Foundations of Cybersecurity 1

Hello there,

we are saarsec, a Capture-the-Flag Team composed of students and lecturers from Saarland University. From April 12 until April 14 we will be giving our new workshop to familiarize interested students with Capture-the-Flag competitions! In CTF competitions you attack and defend against security vulnerabilities to achieve points and win the game.
CTFs are a great way to actually play around with the practical details of mounting attacks and defenses you have learned about in your lectures (including this one).
This practical experience is not only beneficial for your studies but also comes in handy during later stages of your career.
The workshop starts with an introduction to Linux and a fun get-together evening, followed by different topics such as Reverse Engineering, Crypto and Exploit Automation.
For each topic, you will learn how to find these vulnerabilities, exploit them on a large scale, and fix them.
You'll spend more than 50% of the time in each slot on actual challenges!

At the end, we will host a CTF where all workshop participants compete using their newly acquired skills.

FAQ:

Q: When and where?

A: April 12th until 14th, Building E1.9 (CISPA Main Building).

Q: Requirements?

A: We do not require any certain skills as we will start with the basics and welcome all non Cybersecurity students aswell. However, the knowledge from Cysec1 or Security is definitely an advantage.

Q: Sounds awesome! Where can I register or get more information?

A: https://workshop.saarsec.rocks

See you there,
saarsec

PS: We have restructured this years workshop making it a perfect fit for people that attended CySec1, so I can only recommend participating. It is generally a fun experience and a great opportunity to get to know other people (including lecturers and lecture staff from lectures you might possibly take in the future).

Dear Students,

the Re-Exam will take place on Friday 12th of April at 10am in E1 3, HS2. Note that you need to register before this Friday, April 5th, 23:59.

We will publish the seating order on your personal status page after the registration period ends.

If you attend the exam, make sure you are there by 09:45 at the latest. Again, you may only bring writing utensils, snacks/drinks, a dictionary, and your student ID to your exam seat.

The exam will take place next Monday, 19th of February, at 14:00 in E2 5, HS I and will last for 120 minutes. Please be there at the latest at 13:45 to get your seat and bring your student ID and enough pens. At your place, you may only have: pens, drink/snack, dictionary, student ID. You have NOT your phone, jacket, backpack, calculator, etc around you. Naturally any medical devices are fine, but please let us know about them at the beginning of the exam.

You can find the seating order on your personal status page. If you do not see a seat assigned to you but you are certain to have registered, contact us immediately.

Dear all,

apologies for cancelling the lecture super last-minute this morning. I had a bit of a scare with one of my kids, which required me to spend the morning in the Uniklinik Homburg. Fortunately, all is well enough for me to regularly run the lecture tomorrow.

To avoid any potential for negative consequences on this to anyone's exam admission, we have reduced the passing bars for both Python and Exercise Sheets by the amount of potential points, i.e., points required for passing sheets is at 63, for Python at 38.

We will also not have any questions about SQL injections in the exam. We will nevertheless have the Python tasks open if you want to check them out later.

Thank you all for the feedback provided through the evaluation. You can now find the result in the CMS at https://cms.cispa.saarland/cysec1_2324/dl/89/Evaluation_Results.pdf. I plan to discuss these also briefly on Tuesday. We appreciate the overall very positive result and will take the feedback into account for 2024! 

Also, a quick reminder that in order to have the best possible preparation, please state the topics to re-discuss in Tuesday's Q/A session through Mattermost until after the lecture on Monday. Note that I will not be recording the lecture, i.e., it is quite important to attend both Monday's and Tuesday's lectures.

Dear all,

as a reminder, please evaluate the lecture and your respective tutorials. Until now, 34 students have evaluated the lecture and only 20 the tutorials. Given that significant more of you submit exercises, please do not let the chance to provide feedback pass. The next generation of students will also appreciate your honest assessment of the lecture.

After reviewing our reference implementation and checker module for the task, we found an issue that yielded incorrect results (specifically 0-prefixed IPs). We have changed the way that our testcases are generated to ensure this cannot happen again in any of the tests.

We have reset all jobs for this exercises, which already led to two "after the fact" solves. To ensure that all students have the chance to get the points, we have extended the deadline for that task by one week. If you already have it marked as solved, you do not need to do anything.

