Email appointment is needed to schedule a meeting over Zoom: meeting details
: shawn.robertson ku edu

Prerequisites

Operating systems (e.g., EECS 678 or EECS 750) and computer networking (e.g., EECS 563 or EECS 780), or the instructor's approval. In other words, a basic understanding of computer systems, including operating systems, networking, compilers, data structures, etc. This is a course that is primarily targeted at graduate students and at junior/senior-level undergraduate students in computer science and computer engineering.

Technical Support

If you experience any problems with lab equipment or your EECS account, contact the Engineering Technical Support Center immediately. Please be polite and as detailed as possible: Ticket Form

Optional Textbook

Matt Bishop. 2019 Computer Security [Art and Science], 2nd Edition. Addison-Wesley Professional.

Important Dates

See the KU Registrar for important dates involving adding, drops, and refund information.

Student Outcomes

After successful completion of this course, students should be able to:

General Course Information

Announcements: You are responsible for all announcements we make in class, over Canvas, and/or email, such as information about assignments, changes in the syllabus, etc.

Assignments (Homework and Final Report) Submission: Usually assignments are due at 11:59PM Central Time via Canvas (unless otherwise specified) according to the date posted in the assignment. In general, expect a 20% per day penalty for late submissions. One minute or 23 hours still count as a whole late day. Each calendar day counts as a late day. In case a solution will be made available by the instructor, late submissions will no longer be accepted.

Attendance: The knowledge and skills you will gain in this course highly depend on your participation in class learning activities. Because of that, I expect you to attend all class sessions unless you are ill or have a valid reason for missing. If you face challenges to fully participating in class due to illness, please let me know. We are here to support your success.

Grading

There will be on average one assignment per week, which could be a written homework, a programming project, or a reading assignment. At the end of the semester, you must also turn in a final report that focuses on a specific problem in computer and information security. The topics for the report will be seeked out by the students and approved by the instructor. There will also be a final exam. The break down of the final score of the course is:
Programming assignments & homeworks 50%
Final exam 25%
Final report 15%
Reading assignment
(includes presentation & questions)		 10%
Grading scheme. (The instructor also intends to curve raw scores at the end of the semester)
A 90% +
A- 88% - 89%
B+ 86% - 87%
B 80% - 85%
B- 78% - 79%
C+ 76% - 77%
C 70% - 75%
C- 60% - 69%
D/F   0% - 59%

Academic Integrity

Cheating and plagiarism will not be tolerated and will be treated severely whenever found. Unless an assignment explicitly states otherwise, all work submitted for credit must be the student's own and is subject to the provisions of the University of Kansas policies. Sharing your work or copying is cheating, and submitting a work that is not all yours is also considered cheating. Any cheating activities will result in an F for the course for all parties involved. Reports of such detected academic misconduct will also be made to your major department, school/college, and university, which oftentimes will result in more serious sanctions. Students should review the university policy on Academic Misconduct. "Academic integrity is a central value in higher education. It rests on two principles: first, that academic work is represented truthfully as to its source and its accuracy, and second, that academic results are obtained by fair and authorized means. Academic misconduct occurs when these values are not respected. Academic misconduct at KU is defined in the University Senate Rules and Regulations." -- KU Student Affairs
From Section 2.6.1 of the University Senate Rules and Regulations: "Academic misconduct by a student shall include, but not be limited to, disruption of classes; threatening an instructor or fellow student in an academic setting, giving or receiving of unauthorized aid on examinations or in the preparation of notebooks, themes, reports or other assignments; knowingly misrepresenting the source of any academic work; unauthorized change of grades; unauthorized use of University approvals or forging of signatures; falsification of research results, plagiarizing of another’s work; violation of regulations or ethical codes for the treatment of human and animal subjects; or otherwise acting dishonestly in research."

Citing Sources: If you use any code, such as a library or existing codebase, you must cite it. Not doing so is considered plagiarism and cheating.

Using EdTech Services: The use of EdTech services (e.g., Chegg.com) for posting or downloading material for the preparation and/or submission of exams, homework, lab reports, etc., constitutes academic misconduct, which is not tolerated in the School of Engineering at the University of Kansas. It violates Article 3r, Section 6 of its Rules & Regulations, and may lead to grades of F in the compromised course(s), a note on your transcript, dismissal from the School, or expulsion from the University of Kansas. When a person signs up to use EdTech services, the "terms of service" that are agreed to do not protect the person when an academic unit (e.g., KU School of Engineering) conducts investigations related to academic misconduct (e.g., plagiarism and/or cheating). These services retain contact and information (e.g., IP address, email, time of use) of subscribers and users, which is released upon request. If you are feeling unsure about an assignment, it is important to use the allowable resources available to you, such as instructor office hours, graduate teaching assistant, grader, and/or tutoring.

See Lecture 1 slides and video for more details on the collaboration policy. If you are in doubt, please ask.

