CS 161 : Computer Security

Spring 2019

Lectures:

Tu/Th 12:30 - 2:00 PM, 155 Dwinelle (webcast)

Addresses:

Web page: https://inst.eecs.berkeley.edu/~cs161/
Announcements, questions: the class Piazza site, which you sign up for here.
Feel free to mark your question as private if you don't want other students to see it.

Midterms & Final:

There will be two midterms in the evening.
  • MT1: Feb 21, 7pm - 9pm.
  • MT2: Apr 9, 8pm - 10pm.
  • Final: May 16, 3pm - 6pm.

DSP and other accommodation contact:

Please send a private post on Piazza.

Lectures:

The lecture schedule is subject to change and will be revised as the course progresses.

Date Topic Readings Slides
Tue 1/22 Introduction [optional: G&T § 1.1, Craft § 1-1.1, 1.3] Lecture Slides
Thu 1/24 Security Principles Notes on Principles for Building Secure Systems.
Notes on Design Patterns for Building Secure Systems.
[G&T § 1.1.4, 3.4.6]
Lecture Slides
Tue 1/29 Overflows, Injection,
and Memory Safety
Notes on Memory Safety.
[G&T § 3.4, Craft § 6.1-6.3]
Smashing The Stack For Fun And Profit, by Aleph One
Lecture Slides
Thu 1/31 Software Security: Defenses Notes on Reasoning About Code and Secure Software Development.
[G&T § 9.4-9.5; Craft § 6.5-6.7]
Eevee's guide for Testing for People Who Hate Testing
Lecture Slides
Tue 2/5 IND-CPA, OTP and Block ciphers Notes.
[G&T § 8.1.0-8.1.3, 8.1.6-8.1.7; Craft § 7.1, 7.3.2 - 7.3.3]
Lecture Slides
Thu 2/7 Symmetric key encryption Notes.
[G&T § 8.1.0-8.1.3, 8.1.6-8.1.7; Craft § 7.1, 7.3.2 - 7.3.3]
Lecture Slides
Tue 2/12 Public Key Exchange Notes.
[G&T § 1.3-1.3.1, 1.3.3, 8.2, 8.5.2; Craft § 7.5]
Lecture Slides
Thu 2/14 Public Key Encryption, Hashing Notes, section 2.
[G&T § 1.3-1.3.1, 1.3.3, 8.2, 8.5.2]
Lecture Slides
Tue 2/19 Integrity and Authentication Notes.
[G&T § 1.3.2, 1.3.4, 8.2.3, 8.3, 8.4.1, 8.4.3; Craft § 7.4.2]
Lecture Slides
Thu 2/21 CryptoFails Notes.
[G&T § 1.3.2, 1.3.4, 8.2.3, 8.3, 8.4.1, 8.4.3; Craft § 7.4.2]
Risks of Cryptocurrencies
Lecture Slides ENIGMA slides (with notes)
Tue 2/26 Network security: Background Networking terminology quick-reference.
[G&T § 5.1-5.1.2, 5.3-5.3.1, 5.4-5.4.2, 6.1-6.1.2, 7.1-7.1.1; Craft § 5.1, 5.4.1]
Slides
Thu 2/28 Network Attacks: Lower Layers [G&T § 5.1.3, 5.2.3, 5.3.3-5.3.4, 5.4.4; Craft § 5.3.1] Slides
Tue 3/5 Network Attacks: DNS & TCP G&T § 6.1.3 (pp. 278-284)
Reliable DNS Forgery in 2008: Kaminsky's Discovery
An Illustrated Guide to the Kaminsky DNS Vulnerability
Slides, Webcast with Audio
Thu 3/7 Network: TCP and TLS G&T § 1.1.1, 7.1.2, 8.3 Slides
Tue 3/12 Denial of Service, Firewalls [G&T § 5-5.4]
Mitigating Multiple DDoS Attack Vectors [G&T § 4.4, 6.1.4]
The WoSign Saga
Slides
Thu 3/14 DNSSEC Notes on Firewalls.
[G&T § 6.2, 6.3 intro, 6.3.3; Craft § 5.3.2]
Slides
Tue 3/19 Intro to web security, Same-origin policy [G&T § 7.1.1, 7.1.3-7.1.4, 7.3.1-7.3.2, 7.3.4, 7.3.6; Craft § 12.1.1, 12.1.2, 12.1.3]
Web Security: Are You Part Of The Problem?
Slides
Thu 3/21 SQL Injection SQL Injection Attacks by Example
XSS (Cross Site Scripting) Prevention Cheat Sheet
Slides
Tue 4/2 XSS and Cookies Secure Session Management With Cookies for Web Applications Slides
Thu 4/4 CSRF and Session Management [G&T § 7.1.4, 7.2.1, 7.2.7, Craft § 12.1.4]
Slides
Tue 4/9 Phishing and UI-Based Attacks Slides
Thu 4/11 Bitcoin Bitcoin: A Peer-to-Peer Electronic Cash System Slides
Tue 4/16 Network Monitoring [G&T § 6.4] Slides
Thu 4/18 Abusing Network Monitoring [G&T § 6.4] Slides
Tue 4/23 Malcode and Reflections on Trusting Trust [G&T § 6.4][G&T § 4.2, 4.5], A Taxonomy of Computer Worms. Optional but cool: Outwitting the Witty Worm. Reflections on Trusting Trust. Slides
Thu 4/25 Tor, 737-Max, and Nukes How the 737-Max Crash Looks to a Software Developer Slides
Tue 4/30 Certificate Transparency Certificate Transparency
Merkle Trees
Slides
Thu 5/2 Conclusions Slides
Tue 5/7 RRR Week
Thu 5/9 RRR Week
Thu 5/16 Final Exam 3-6pm

