Foundations of Cybersecurity 1

Dear all,

CISPA has set up a dedicated mailing list to announce open hiwi positions, topics for theses, talk announcements, and other student-related activities (e.g., taking parts in studies we run). The list is moderated by CISPA to ensure only meaningful content.

You can self-subscribe through https://lists.cispa.saarland/listinfo/teaching-announce 

Sorry for some confusion: I accidentally informed everyone about their results (even those that did not take the exam). Also, because we aligned the grades with the ones from the main exam, there might be a slight shift in your grade (only better) to what the initial email said. Please check your personal status page for the grade (and apologizes for the confusion, it's late).

To determine the location and date for the exam inspection, please let me know (stock@cispa.de) if you want to check your exam by the end of this week. Depending on the number of people, I will announce the date and location on Monday.

In preparation for tomorrow's exam, please check your seat in the CMS (Personal Status page). We will have seating plans at GHH, but nevertheless it will avoid unnecessary queues if you already know where you are seated. Recall that the exam starts at 10:00, so ensure to be at GHH at 9:45 at the latest.

Remember to bring more than one pen, but only have pens, drinks, snacks, and your student ID at your seat (optionally also a dictionary). Once we let you into the lecture hall, find your seat and be sure to have your student ID out for us to check.

Also note the following important Covid-related information from UdS:

As the precondition to enter Saarland University is to comply with the 3G rule, this is also the precondition to participate in the exam. This may be checked by the University’s security service.

The 3G rule means to be completely vaccinated or recovered or having a negative antigen rapid test (valid 24 hours) or a negative PCR test certificate (valid 48 hours). Attention: People vaccinated only once with “COVID-19 Vaccine Janssen” (Johnson & Johnson) are no longer considered completely vaccinated.

Please note: If you fail to provide the proof of your G status upon request your name will be recorded and you must leave the campus immediately. Your exam will be rated as “failed”.

A medical mouth-nose-protection mask (surgical mask or FFP2/KN95/N95 mask) must be worn during the entire exam.

Students who have the typical symptoms of SARS-Cov2 disease will not be allowed to take exams. This does not include students who have a negative daytime test result.

Students who have had close contact with a Corona-positive person may only participate in examinations and courses in attendance if they can show sufficient vaccination protection (basic immunization not longer than 3 months or booster vaccination) or convalescent status (not older than 3 months) or vaccination protection after recovery and are asymptomatic (see § 4 b Ordinance on Corona Pandemic (VO-CP).

Students who are unable to take an examination due to segregation (isolation or quarantine) in accordance with the Ordinance on the Control of the Corona Pandemic (VO-CP) may effectively withdraw from the examinations without receiving a failed attempt. The regulations for withdrawal from examinations of the respective valid examination regulations apply. Proof of the withdrawal must be submitted without culpable hesitation.

Hello there,

we, the Capture-the-Flag Team saarsec, consisting of students and lecturers from Saarland University, are giving a workshop to familiarize students with Capture-the-Flag competitions as well as attacking and defending against security vulnerabilities. CTFs are a great way to actually fiddle around with the practical details of mounting attacks and defenses that were theoretically discussed during your studies. This practical experience can not only be beneficial for your studies but also come in handy during later stages of your career. The workshop starts with a short introduction to Linux, followed by different topics such as File Inclusions, SQL Injections, and Command Injections. For each topic, we will discuss how we can find these vulnerabilities, exploit them on a large scale, and how we can fix them. Then, for each each topic, you'll spend more than 50% of the time in each slot on actual challenges.

At the end, we will host a CTF for all workshop participants where they can use their newly acquired skills against each other.

FAQ:

Q: When and where?

A: April 9th and 10th, format to be decided based on Covid numbers (to be announced the week before the workshop)

Q: Requirements?

A: We do not require any certain skills as we will start with the basics. However, the knowledge from Cysec1 or Security is definitely an advantage.

Q: Sounds awesome! Where can I register or get more information?

A: https://workshop.saarsec.rocks

See you there,

saarsec

Hi all,

I have uploaded the evaluation results to the CMS (see them under Material). I appreciate the overall very positive evaluation, which is the best evaluation result to date. As much as I appreciate this, I like to also take the chance to take some constructive suggestions away. The "worst" grade is about the structure of the lecture, so I would appreciate any additional remarks on what exactly you would have liked more. Please feel free to use either the CMS feedback or send me an email to stock@cispa.de if you have any suggestions!

