|
|
CEG 4420/6420: Host Computer SecuritySyllabus |
Catalog Description: Introduces security hardening of a single system, and how to protect it when connected to a network. It explains how malware can compromise security and privacy from the moment a machine is powered on until shut down. Topics include Privilege Escalation, Buffer Overruns, Network Packet Mangling, Session Hijacking, Firewalls, and ethics. Lab work uses tools such as Kali Linux, and AWS. Prerequisites: CEG 2350 OS Concepts and Usage.
There is no required text book this term. The course home page leads to lecture notes on every topic of this course.
Be aware of https://www.wright.edu/coronavirus website content. Our lectures are asynchronous. Per week, you are expected to watch two lecture videos (75 min each) and study the associated lecture notes. Visit the Course Home Page at least once a week.
Lab work is a significant part of this course. The ordering of lectures, in contrast to the course content topics listed below, is largely due to this influence.
The topics are described at some length because they may be too unfamiliar to you. The numbers in parens are a rough estimate of the number of (75-minute) lectures on each topic.
Well Known Security Breaches. Current security events. Terminology: E.g., Intruder v. Hacker v. attacker v. cracker. Course overview. Escalation of privileges. Denial of Service (DoS). Virus, Worms, and Trojans. Virtual machines.
Linux setup. Configuring properly. The initial boot can be a significant source of insecurity. The sequence of events from initial power-on cold booting to shut down of a computer system. Standard processes: init etc.
Understanding computational infeasibility. Message digests. Digital certificates. Man-in-the-Middle attacks.
User Authentication: /etc/passwd, /etc/shadow files. Salting. One time passwords. Two-factor authentication. Cracking of passwords.
Hardening an OS kernel and system programs. Patching of binaries and source code. Use of diff and patch. Patching for known kernel exploits. Linux kernel modules. Linux security modules. Re-design/ Hardening of OS for security. NSA's Security Enhanced Linux.
Buffer Overflow Exploitation. Software development techniques that are resistant to bug exploits. At the high-level, code structure, least privilege, and narrow interfaces, and at the low-level, checking for buffer overruns, being ultra careful in writing setuid programs, untrusted paths, race conditions, environment, etc. Prevention and detection of race conditions. Type-safety, static source code analysis, assertions and invariants.
Detection and Documentation of (possible) Intrusions.
Penetration testing. Logging facilities. Absense of Rootkits,
unauthorized services, Backdoors. Prevention, detection and
mitigation of malware. Intrusion Detection Systems (IDS).
Intrusion Prevention Systems (IPS). Forensics.
Ethical and Legal Issues (2)
We will discuss topics such as: Why Hackers Do The Things They Do? Is it OK to harden the PC of a neighbor without permission? It is required that you sign our statement of ethics.
The mid term is scheduled around the seventh/eighth week, and the final during the exam week as set by the Registrar.
I expect to give 8 labs, each worth 5%. Lab reports must be submitted by midnight on the due date posted. I will accept up to two lab reports late but each within 48 hours. The subject matter of these experiments is included in the exams.
In this course, a lab rarely involves writing your own programs. It generally will require you to build an executable, on Linux, after suitable reconfiguration using tools such as make. The source code tree will be given to you -- in C/C++, or in ASM.
Experiments are to be performed by the student individually. These labs must be work done solely by you, except for the parts I provided you with.
Active participation in the group discussions is expected.
Homework is suggested. But, there are no homework assignments to be turned in.
Students enrolled in CEG 6420 are required to do additional tasks at a graduate student level. Undergraduate students and graduate students will be graded separately. This semester the tasks are to (i) learn and write a technical summary in a few pages on one of the topics below, (ii) sketch a new lab experiment based on that topic, and (iii) carry out that experiment and submit a lab report as usual. Your article and lab experiment should match the quality of those already included in the course.
sudo, fusermount) using
static analysis tools, such as Splint, LLVM CodeChecker.