An overall Google Calendar for the class, including office hours, exams, etc (will be populated over the course of the class):


Staff

Raluca Ada Popa Nicholas Weaver


Keyhan Vakil Weikeng Chen
Arvind Iyengar Austin Murdock Grant Ho
Harley Patton Nathan Malkin Pratyush Mishra
Rafael Dutra Rishabh Poddar Ruta Jawale
Ruta Joshi Seung Jin Yang Spencer Mccall
Victor Chan

Office hours:

Time Room TA
Mo 11:00 AM - 12:00 PM Soda 329 Nick Weaver (conceptual/lecture questions)
Mo 12:00 - 1:00 PM Soda 611 Victor
Mo 1:00 - 2:00 PM Soda 611 Grant
Mo 1:00 - 2:00 PM Soda 329 Nick Weaver (conceptual/lecture questions)
Mo 3:00 - 5:00 PM Soda 341A Austin
Tu 9:00 - 10:00 AM Soda 341A Seung Jin
Tu 10:00 - 11:00 AM Soda 341A Pratyush
Tu 2:00 - 3:00 PM Soda 729 Raluca Ada Popa (conceptual/lecture questions)
Tu 4:00 - 5:00 PM Soda 611 Rishabh
We 10:00 - 11:00 AM Soda 341A Ruta Jawale
We 11:00 AM - 12:00 PM Soda 341A Spencer
Th 2:00 - 3:00 PM Soda 611 Arvind
Th 3:00 - 4:00 PM Soda 611 Harley
Th 4:00 - 5:00 PM Soda 611 Weikeng
Th 5:00 - 6:00 PM Soda 611 Arvind
Fr 10:00 AM - 12:00 PM Soda 341A Ruta Joshi
Fr 12:00 - 2:00 PM Soda 341A Keyhan
Fr 2:00 - 3:00 PM Soda 611 Victor
Fr 3:00 - 4:00 PM Soda 611 Rafael
Fr 4:00 - 5:00 PM Soda 611 Harley


Discussion Section Handouts:

  1. x86, GDB and Security Principles: worksheet; solutions
  2. Software Security: worksheet; solutions
  3. Cryptography I: worksheet; solutions
  4. Cryptography II: worksheet; solutions
  5. Cryptography III: worksheet; solutions
  6. Network Security I: worksheet; solutions
  7. Network Security II: worksheet; solutions
  8. Network Security III: worksheet; solutions
  9. Web Security I: worksheet; solutions
  10. Web Security II: worksheet; solutions
  11. Web Security III: worksheet; solutions
  12. Intrusion Detection: worksheet; solutions

Discussion Section Times:

Section Time Room TA
101 Tu 3:00 - 4:00 PM Soda 405 Austin
103 Tu 4:00 - 5:00 PM Hildebrand B51 Seung Jin
105 Tu 4:00 - 5:00 PM Etcheverry 3105 Austin
102 We 9:00 - 10:00 AM Hildebrand B56 Victor
114 We 10:00 - 11:00 AM Soda 320 Grant
115 We 12:00 - 1:00 PM VLSB 2066 Keyhan
118 We 1:00 - 2:00 PM Soda 320 Ruta Joshi
106 We 2:00 - 3:00 PM LeConte 385 Harley
107 We 2:00 - 3:00 PM Etcheverry 3119 Ruta Joshi
108 We 3:00 - 4:00 PM Dwinelle 242 Rafael
109 We 3:00 - 4:00 PM Dwinelle 243 Pratyush
110 We 4:00 - 5:00 PM LeConte 385 Arvind
111 We 4:00 - 5:00 PM Evans 70 Spencer
112 We 5:00 - 6:00 PM LeConte 385 Arvind
113 We 5:00 - 6:00 PM Evans 70 Victor
120 Th 10:00 - 11:00 AM Soda 405 Weikeng
117 Th 11:00 AM - 12:00 PM Mulford 240 Ruta Jawale
119 Th 11:00 AM - 12:00 PM GPB 107 Rishabh

