CS Computer Security
Course information
Complete course name: 055633 - COMPUTER SECURITY - UIC 587 (ZANERO STEFANO) Profesor: Stefano ...
Introduction, authentication and access control
Introduction to computer security
CIA Paradigm The CIA paradigm for information security states three desiderata: Confidentiality...
Authentication
Identification is when an entity declares its identity ("I am Stefano", "I am Michele", ...) whil...
Access control
Reference monitor The reference motior enforces access control policies ("who does what on which ...
Exercises on introduction
Question 0 Consider the phenomenon of identity stealing in social networks (e.g., Facebook, Twitt...
Exercises on authentication and access control
2021-2022 Demo exam exercise 1 (4 points) In a company, each employee works in an open space. We ...
Cryptography
Introduction to cryptography and perfect ciphers
Cryptography is the study of techniques to allow secure communication and data storage in presenc...
Computationally secure ciphers and pseudorandom number generators
A modern practical assumption is to build ciphers such that a successful attack is carried only i...
Chosen Plaintext Attacks (CPAs)
Our attacker knows a set of plaintexts which can be encrypted and he wants to understand which on...
Data integrity and Message Authentication Codes (MAC)
Confidentiality does not means integrity. Changes in the ciphertext are undetected. Message Authe...
Asymmetric cryptosystems
We would like to have the following features: Agreeing on a short secret over a public channel C...
Data authentication and digital signatures
We’d like to be able to verify the authenticity of a piece of data without a pre-shared secret. U...
The public key binding problem and digital certificates
Both in asymmetric encryption and digital signatures, the public key must be bound to the correct...
Fundamentals of Information Theory
Shannon’s information theory is a way to quantify information and to mathematically frame communi...
Exercises on cryptography
More exercises aviable at overthewire.org. 2021-2022 DEMO Exam exercise 2 (5 points) You have...
Software security
Introduction to software security
Security is a non-functional requirement of software engineering. Creating inherently secure appl...
Recalls of Linux
The following concepts apply, with proper modifications, to any machine architecture (e.g., ARM, ...
Buffer overflows
A function foo() allocates a buffer, e.g., char buf[8]. buf is filled without size checking. int ...
Format String Bugs
A format string is solution to the problem of allowing a string to be output that includes variab...
Exercises on software security
2022-2021 DEMO Exam exercise 3 (6 points) Assume that: The C standard library is loaded at a kno...
Web security
Introduction to web security
Web application are built on top of HTTP, which is a stateless protocol that has only weak authe...
Cross Site Scripting (XSS)
Cross site scripting is a vulnerability by means of which client-side code can be injected in a p...
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queri...
Cookies and sessions
HTTP is stateless and almost uniderectionl. Web application, on the other hand, need to keep a st...
Cross-Site Requests Forgery (CSRF)
Cross-site request forgery (also known as CSRF) is a web security vulnerability that allows an at...
Other vulnerabilities
Freudian slips (information leaks) Dettailed error messages Display user-supplied data in errors...
Exercises on web security
2021-2022 Demo exam exercise 4 (6 points) LetsComplain is a new website for students and profs. S...
Network security
Network Protocol Attacks
Denial of Service (against availability) Make the service unavailable to legitimate users. Killer...
Firewalls
Firewall: network access control system that verifies all the packets flowing through it. Its mai...
Architectures for secure networks
Dual- or Multi-zone Architectures In most cases, the perimeter defense works on the assumption th...
TLS and SET
Issues of Transactions Security: Problems of remoteness Trust factor between parties Use of sen...
Exercises on network security
2021-2022 DEMO Exam exercise 5 (6 points) Consider the above network diagram, describing a compa...
Malwares
Malwares introduction
"Malware" is a portmanteau of "malicious software": code that is intentionally written to violate...
Defending againts malware and stealth techniques
Patches: most worms exploit known vulnerabilities Signatures: must be developed automatically ...
Exercises on malwares
2021-2022 Demo exam exercise 6 Our systems have been compromised by very powerful malware. Luckil...