Lectures - 18-335 / 18-732

(Note this is a rough schedule and things are subject to change.)

Jan 19, 2022 Intro: Introduction and Course Overview
This lecture will give a high-level overview of the course, including topics covered, learning goals, and course mechanics.
Jan 21, 2022 : No Recitation
No recitation
Jan 24, 2022 Intro: Crypto Refresher and Secure Cryptographic Coding
Jan 26, 2022 Intro: Attacks
Reminders and generalizations
| Reading:
- Computer Security and the Internet: Tools and Jewels: Ch. 9 (Portions on HTTP proxies, as well as 9.8 onwards, are optional)
- Buffer Overflows: Attacks And Defenses For The Vulnerability Of The Decade.
- Basic Integer Overflows
- Exploiting Format String Vulnerabilities
| Optional Reading:
- SoK: Eternal War In Memory
- Dynaguard: Armoring Canary-Based Protections Against Brute-Force Attacks
- Hacking Blind
- Smashing The Stack For Fun And Profit
- Low-Level Software Security: Attacks And Defenses
Jan 28, 2022 Recitation: Build It; Break It; Fix It -- Overview and Introductions
We will discuss the details of the first homework assignment. There will also be time for homework groups to meet and make plans for the assignment. Time permitting, there will be general Q&A about the weeks' topics.
Jan 31, 2022 Run-Time: Dynamic Taint Tracking

| Reading:
- All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)
| Optional Reading:
- Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software
- TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones
Feb 2, 2022 Run-Time: Control-Flow Integrity (CFI)

| Reading:
- Control-flow integrity principles, implementations, and applications.
Feb 4, 2022 Recitation: Open Q&A
Please bring any questions you have about this week's lectures.
Feb 7, 2022 Run-Time: Enforceable Properties

| Reading:
- Enforceable security policies
| Optional Reading:
- Edit Automata: Enforcement Mechanisms for Run-time Security Policies
Feb 9, 2022 Run-Time: Enforceable Properties (Continued)
Feb 11, 2022 Recitation: Open Q&A
Please bring any questions you have about this week's lectures.
Feb 14, 2022 Code Analysis: Fuzzing

| Optional Reading:
- Scheduling black-box mutational fuzzing
- Skyfire: data-driven seed generation for fuzzing
Feb 16, 2022 Code Analysis: Static Analysis

| Reading:
- Buffer overrun detection using linear programming and static analysis
- Checking system rules using system-specific, programmer-written compiler extensions
| Optional Reading:
- A few billion lines of code later: using static analysis to find bugs in the real world
Feb 18, 2022 Recitation: Open Q&A
Please bring any questions you have about this week's lectures.
Feb 21, 2022 Code Analysis: Symbolic Execution

| Reading:
- Dart: directed automated random testing
- All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)
| Optional Reading:
- EXE: Automatically generating inputs of death
Feb 23, 2022 Code Analysis: Model Checking

| Reading:
- A tool for checking ANSI-C programs
| Optional Reading:
- Design, implementation and verification of an extensible and modular hypervisor framework
Feb 25, 2022 Review: Exam 1 review
This will be a review session. Please think ahead of time what questions you may have.
Feb 28, 2022 Exam: 1
We will have the first exam of the course. This will be a closed book, closed notes, closed neighbor exam.
Mar 2, 2022 Architecture: Separation Mechanisms

| Reading:
- The protection of information in computer systems
| Optional Reading:
- Efficient software-based fault isolation
- A virtual machine introspection based architecture for intrusion detection.
Mar 4, 2022 : No Recitation
Mid-Semester Break
Mar 7, 2022 : No Class
Mid-Semester Break
Mar 9, 2022 : No Class
Mid-Semester Break
Mar 11, 2022 : No Recitation
Mid-Semester Break
Mar 14, 2022 Architecture: Separation Challenges

| Reading:
- A note on the confinement problem
Mar 16, 2022 Architecture: Separation Policies

| Reading:
- User-driven access control: Rethinking permission granting in modern operating systems
| Optional Reading:
- Run-time enforcement of information-flow properties on Android (extended abstract)
- SoK: Lessons learned from android security research for appified software platforms
Mar 18, 2022 Recitation: Open Q&A
Please bring any questions you have about this week's lectures.
Mar 21, 2022 Architecture: Trusted Computing

| Reading:
- Bootstrapping trust in commodity computers
- Design and implementation of a tcg-based integrity measurement architecture.
- Flicker: an execution infrastructure for tcb minimization
| Optional Reading:
- Trustvisor: efficient TCB reduction and attestation
Mar 23, 2022 Languages: Programmer Assisted Verification - Part 1

| Reading:
- Program proofs - Ch 1, Ch 2 (skipping 2.3.4 and 2.7-2.12), Ch 11, 13.0, 13.1
Mar 25, 2022 Review: Exam 2 review
This will be a review session. Please think ahead of time what questions you may have.
Mar 28, 2022 Exam: 2
We will have the second exam of the course. This will be a closed book, closed notes, closed neighbor exam.
Mar 30, 2022 Languages: Programmer Assisted Verification - Part 2

| Reading:
- Program Proofs: Ch 4 (skipping 4.3, 4.5) and Ch 5.1-5.2,5.4,5.7,5.8
Apr 1, 2022 Recitation: Dafny Practice
We will work through a variety of Dafny problems to help you prepare for the last two homework assignments.
Apr 4, 2022 Languages: Type Systems
Apr 6, 2022 Languages: Type Systems (continued) and Non-Interference

| Reading:
- Mathematical models of computer security
- A sound type system for secure flow analysis
- Certification of programs for secure information flow
Apr 8, 2022 : No Recitation
Spring Carnival
Apr 11, 2022 Languages: Non-Interference (continued)
Apr 13, 2022 Languages: Typed Assembly Language

| Reading:
- Talx86: a realistic typed assembly language
Apr 15, 2022 Recitation: Open Q&A
Please bring any questions you have about this week's lectures.
Apr 18, 2022 Languages: WebAssembly

| Reading:
- Bringing the web up to speed with WebAssembly
| Optional Reading:
- Mechanising and verifying the webassembly specification
Apr 20, 2022 : Usability
Apr 25, 2022 Review: Exam 3 review
This will be a review session. Please think ahead of time what questions you may have.
Apr 27, 2022 Exam: 3
We will have the third exam of the course. This will be a closed book, closed notes, closed neighbor exam.
Apr 29, 2022 : No Recitation
No recitation