Software Security

Course Objective

At the end of the course students will:

• have knowledge of the concept of vulnerability in design and system implementation of applications. (K&U)
• (by doing) deeply understand the concepts of memory corruption attacks (as exemplified by buffer overflows, use-after-free, etc) (K&U, AK&U, MJ)
• (by doing) deeply understand mitigations (such as control flow integrity, address space layout randomization, and shadow stacks) as well as some of their weaknesses (K&U, AK&U, MJ)
• have hands-on experience with basic and advanced exploitation and mitigation methods, including state-of-the-art research in systems security (K&U, AK&U, MJ)

The acronyms above refer to the Dublin Descriptors covered by each learning objective, specifically: Knowledge and Understanding (K&U), Applied Knowledge and Understanding (AK&U), Making Judgments (MJ), Learning Skills (LS), and Communication Skills (CS).

Course Content

This is a course on security with a focus on systems work. The course covers a wide spectrum of security issues. We explicitly focus on systems security rather than cryptography, as we want to show students how attackers penetrate systems and most security issues are not due to bad crypto.

Specifically, the course focuses on memory corruption and application security (buffer overflows, format string bugs, dangling pointers, shellcode, return-oriented programming, ASLR/DEP/canaries, control flow integrity), and state-of-the-art attacks and defenses (latest research insights).

Much of the course will be hands-on and challenge-based. In assignments, students will carry out and investigate attacks in a controlled environment. This involves programming at the lowest level (in assembly).

Additional Information Teaching Methods

Lectures (with voluntary attendance) and (mandatory) practical assignments.

Method of Assessment

Written exam (50%) and practical assignments (50%). The exam must be passed with a grade >= 5.5. Each of the practical assignments must be passed with a grade >= 4.0. The final assignment grade is the weighted average of the assignments' grades. Each assignment must be completed individually.

Please note that your grade will be registered as follows:

• For the first exam date: if you did not submit any assignments and did not participate in the exam, the result will be registered as no show (NS).
• For the second exam date: if you did not participate in the resit exam, the result will be registered as no show (NS).
• In all other cases, you will receive either a numeric grade or incomplete (NVD).
• If you did not meet the minimum grade requirements for the assignments and/or the exam, but your weighted average is >= 5.5, your grade is NVD.
• Otherwise, your final grade is your weighted average, rounded to half points except for 5.5.
• If you plan to drop the course, do not submit anything, as NVD is administratively considered a failing grade.

There is no resit opportunity for the practical assignments. Results for practical assignments and for the exam may be transferred from previous years if their contents did not change significantly since the result was obtained (as determined by the examiner). If you submit an assignment or participate in the exam, the new result replaces any transferred results.

We ensure that each student individually demonstrates their abilities through the requirement that the supervised exam be passed with at least 5.5 and through active plagiarism detection for the assignments.

Literature

Additional Information Target Audience

Master Computer Security (year 1)
Master Computer Science

Additional Information

Use of AI: Level 2b Use of generative AI is permitted in a limited way, with disclosure

In this course, generative AI (GenAI), such as ChatGPT or similar tools, may be used in a limited way, for example for editorial support, rephrasing, or structure. Substantive contributions from GenAI may only be used within the limits set by the lecturer. Any use of GenAI must always be explicitly disclosed, in accordance with the lecturer's instructions. The student remains fully responsible for the content, quality, and accuracy of the submitted work. Incorrect use of GenAI is considered fraud. If established, the submitted work or assessment result will be declared invalid, and the Examination Board may impose further measures.

Recommended background knowledge

No formal requirements, except a keen interest and sufficient time.
Programming experience in C is essential. Knowledge of assembly and computer architecture helps too.