Homeworks:

Homeworks will be submitted electronically via Gradescope. Homework solutions must be legible; we may mark off for difficult-to-read solutions, or even refrain from grading them entirely.
No late homeworks accepted.
Please use Adobe Reader (link) to complete the fillable PDF form. For Linux users, let us try Foxit PDF Reader (link) and print the finished PDF out as a PDF for submission to Gradescope.

Schedule for homeworks:

Homeworks are different from prior semesters'. If you previously take a look at the prior semesters' questions, note that they might already be changed.


Projects

There will be three course projects. We will penalize late project submissions as follows: less than 24 hours late, you lose 10%; less than 48 hours late, you lose 20%; less than 72 hours late, you lose 40%; at or after 72 hours, late submissions no longer accepted. (There are no "slip days".)

WARNING: some projects are exceptions to previously discussed late policy. Please check below/look at Piazza for specific project information.

Note that this late policy applies only to projects, not homeworks (homeworks cannot be turned in late).

Schedule for projects:


Exams

There will be two midterms and one final exam.

All exams are mandatory. If you will be unable to attend any of the dates, you must contact the instructor during the first week after the times are finalized.

  • MT1: Feb 21, 7pm - 9pm.
  • MT2: Apr 9, 8pm - 10pm.
  • Final: May 16, 3pm - 6pm.
For those who are taking a class which has a final at the same time, we will have an alternate final slot immediately afterwards.

Grading

We will compute grades from a weighted average, as follows:
Homeworks: 16% (equally weighted)
Projects: 24% (equally weighted)
Midterms: 30% (50.0% MT1, 50.0% MT2)
Final exam: 30%


Course Policies

Contact Information
Announcements
Prerequisites
Collaboration
Ethics
Computer accounts
Textbook
Lecture notes
Discussion sections
Re-grading policies
Late homework policy
Advice

Contact information

If you have a question, the best way to contact us is via the class Piazza site. The staff (instructors and TAs) will check the site regularly, and if you use it, other students will be able to help you too. Please avoid posting answers or hints for either homeworks or projects before the assignment is due.

If your question is personal or not of interest to other students, we encourage you to mark the question as private on Piazza: select "Post to: Individual Student(s)/Instructor(s)" at the top and then type "Instructors" in the field underneath it. If you wish to talk with one of us individually in person, you are welcome to come to any of our office hours. We prefer using these methods instead of sending email; regrettably, email does not scale well to a class of this size.

Announcements

The instructors and TAs will periodically post announcements, clarifications, etc. to the Piazza site. It is important that you check it regularly throughout the semester.

Prerequisites

The prerequisites for CS 161 are CS 61B, CS61C, and CS70. We assume basic knowledge of Java, C, and Python. You will need to have a basic familiarity using Unix systems.

Collaboration

Homeworks may be done on your own or may be done in groups. Either way, you must write up your solutions entirely on your own. As a general rule of thumb, you should never possess solutions to exact homework questions other than solutions you have written yourself. For homeworks, you must never read, see, or copy the solutions of other students, and you must not allow other students to see your solutions. For projects, you must never read, see, or copy the code or solutions of other students (other than your project partner, for group projects), nor allow students other than your partner to see your solutions or code.

We believe that most students can distinguish between helping other students understand course material and cheating. Explaining a subtle point from lecture or discussing course topics is an interaction that we encourage, but you should never read another student's assignment solution or partial solution, nor have it in your possession (other than for project partners). You must never share your written solutions, or partial solutions, with another student. You must write your homework solution strictly by yourself. You must not ask for homework/project solutions on Stack Overflow or other online sites; you may ask for help with conceptual questions, but you must credit your sources. You must not receive help on assignments from students who have taken the course in previous years, and you must not review homework or project solutions from previous years.

You must ensure that your solutions will not be visible to other students. If you use GitHub or another source control system to store your solutions electronically, you must ensure your account is configured so your solutions are not publicly visible. If you use GitHub, GitHub offers free private repositories that allow you to keep your solutions private; please use one.