Thanks

The exam inspection for the main exam will take place on Friday 9-11 in room 0.07 in the CISPA building. I realize this is before your Prog 1 exam, but I would like to be able to report grades quickly, also such that students can decide whether or not to register for the backup exam early on.

Please make sure to bring your student ID and proof of 3G status. The main door of CISPA is closed, so you might have to wait until we let you in and check your status. Also note that we will stop letting students in at 10:40 to ensure we can finish at 11.

In preparation for tomorrow's exam, please check your seat in the CMS (Personal Status page). We will have seating plans at GHH, but nevertheless it will avoid unnecessary queues if you already know where you are seated. Recall that the exam starts at 10:00, so ensure to be at GHH at 9:45 at the latest.

Remember to bring more than one pen, but only have pens, drinks, snacks, and your student ID at your seat (optionally also a dictionary). Once we let you into the lecture hall, find your seat and be sure to have your student ID out for us to check.

Also note the following important Covid-related information from UdS:

As the precondition to enter Saarland University is to comply with the 3G rule, this is also the precondition to participate in the exam. This may be checked by the University’s security service.

The 3G rule means to be completely vaccinated or recovered or having a negative antigen rapid test (valid 24 hours) or a negative PCR test certificate (valid 48 hours). Attention: People vaccinated only once with “COVID-19 Vaccine Janssen” (Johnson & Johnson) are no longer considered completely vaccinated.

Please note: If you fail to provide the proof of your G status upon request your name will be recorded and you must leave the campus immediately. Your exam will be rated as “failed”.

A medical mouth-nose-protection mask (surgical mask or FFP2/KN95/N95 mask) must be worn during the entire exam.

Students who have the typical symptoms of SARS-Cov2 disease will not be allowed to take exams. This does not include students who have a negative daytime test result.

Students who have had close contact with a Corona-positive person may only participate in examinations and courses in attendance if they can show sufficient vaccination protection (basic immunization not longer than 3 months or booster vaccination) or convalescent status (not older than 3 months) or vaccination protection after recovery and are asymptomatic (see § 4 b Ordinance on Corona Pandemic (VO-CP).

Students who are unable to take an examination due to segregation (isolation or quarantine) in accordance with the Ordinance on the Control of the Corona Pandemic (VO-CP) may effectively withdraw from the examinations without receiving a failed attempt. The regulations for withdrawal from examinations of the respective valid examination regulations apply. Proof of the withdrawal must be submitted without culpable hesitation.

Hi all,

I have uploaded the "tutors' exam" to the material section. This was curated by the tutors last year in preparation for the exam. Note that the there are way more questions than in the actual exam, but they resemble types of questions you might get. Given there is no exercise sheet this week, you are encouraged to attempt to solve the exam by yourself until Friday. On Friday in the tutorials, you'll get to ask questions about the answers. That is, there will be tutorials in your regular slot, just with a bit different content.

Hi all,

after some feedback I received, I unfortunately did not have time to update the slides for the Web security part until today. I have added some description for the XSS attacks, which augment the "audio track" from the lecture. Hope this helps a bit with the exercises (which I am sure everyone has already completed anyways ;-)).

Dear all,

I was informed by Qualis that thus far 23 students had evaluated the lecture and 13 the tutorials. For those: thanks!

For the others: please make sure to evaluate the lecture and also tutorials. We rely on your feedback to improve the lecture next time around. And if you are totally happy with everything, let us know (in particular the tutors)!

Lecture: https://qualis.uni-saarland.de/eva/?l=131610&p=szmu9a

Tutorial: https://qualis.uni-saarland.de/eva/?l=1316101&p=fik4nt

Both are open until February 3, 2022.

As a quick reminder, there will be no lecture next week. However, as one student (thanks to the anonymous person) noted it might be helpful to have the topics of the previous lecture covered in the directly following tutorial (i.e., the tutorial tasks are discussed before similar exercises tasks are due), we decided to give this a try :-)

That is: this week, the tutorial exercises cover TLS, HSTS & Certificates. Next week (even though there is no lecture), the tutorial tasks will be about DDoS, anonymous communication, and privacy. The sheets on these topics are only due on January 31, so that should hopefully help a bit with the preparation.