Apologies for the issue and see you later :-) 

Hey everyone,

We have just finished grading the last exercise sheets, and some points are worth mentioning regarding the formalities.
This time, grading took much longer than usual, mainly because of multiple handwritten submissions—some containing hard-to-read, low-resolution pictures. Also, we were running into other hiccups, like missing or wonky task numerations and the page formats were all over the place within one document. We also got many answers that danced around the point on questions like it is a valid 2FA method (yes/no). All this stuff adds up, making grading a longer and, let's say, more 'interesting' process.

In conclusion, we would greatly appreciate it if, for your following submissions, you type your solutions up in Word, LaTeX, or any other program and not in handwritten form.
It'll make our lives easier, and your grades will return faster.

Thanks a bunch, and again, happy holidays!

Dear all,

fortunately, Simon could take over the Python lecture for me today. It is very unfortunate that I was unable to do them myself, but I am certain he did a great job to replace me last minute. Since the lacking lecture last week means we had to cut down the introduction to requests and JSON to a bare minimum, we have decided to make all tasks which were released this week optional. This reduces the overall amount of points by 8, i.e., the passing bar for Python is also down by 4 points.

In addition, there are three more security challenges which have been released today. These also do not count towards the required points, but provide additional 7 points. That is, in all, you can now score up to 103 points (which needing only 44 to pass). Beware: these challenges may require a bit of playing around with them to solve. We even had to implement a crazed JavaScript/CSS-based difficulty indicator for one of them :-) I strongly urge you to not attempt them unless you already finished all others.

Note that the regular tasks are due in the second week of January, whereas the security ones will remain open until the end of the lectures (Feb 5).

Hope to see you tomorrow - assuming nothing dramatic happens and I can give the lecture, it will be worth attending :-)

Here is a reminder that there will be no tutorials this week. Instead, the tutors will offer an office hour in the CISPA lecture hall tomorrow, Friday, the 1st of December, from 12 to 14. You may use this opportunity to ask questions about lecture contents or work on the current exercise sheet.

Similar to other lectures, attendance is not mandatory.

In Exercise 3, the variable "p" is incorrectly defined as 21, which is certainly not a prime number. "p" should be 23. Please make a note of this correction when reviewing your solutions.

We have uploaded a corrected version of the sheet. All other numbers stay the same.

Sorry for the inconvenience.

Unfortunately, we have discovered a number of additional instances where students obviously used ChatGPT to solve the tasks. We have flagged those students (please check your Personal Status page) and counted this as the first and only warning about plagiarism. Anyone that we flagged up has lost their points for solving the respective tasks. If you are affected and believe this is no correct, please contact me tomorrow after our lecture.

I know that the vast majority of you are solving the tasks in an honest fashion, which may sometimes result in you not solving all the tasks. This is precisely the reason why we will continue with a strict policy about using ChatGPT or "taking inspiration" from prior years.

We received some feedback about the Python interface being confusing. In particular, when you submit a task through the code editor (in particular for updates), the resulting page may show "Task still running" and does not reload automatically. It might take some time for us to implement an auto-refresh, but for now, just refresh that page after a few seconds and you should see the results.

Regarding the deadlines for exercise sheets: we decided to stick with Monday as the tutors only have time on Tuesday to grade them. The alternative would therefore be to have grading delayed by one week. Nevertheless we hope the time suffices to finish all tasks.

Dear all,

after there is no obvious solution to the Wifi issues we had this Tuesday, but we have the GHH (in which Wifi works much better), we have decided to adjust the order of lectures a bit.

Specifically, for the next weeks, we will have the Python content on Monday (in GHH) and the security lecture content on Tuesdays (in 0.02). Please make sure to bring your laptop accordingly on Monday.

Note that we do not adjust the deadlines for the sheets, these are still due by Monday 23:59, but will be released on Tuesday after the lecture. The Python tasks, in turn, will be released on Monday after the lecture.

My apologies for the last-minute change of plans. As I noted on Tuesday, I was not expecting such bad Wifi connection in a Computer Science department building.

I have just uploaded the exported PDF for the live coding we did now. For working on the Python tasks, please use https://python.cysec1.de. You can attempt to solve tasks as often as you want, but please be sure to not unnecessarily upload solutions that do not already work locally in your instance of PyCharm (or similar).

Also, the Monday slot for our lecture is now in GHH instead of HS 0.02.

Dear all,

unfortunately, I had to cancel my vacation plans last minute due to some unforeseen events. To ensure we have some wiggle room later in the semester, we will therefore move up the timeline a little:

- We start our lecture on Monday, October 30, at 12:15 in HS 0.02

- Our tutorials start Thursday, November 2