CE6107
The Attack and Defense of Computers

1. Syllabus and Malware: Logic Bombs, Key Logger, Dialer, URL Injection, Trojan Horses, and Spyware. (18th Sep.)
2. There will be no class this week. (25th Sep.)
3. Internet Worms, Buffer Overflow Attacks, and Heap Overflow Attacks (2nd Oct.)
4. Return-into-libc attacks and BOA Countermeasures and Botnet(9th Oct.)
5. Disk Layout, BIOS, and Viruses (16th Oct.)
6. Macro Viruses and Boot Record Viruses (23rd Oct.)
7. Backdoors, sniffer, and Rootkits for Linux/Unix (30nd Oct.)
8. Rootkits for Linux/Unix (6th Nov.)
9. Midterm
   • Date: 2:00PM ~ 5:00PM, 13th Nov., 2008
   • Location: The same place as the class's
   • The exam. questions will be given in the essay-question form.
   • Close book exam.
10. Rootkits for Windows - Injection Mechanism (20th. Nov.)
11. Rootkits for Windows - Interception Mechanism and Magic Cookies and Web Bugs (27th Nov.)
12. HTTP cookies (4th Dec.)
13. Cross-Site Scripting (XSS) and SQL Injection (11th Dec.)
14. SQL Injection and Account Stealing(18th Dec.)
15. Account Stealing, TCP Session Hijacking (25th Dec.)
16. Happy New Year!
17. ARP Spoofing and Format String Attacks, and DoS/DDoS Attacks (8th Jan.)
18. Final Exam.
    • Date: 2:00PM ~ 5:00PM, 15th Jan., 2009
    • Location: The same place as the class's
    • The exam. questions will be given in the essay-question form.
    • Close book exam.
19. supplementary material, not covered in the final exam.
    • Idle Scan, OS Fingerprinting, Footprinting, and Port Scanning. .
    • DNS Servers and DNS Server Attacks
    • Whois Server

Grade

• Midterm (posted: 28th Nov.)
  • Midterm Grade
  • Midterm Grade after the Makeup
  • If you have any questions about your midterm grade or if you wish to see your answer sheets, contact the TAs directly.
  • The TAs' office is at Room A303-1.
• Project 1(posted: 5th Jan. 2009)
  • Project 1 Grade
  • If you have any questions regarding to your project 1 grade, you can contact the TAs directly to check it.
• Final Grade (posted: 22nd Jan. 2009)
  • Final Grade
    • If you have any questions regarding to your final grade, come to my office before 4:30PM 22nd Jan. 2009.
    • Happy Chinese New Year!

Project

• Lab VmWare User Guide
• Lab Location: Room A208, Engineering Building 5.
• Group List and Host Allocation Map (posted 10th Nov.)
• Project 1 (posted: 24th Nov.)
  • 張維韓-How to Turn off the Non-executable Stack Option in Ubuntu
• Project 2 (posted: 27th Dec.)
• 問卷調查 (posted: 14th Jan. 2009)
  • 由於之前設計的問卷調查網頁有有缺失，我們需要您重新填寫問卷，對此造成的不便深感歉意。
  • 進行問卷調查前請先閱讀此說明文件。
  • 為感謝你的協助，順利完成問卷調查者，將會獲得本科3分的總分加分。
  • 新的問卷調查網頁允許你檢查你目前的問卷填寫結果，或重新填寫問卷。
  • 如果你在之前就填寫過本問卷的部分問題，則由於我們的資料庫中已有該問題的答案，因此再次填寫問卷時，僅會顯示出該問題，而不會要求你填寫新的答案。但如果你之前問卷的填寫沒有成功則再次填寫時，就會要求你填寫新的答案。
  • 為避免受訪者胡亂做答，部份問題會重複，回答不一致的受訪者或是所有問題回答同一答案者的結果 將不會被採納記錄，因此我們將因得不到您的資料，無法幫您加分。
  • 問卷調查進行前，需先註冊，註冊時請用你的學號做為「帳號」。
  • 請於一月十八日前完成問卷。