Hi all,

I received the link for the course evaluation today. I encourage everyone to take the few minutes to evaluate both the lecture and the tutorials. This is helpful to us to know where we can improve the lecture for the next iteration.

Lecture: https://qualis.uni-saarland.de/eva/?l=131610&p=szmu9a

Tutorial: https://qualis.uni-saarland.de/eva/?l=1316101&p=fik4nt

Both are open until February 3, 2022.

For an optimal preparation for the exam, I will offer a Q/A lecture in the last slot. This will cover both generic hints towards how to write the exam, but can also be used to answer your questions about certain topics. To ensure I can cover the most important ones, please use the Askbot "question" at https://cms.cispa.saarland/askbot/cysec1_2122/question/86/topics-for-qa-lecture/ to list the topics you think require better explanation.

Dear all,

for many of you, this has been your first half semester of studying. I understand that it is frustrating (more so to students in higher semesters) to not be able to get the full studying experience. I nevertheless hope you have enjoyed the semester thus far and can now celebrate Christmas (if you do that) with your family. I'm looking forward to next year in the hopes of the situation improving again.

On the note of next year, I propose we switch back the lecture time to 12:15 - 13:50. Since all tutorials appear to be online anyways, the delay seems a bit pointless. In particular, for our first slot of 2022, I also give the "Ring Lecture" right afterwards. Doing our lecture here until 14:05 and starting the other at 14:15 seems a bit too much for me. Should there be any reasons why 12:15 does not work for you, let me know and we can schedule the lecture later again from January 10. 

Irrespective of that, have a safe and healthy time off and "see" you next year!

Dear students,

since the question for solutions to tutorial sheets accumulates, we will publish them to study for the exam. We are not publishing them earlier to encourage the attendance of tutorials.

For specific questions to tutorial sheets, you are also welcome to join an office hour. One of the tutors is going to be more than happy to help you out.

 

Best,

Your cysec1 team

Given the switch to online, some students raised concerns about the timing of the lecture since they have on-site (for now) courses before. To give people a bit more time to get home (if they want to), we'll start the lecture at 12:30. As most of you will have the ring lecture right after even running until 14:05 should not be a problem from my understanding. 

Additionally, if the change to online tutorial is an issue, please reach out to Dominik Kempter and ask to be assigned to another tutorial. Since we do not have any capacity issues on Zoom, this is easily feasible.

Dear all,

after extensive discussions with my tutors and other lecturers on campus, I have decided that I do not feel comfortable with increased risk of exposure for the tutors and you. This means that effective this week, all tutorials will be online. Also, the lecture will no longer be hybrid and instead exclusively online through the usual Zoom link from next Monday onwards.

As much as I appreciate the experience of in-person teaching, I believe this is the only sensible decision given the increasing escalation of the fourth wave. I also understand that this is incredibly frustrating for you as students since it seemed that the "new normal" might just work for the winter term. While the overall risk of exposure in a lecture hall is much lower compared to, e.g., a full restaurant or bar, I frankly do not think it is worth it. I sincerely hope that we can switch back to in-person events for the summer term and hope to eventually get to know many of you without a mask on.

If you have thoughts on this decision you want to share anonymously, feel free to use the CMS feature. Alternatively, feel free to mail me directly.

Stay healthy & hopefully keep your spirits up!

 Ben Stock

Dear all,

on the sheet due today, we found a number of cases where solutions were plagiarized. After discussions with the tutors, they have flagged all cases we are confident about as such. You can find that information in your personal status if it affects you. Also, this sheet will be counted as 0 points. For any repeated offenses, we will exclude the students from the exam and report this to the examination board.

Also, let me remind you what the first lecture (page 10) specifies as plagiarism:

All exercises need to be handed in as individual/group solutions

-No copying from some resources

-No copying from other students

-No copying from previous years (including your own solutions)

 Should your exercise have been flagged as plagiarised and you disagree with that assessment (given the above criteria), you can reach out to me via email and arrange a meeting. Otherwise, for those affected, this is your first and only warning. It might seem like I am very harsh on this, but this is only because other students have similarly much on their plate and do not resort to this type of cheating. Hence, in the interest of fairness, we have to take the measures outlined above.