Warning: Your attention is drawn to the Department's Policy on Academic Dishonesty. In particular, you should be aware that copying or sharing solutions, in whole or in part, from other students in the class or any other source without acknowledgment constitutes cheating. Any student found to be cheating will (1) be referred to the Office of Student Conduct, (2) receive negative points on the assignment (i.e., worse than not doing it at all), and, depending on severity, (3) fail the course. Nick in particular is noted for having a sense of vengeance.

Ethics

We will be discussing attacks in this class, some of them quite nasty. None of this is in any way an invitation to undertake these attacks in any fashion other than with informed consent of all involved and affected parties. The existence of a security hole is no excuse. These issues concern not only professional ethics, but also UCB policy and state and federal law. If there is any question in your mind about what conduct is allowable, contact the instructors first.

Computer accounts

We will use 'class' accounts this semester. Get your account here. When you first log in to your account, you will be prompted to enter information about yourself; that will register you with our grading software. If you want to check that you are registered correctly with our grading software, you can run check-register at any time. A list of available Instructional "login servers" that can be sshed into can be found here.

Textbook

The class does not have a required textbook. We have not found one that fully treats the material covered in the course, and we want to help you save money, so please don't feel obligated to buy a textbook. However, we know that some students appreciate additional reading to supplement lectures; for them, we recommend Introduction to Computer Security by Goodrich & Tamassia. We also recommend The Craft of System Security by Smith & Marchesini. We will list readings from these textbooks in the syllabus, but these are entirely optional.

Lecture notes

We will provide lecture notes and/or slides for many of the lectures. These materials are not a substitute for attending class, as our discussion in class may deviate from the written material. You are ultimately responsible for material as presented in both lecture and section.

We will be webcasting the class.

Discussion sections

Discussion sections will sometimes cover important material not presented in lecture, and we expect you will attend. Outside of your discussion section, you should feel free to attend any of the staff office hours (not just your section TA's office hours) and ask any of us for help. You can attend any discussion section you want, but if it is too crowded, try a different one: lets load balance by randomization.

Re-grading policies

Any requests for grade changes or re-grading must be made within one week of when the work was returned. To ask for a re-grade for material graded on Gradescope, submit a regrade request on Gradescope. We will provide procedures to request re-grades for other coursework when those are graded. We will not accept verbal re-grade requests. Note that a re-grade can result in a decreased score as well as an increased score, if upon revisiting we discover problems in your work that we previously overlooked.

Bear in mind that a primary aim in grading is consistency, so that all students are treated the same. For this reason, we are unlikely to adjust the score of individual students on an issue of partial credit if the score allocated is consistent with the grading policy we adopted for that problem.

More on homeworks: If a problem can be interpreted in more than one way, clearly state the assumptions under which you solve the problem. In writing up your homework you are allowed to consult any book, paper, or published material, except solutions from previous classes or elsewhere, as stated under the Collaboration section. If you consult external sources, you must cite your source(s). We will make model solutions available after the due date, and feedback will be available via glookup or Gradescope.

Late homework policy

We will give no credit for homework turned in after the deadline. Please don't ask for extensions. We don't mean to be harsh, but we prefer to make model solutions available shortly after the due date, which makes it impossible to accept late homeworks.

Don't be afraid to ask for help! Are you struggling? We'd much rather you approached us for help than gradually fall behind over the semester until things become untenable. Sometimes this happens when students fear a possibly unpleasant conversation with a professor if they admit to not understanding something. We would much rather resolve/remedy your misunderstanding early than have it expand into further problems later. Even if you are convinced that you are the only person in the class that doesn't understand the material, and think it must be entirely your fault for falling behind, please overcome this concern and ask for help as soon as you need it. Helping you learn the material is what we're here to do, after all!

Likewise, if you are a DSP student, please get your letters in now.

Advice

The following tips are offered based on our experience with CS 161:

1. Don't wait until the last minute to start projects! The projects can be time-consuming. Pace yourself. Students who procrastinate generally suffer.

2. Make use of office hours! The instructors and TAs hold office hours expressly to help you. It is often surprising how many students do not take advantage of this service. You are free to attend as many office hours as you wish. You are not constrained just to use the office hours of your section TA. You will likely get more out of an office hour visit if you have spent some time in advance thinking about the questions you have, and formulating them precisely. (In fact, this process can often lead you to a solution yourself!)

3. Participate actively in discussion sections! Discussion sections are not auxiliary lectures. They are an opportunity for interactive learning. The success of a discussion section depends largely on the willingness of students to participate actively in it. As with office hours, the better prepared you are for the discussion, the more you are likely to get out of it.