Home

Course description

Lecture notes

Assignments

Reference

CS 378 - Network Security and Privacy (56721)

Fall 2007

Reference materials

• Network Security (2nd edition) by Kaufman, Perlman, and Speciner
• Security Engineering by Anderson
• The Shellcoder's Handbook by Koziol et al.
• The Art of Intrusion by Mitnick and Simon
• Network Security Essentials (3rd edition) by Stallings

• Reflections on Trusting Trust (Ken Thompson's Turing Award lecture)
• Why Cryptosystems Fail by Anderson
• Secure Programming for Unix and Linux HOWTO by Wheeler
• SANS Top-20 Internet Security Attack Targets
• Improving the Security of Your Site by Breaking Into It by Farmer and Venema
• Prudent Engineering Practice for Cryptographic Protocols by Abadi and Needham

Buffer overflow

• Smashing The Stack for Fun and Profit by Aleph One
• Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns by Pincus and Baker
• Blended Attacks Exploits, Vulnerabilities and Buffer-Overflow Techniques in Computer Viruses by Chien and Ször
• Exploiting Format String Vulnerabilities by scut / team teso
• The Tao of Windows Buffer Overflow as taught by DilDog
• Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade by Cowan et al.
• Bypassing StackGuard and StackShield by Bulba and Kil3r

• Dos and Don'ts of Client Authentication on the Web by Fu, Sit, Smith, and Feamster
• Cross Site Scripting Explained by Klein
• Advanced SQL Injection in SQL Server Applications by Anley
• XSS (Cross Site Scripting) Cheat Sheet by RSnake
• MySpace Worm
• Protecting Browser State from Web Privacy Attacks by Jackson, Bortz, Boneh, and Mitchell

• Online Identity Theft: Phishing Technology, Chokepoints and Countermeasures by Emigh
• Drive-By Pharming by Stamm, Ramzan, and Jakobsson
• Social Phishing by Jagatic, Johnson, Jakobsson, and Menczer
• A Usability Study and Critique of Two Password Managers by Chiasson, van Oorschot, and Biddle

• Fooling the Finger Scanner (video)
• Impact of Artificial "Gummy" Fingers on Fingerprint Systems by Matsumoto, Matsumoto, Yamada, and Hoshino
• Graphical Passwords: A Survey by Suo, Zhu, and Owen
• Inkblot Authentication by Stubblefield and Simon
• On User Choice in Graphical Password Schemes by Davis, Monrose, and Reiter

• Designing an Authentication System: a Dialogue in Four Scenes by Bryant
• Limitations of the Kerberos Authentication System by Bellovin and Merritt

• A Taxonomy of Computer Worms by Weaver, Paxson, Staniford, and Cunningham
• The Worm FAQ by Staniford
• Slammed! An Inside View of the Worm That Crashed the Internet in 15 Minutes by Boutin
• A Multi-perspective Analysis of the Storm (Peacomm) Worm by Porras, Saidi, and Yegneswaran
• Search Worms by Provos, McClain, and Wang
• Myfip Intellectual Property Theft Worm Analysis by Stewart
• Outwitting the Witty Worm by Kumar, Paxson, and Weaver
• A Crawler-based Study of Spyware on the Web by Moshchuk, Bragin, Gribble, and Levy
• Malware Prevalence in the KaZaA File-Sharing Network by Shin, Jung, and Balakrishnan
• Hunting for Metamorphic by Ször and Ferrie
• How to 0wn the Internet in Your Spare Time by Staniford, Paxson, and Weaver

• Firewall Gateways by Cheswick and Bellovin
• Snort
• Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection by Ptacek and Newsham

• TCP/IP Security (survey) by Chambers, Dolske, and Iyer
• Security Problems in the TCP/IP Protocol Suite by Bellovin
• A Look Back at "Security Problems in the TCP/IP Protocol Suite" by Bellovin
• IP Spoofing Demystified by daemon9
• SYN cookies by Bernstein
• A Simple Active Attack against TCP by Joncheray

• An Inside Look at Botnets by Barford and Yegneswaran
• A Multifaceted Approach to Understanding the Botnet Phenomenon by Abu Rajab, Zarfoss, Monrose, and Terzis
• Know Your Enemy: Tracking Botnets by Bacher, Holz, Kotter, and Wicherski
• Understanding the Network-Level Behavior of Spammers by Ramachandran and Feamster

• DDoS Mitigation Techniques (online library)
• trinoo, Tribe Flood Network, and stacheldraht DDoS Attack Tools
• True DDoS extortion story by Berinato
• Network Support for IP Traceback by Savage, Wetherall, Karlin, and Anderson

• (In)Security of the WEP algorithm (overview)
  • Intercepting Mobile Communications: The Insecurity of 802.11 by Borisov, Goldberg, and Wagner
  • Your 802.11 Wireless Network Has No Clothes by Arbaugh, Shankar, and Wan
• Using the Fluhrer, Mantin, and Shamir Attack to Break WEP by Stubblefield, Ioannidis, and Rubin
• Survey of GSM security by Pesonen

• Anonymity bibliography from the Free Haven project
• Deployed anonymity systems:
  • TOR: Anonymizing Internet communication system
  • Mixminion: Type III anonymous remailer
• Cypherpunks

• RFID Privacy and Security (RSA Labs)
• RFID Privacy Workshop: Concerns, Consensus, and Questions
• Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems by Weis, Sarma, Rivest, and Engels
• Authenticating Pervasive Devices with Human Protocols by Juels and Weis
• The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy by Juels, Rivest, and Szydlo