Announcement

• Black Board System (posted: 11th Sep.)
  • Press the ``User Login'' button on the left side of your screen to enter into the login screen.
  • Enter your Login Name and Password to login the system.
  • After loggining into the system, choose the ``0971CE6107_電腦攻擊與防禦'' item from the ``My Course'' block on the right side of your screen to select the course that you plan to work on.
  • After switching to the new page, choose the "Discussion Area" item on the left hand side of your screen to enter into the forum area.
  • From the middle bottom of your screen choose the Fourm you want to use.
  • Forum Name: ``Security Course Discussion Forum''
• Bonus Question:
  • Bonus Question 1: (20 points) (posted: 11th Sep.)
    Find a way to bypass the protection of ASLR. In other words, find an effective method to launch a buffer overflow attack against a program protected by ASLR. ( ASLR-related Papers and its drawbacks)
    
  • Bonus Question 2: (25 points) (posted 19th Nov.)
    FInd a solution to detect/block backdoors inside 3rd party source code.
  • Due Day: The 3rd day after the final exam.
    Submission: Send your answers to me by an e-mail. Don't forget to put your name and student ID in the mail.
• Project Teammate (posted: 31st Oct.):
  • The member number of each security project team is 4 persons.
  • Please choose your teammates ASAP and send the list of your teammates to the TAs, so that you can have your computer earlier.
  • In your mail, don't forget to put your names and student IDs.
• Roll Call (posted: 31st Oct.)
  • On 6th Nov.'s class, I will give a roll call to make sure each of you has already found your teammates.
  • For those who still could not find their teammates after 6th Nov.'s class, the TAs will assign your teammates for you.
  • The final team member list will be posted on the web site soon.
• Midterm (posted 9th Nov.)
  • There are 14 questions in the midterm.
  • Except one question whose score is 9 points, the score of every other question is 7 points.
  • The midterm questions cover the materials taught before(include) 6th Nov.'s class, but not include ``rootkit.''
• Project 1 has already be posted on this web site. (24th Dec.)
• The midterm grade was posted on this page. (28th Nov.)
• Make-up Exam: (posted: 9th Dec.)
  • examinee: For those who didn't pass the midterm exam.
    • undergraduate student: below 60 points
    • graduate student: below 70 points
  • Time: 5:00PM 18th Dec. 2008.
  • Location: as the class's location
  • Grading Criteria:
    • undergraduate student: If the score of your make-up exam is higher than 80, your midterm exam score will be adjusted to 60 points. Otherwise, we don't adjust your midterm exam score.
    • graduate student: If the score of your make-up exam is higher than 90, your midterm exam score will be adjusted to 70 points. Otherwise, we don't adjust your midterm exam score.
  • Coverage of the make-up exam:
    • 3 questions from the midterm exam.
• Project 2 has already be posted on this web site. (26th Dec.)
• Project 1 grade has been posted on this web page. (5th Jan. 2009)
• Final Grade (posted: 6th Jan. 2009)
  • The temporary time to post the final grade of this course is in the morning of 22nd Jan. 2009.
  • If you have any questions regarding to your final grade, please come to my office between 1:30PM and 5:00PM on 22nd Jan. 2009.
  • The final grade will be posted on this web site.
  • After the above time, the final grade list will be submitted to the school; hence, I will not be allowed to change it after then.
• 問卷調查 (posted: 7th Jan. 2009)
• 請重新填寫問卷調查 (posted: 14th Jan. 2009)

Referenced Material

• Shell Code
• Some interesting security-related or attacker web sites: (posted: 9th Sep.)
  • National Vulnerability Database
  • US CERT
  • SANS InfoSec Reading Room
  • Phrack Magazine
  • Blackhat
  • SecurityFocus
• Buffer Overflow-Related Papers (posted: 9th Sep.)
  • Smashing The Stack For Fun And Profit
  • Stack Smashing Vulnerabilities in the Unix Operating System
  • The Art of Writing Shellcode, by smiler.
  • w00w00 on Heap Overflows
  • The advanced return-into-lib(c) exploits
  • The Tao of Windows Buffer Overflow
  • New Chips Stop Buffer Overflow Attacks
  • Sined's collection of intermediate papers WEB Page
  • HP-UX (PA-RISC 1.1) Overflows
• 第一次網路大戰