UB CSE 410/510 Software Security

Fall 2022, Monday 5:00PM - 7:50PM, NSC 220

General Information

Instructor

Dr. Ziming Zhao
E-mail: zimingzh@buffalo.edu
Homepage: https://zzm7000.github.io/
Fall 2022; Monday 5:00 PM - 7:50 PM; NSC 220
Office hours will be online: Monday 3:30 PM - 4:30 PM or by appointment
338B or Zoom at https://buffalo.zoom.us/j/95299258797?pwd=QlBhbjJIUlM5WmlETmFtOE5qT1Z5dz09
The lecture recordings will be posted online after each class.

Teaching Assistant

Md. Armanuzzaman Tomal
E-mail: mdarmanu@buffalo.edu
Homepage
Office hours will be online: Thursday 3:30 PM - 4:30 PM or by appointment
You will need to log in to UB Zoom before you join the office hours at https://buffalo.zoom.us/j/95299258797?pwd=QlBhbjJIUlM5WmlETmFtOE5qT1Z5dz09

Overview

This course is designed to provide students with good understanding of the theories, principles, techniques and tools used for software and system hacking and hardening. Students will study, in-depth, binary reverse engineering, vulnerability classes, vulnerability analysis, exploit and shellcode development, defensive solutions, etc. to understand how to crack and protect native software. In particular, this class covers offensive techniques including stack-based buffer overflow, heap security, format string vulnerability, return-oriented programming, etc. This class also covers defensive techniques including canary, shadow stack, address space layout randomization, control-flow integrity, etc. A key part of studying security is putting skills to the test in practice. Hacking challenges known as Capture The Flag (CTF) competitions are a great way to do this. In this class the progress of students are evaluated by lab assignment and in-class Capture-The-Flag (CTF) competitions.

Downloads: Course Syllabus

Tentative Schedule

Date Topic Dues
Week-1 Class-1 8/29 Overview and Background Knowledge Notes Hw [No video]  
Week-2 Class-1 9/5 === Labor Day Observed - No class ===
Week-3 Class-1 9/12 Background and Buffer Overflow Notes Hw Video Hw-1
Week-4 Class-1 9/19 Buffer Overflow Notes Hw Video Hw-2
Week-5 Class-1 9/26 Buffer Overflow Notes Hw Video Hw-3
Week-6 Class-1 10/3 Buffer Overflow (Frame pointer and defense) Notes Hw Video Hw-4
Week-7 Class-1 10/10 Stack Canary and its Bypass Notes Hw Video
Week-8 Class-1 10/17 ASLR, Seccomp, and Shellcoding Notes Hw Video Hw-5
Week-9 Class-1 10/24 *** Midterm Exam and CTF*** Midterm Hw-6
Week-10 Class-1 10/31 Format string Notes Hw Hw Video Hw-7
Week-11 Class-1 11/7 Return-oriented programming Notes Hw Video Hw-9
Week-12 Class-1 11/14 Return-oriented programming and heap exploitation Notes Hw Video Hw-8 Hw-10
Week-13 Class-1 11/21 Heap exploitation and Cache side-channel attacks Notes Hw Video
Week-14 Class-1 11/28 Cache side-channel attacks, Meltdown, Spectre Notes Hw Video Hw-11, Hw-12
Week-15 Class-1 12/5 Hw Hw-13
Final CTF 12/14 7:15pm-10:15pm NSC 218 FinalCTF Hw-14 due on 12/16

Resources

GDB Cheat Sheet Tmux Cheet Sheet x64 Cheat Sheet x32 Cheat Sheet x32 Cheat Sheet ARM Cheat Sheet ARM Cheat Sheet 32-bit