Hi folks,

slides&recordings are online for this week and the slides for next week are online as well. As, in most cases, the Hash Length Extension attack is somewhat complicated to understand, I built a small Python script that shows the process in code. You can find it in the materials section. I hope this helps the understanding a bit :-)

There is a minor change in the lecture plan for January. There will be a lecture on January 17, but not on January 24. The updates are reflected on the Main page.

Also, there seemed to be some issues with the emails containing the Zoom links, which ended up being spam-filtered/dropped. If you have been assigned to a Zoom-based tutorials, you should now also see a link in your Personal Status page. I apologize for the issues.

Note that there is neither a lecture nor tutorials next week. 

I just assigned the tutorials. Please check in your "Personal Status" page to see your tutorial.

Also, the sheets have already been graded yesterday and the results should be visible as well. Please ensure that you find a team partner to submit next week, so as to reduce the grading effort on the tutors. You can also use the Mattermost (there is a channel just for that) to find a partner.

Good morning! I wanted to quickly remind you to please bid on your tutorial preferences. The deadline is tonight, after that we will assign the tutorials.

Also, since this might have caused some confusion last week: the mask mandate in GHH can be lifted if everyone is seated in a seat with a green dot. In that case, sufficient distance is guaranteed. Just because you are seated in a green-dotted seat does not imply you can take off your mask. Based on my guesstimate of the attendance last week, it should be possible to only use green-dotted seats. Hence, when coming in, please use those only.

Finally, the slides for today's lecture are on the CMS. Feel free to take a look up front and/or have them ready to annotate. 

See you at noon!

Based on the Doodle feedback, we need to conduct two tutorials online. Given that the tutors need to be able to get home after their own lectures, we had to update the times/days. Therefore, all tutorial preferences have been reset.

Please go ahead and set your tutorial preferences under "Personal Status". We will assign tutorials next Tuesday.

The lecture slides (including answers) from today's session are online in the CMS and so is the first exercise sheet. Also, the recording of today is online (see "Access to lecture") and so are the slides for next week. 

Note that the submission of exercises is due on Monday 11:59 (i.e., right before the lecture).

Also, please be sure to fill the Doodle so we can plan our tutorial format: https://doodle.com/poll/yts3tbvwfe7sevb5

Welcome all to this year's iteration of Foundations of Cybersecurity 1.

This year's lecture format will be hybrid, i.e., we will have in-person lectures in the Günter-Hotz-Hörsaal (GHH for short, building E2.2), which are also streamed through a Zoom webinar. For information on how to access those (and the recordings), please see the CMS course page (Information -> Access to lectures). In-person meetings will likely include mask mandates (unless the capacity is low, in which case sufficient space can be left between students) and students have to register through the Staysio app for each lecture. Should you not wish to use the app, you have to bring in the "alternative sheet" (https://www.uni-saarland.de/fileadmin/upload/page/coronavirus/Alternativformular-Staysio.pdf) to the lectures, which I have to then collect. Beyond that, I recommend usage of the Corona Warn App, for which I will have a QR code on the slides.

Note that where possible, attending lectures in person is desirable. This allows you to easily ask questions (also possible through Zoom, but only through the chat) and gives me a non-verbal feedback from the audience to identify potential misunderstandings.

Contrary to the lecture, tutorials cannot be hybrid (mostly due to lack of equipment for recording/streaming). Hence, they can either be online or offline. By default, we plan to have all tutorials in an in-person setting. To assess the need for a potential online tutorial, please fill out the doodle at https://doodle.com/poll/yts3tbvwfe7sevb5. Feel free to just use a nickname or your initials instead of your full name in the poll. Even if you do not care, please fill the doodle and indicate select both options (or none, but please participate so I know how many people have voted).

Looking forward to seeing many of you in the lecture next week and have a nice weekend until then!

Dear students,

this is to inform you that next Monday, 18th Oct. (12:00-14:00), we are going to have our first lecture. The topics include organizational matters, Information Security Goals, Legal Aspects in Germany.

On Friday, the 22nd Oct. (14:00-16:00), we are going to have an online tutorial to give you an introduction into Python. Python is a programming language which you are going to use for the practical parts of the exercise sheets. Checkout https://www.python.org/ for installation instructions. We provide you with a Jupyter Notebook for the tutorial. If you want to follow along interactively, make sure to install Jupyter Lab / Jupyter Notebook : https://jupyter.org/install.

We hope you have a great start into the semester.

 

Best,

Your Cysec1 Team