Accommodations for Students with Disabilities

The University Academic Support Centers coordinates academic accommodations and services for all eligible KU students with disabilities. If you have a disability for which you wish to request accommodations and have not contacted the Student Access Center, please do so as soon as possible. They are located in 22 Strong Hall and can be reached at 785-864-4064 (V/TTY). More information can be found on the Student Access Center website. Please contact the instructor privately in regard to your needs in this course.

Expectation of Classroom Conduct

The instructor, Alexandru G. Bardas, considers this classroom to be a place where you will be treated with respect as a human being - regardless of gender, race, ethnicity, national origin, religious affiliation, sexual orientation, gender identity, political beliefs, age, or ability. Additionally, diversity of thought is appreciated and encouraged, provided you can agree to disagree. Activities within the University of Kansas community, including this course, are governed by the Code of Student Rights and Responsibilities.

Diversity and Inclusion. The University of Kansas supports an inclusive learning environment in which diversity and individual differences are understood, respected, and appreciated. We believe that all students benefit from training and experiences that will help them to learn, lead, and serve in an increasingly diverse society. All members of our campus community must accept the responsibility to demonstrate civility and respect for the dignity of others. Expressions or actions that disparage a person's or group's race, ethnicity, nationality, culture, gender, gender identity / expression, religion, sexual orientation, age, veteran status, or disability are contrary to the mission of the University. We expect that KU students, faculty, and staff will promote an atmosphere of respect for all members of our KU community. This is an inclusive classroom. At KU, administrators, faculty, and staff are committed to the creation and maintenance of "inclusive learning" spaces. These are classrooms, labs, and other places of learning where you will be treated with respect and dignity and where all individuals are provided equitable opportunity to participate, contribute, and succeed.

Public Health Considerations. To protect all of us, please follow the Protect KU webpage for the latest updates and directives.

Concealed Carry. Individuals who choose to carry concealed handguns are solely responsible to do so in a safe and secure manner in strict conformity with state and federal laws and KU weapons policy. Safety measures outlined in the KU weapons policy specify that a concealed handgun:

Non-Discrimination Statement

The University of Kansas prohibits discrimination on the basis of race, color, ethnicity, religion, sex, national origin, age, ancestry, disability, status as a veteran, sexual orientation, marital status, parental status, gender identity, gender expression, and genetic information in the University's programs and activities. Retaliation is also prohibited by University policy. If you have questions about filing a report of discrimination, contact the Office of Civil Rights and Title IX at civilrights@ku.edu.

Under Title IX of the Education Amendments of 1972, harassment based on sex, including sexual assault, stalking, domestic and dating violence, and harassment or discrimination based on the individual's sexual orientation, gender identity, gender expression, and pregnancy or related conditions, is prohibited. If a student would like to file a complaint for Title IX discrimination or has any questions, please contact KU’s Title IX Coordinator (Lauren Jones McKown, Associate Vice Chancellor for Civil Rights and Title IX, Dole Human Development Center, 1000 Sunnyside Ave, Suite 1082, Lawrence, KS 66045, civilrights@ku.edu, 785.864.6414) and/or U.S. Department of Education Office of Civil Rights, Kansas City Office, One Petticoat Lane, 1010 Walnut Street, Suite 320, Kansas City, MO 64106, OCR.KansasCity@ed.gov (1-816-268-0050).

Mandatory Reporter

The University of Kansas has decided that all employees, with few exceptions, are responsible employees or mandatory reporters who must report incidents of discrimination, harassment, and sexual violence that they learn of in their employment at KU to the Office of Civil Rights and Title IX. This includes faculty members. As such, if you share information about discrimination, harassment, or sexual violence with me, I will have to relay that information to the Office of Civil Rights and Title IX. I truly value your trust in me to share that information and I want to be upfront about my requirement as a mandatory reporter. If you are interested in contacting KU’s confidential resources (those who do not have to make disclosures to OCRTIX), there are: the Care Coordinator, Melissa Foree; CAPS therapists; Watkins Health Care Providers; and the Ombuds Office.

Notice of Copyright and Commercial Note-Taking

All lectures and course materials carry a copyright of several authors, including Xinming Ou and Alexandru G. Bardas. Some additional content is adapted from the BlackHat Exploit Laboratory (thanks to Saumil Shah and S.K. Chong for kindly permitting the use of those materials). Pursuant to the University of Kansas’ Policy on Commercial Note-Taking Ventures, commercial note-taking is not permitted in EECS 765 - Introduction to Cryptography and Computer Security (Fall 2022). Lecture notes and course materials may be taken for personal use, for the purpose of mastering the course material, and may not be sold to any person or entity in any form. Any student engaged in or contributing to the commercial exchange of notes or course materials (such as recorded lecture videos and slides) will be subject to discipline, including academic misconduct charges, in accordance with University policy. Please note: note-taking provided by a student volunteer for a student with a disability, as a reasonable accommodation under the ADA, is not the same as commercial note-taking and is not covered under this policy.

Acknowledgments

The course materials are adapted from a previous version of the course taught by Xinming (Simon) Ou together with Xiaolong (Daniel) Wang. Some additional materials are adapted from the BlackHat Exploit Laboratory (thanks to Saumil Shah and S.K. Chong who kindly permit the use of their materials).