Security (WS 2024/2025)

Dear students of Security,

our final is scheduled for 19.2.25. Please make sure to register on LSF until one week before that, as it is not possible to register later. I am importing registrations from LSF into the CMS registration regularly, so it is sufficient to register on LSF. I will also check on everyone's points in the exercises one week before the exam, and ask UdS to unregister anyone from LSF that has less than the required 150 points at that time. If you are still waiting for points from EX5 and/or EX6 to reach this threshold: we will make sure that such exercises are corrected in time, but it will be close to the deadline if you rely on points from EX6. 

We are currently not planning to have a cheat sheet for the final, in particular not one written by students. Please have a look at the old exam posted in the material collection for reference on the style of questions asked.

Dear students,

tomorrow marks the last official lecture of this semester, thank you all for sticking with us throughout this course! This means, there will be NO lecture on Wednesday, February 5th!

We want to thank you for your collaboration, especially those who regularly joined the lectures and participated in an active manner, thank you! For you, and also everyone else who is interested, we have a little present ;) Namely a bonus lecture on February 11th, at the usual time slot, i.e., 16:15-17:45 at GHH. We managed to get a expert from the industry who will give you some insights as to how security is handled in practice in large companies such as Adidas or ÖBB (Austrian Federal Railways). This lecture will NOT be part of the exam, however, we still hope many of you attend as this is a unique opportunity to hear about these topics from someone from industry and of course ask all your questions. Since our speaker is joining us remotely, you can do so as well via the Zoom link below. We will set up the streaming in GHH and moderate the Q&A session from there.

So see you all there and here is a TLDR of the bonus lecture:

Title: "Industrial Security Skills and Careers: Some Personal Insights"

Dr. Markus Donko-Huber (née Huber) is an expert in the area of Information Security and Privacy. He spent 10 years in academia and organized the Privacy Enhancing Technologies lecture at TU Wien. Markus previously worked to improve the security and privacy of adidas Runtastic. He currently works as a Security Architect at ÖBB.

February, 11th 2025, 16:15-17:45, GHH (or online via Zoom)

https://cispa-de.zoom-x.de/j/65392812580?pwd=nZQjwLKbJQ6NALLocXKBonnanl3FTf.1

Meeting ID: 653 9281 2580
Passcode: s.@3G$

Dear students,

I just released exercise sheet 5, covering the topics of today's lecture on authentication as well as usable security. Sorry for the slight delay, on challenge created some issues which we had to get rid of first.

I hope you enjoy this slightly different style of practical exercises, as always, we are very happy about your feedback (also for the lecture), which you can send either directly to me or my colleagues or anonymously via CMS.

Have a great week!

Alexander

Hi all,

Just a quick update on the CTF scoreboard: we've decided to disable the challenges for which we already published solutions. This means that flags for these challenges can no longer be submitted. The reason is that we want to reward those students who solve the challenges on their own, but we can no longer distinguish flag submissions based on original work from flag submissions based on our solutions once the solutions are out.

We've also applied this rule retroactively and invalidated all flag submissions that we received after the solution to a challenge had already been published. The scores on the scoreboard have been recalculated accordingly.

We note that you can still test whether a flag is correct or not, even for disabled challenges: go to the flag submission page and insert the flag. If you get the message "Challenge is disabled", the flag was correct. Otherwise, you will see the message "Invalid flag". You will not receive scoreboard points for such submissions though.

Naturally, this change only affects the scoreboard and does not have any effect on your exercise sheet points or grades.

Happy hacking!
Till

Dear students,

due to some technical issues, the CSRF + XSS challenges are currently not working as expected. We are working on the issues, for the time being, these challenges are deactivated in the scoreboard and not exploitable on the website. The affected front-end will still show as usual, however the corresponding back-end services are offline.

All other challenges are unaffected and can be exploited as usual.

We apologize for the inconvenience and will release another news once the issues is resolved.

Best,

Alexander

Dear students,
unfortunately, there was a small mistake in the "canary" challenge. We fixed the problem, but some offsets might have changed. We will accept exploits with both offsets, the new and the old one, in case you already solved the task.

In addition, let me take this opportunity to announce that there will be small prizes for the top 3 scoring teams on the scoreboard at the end of the lecture ;)
Simeon

Dear students,

We have two more requests regarding the exercise sheet submissions:

1. No hand-written submissions

To make our tutor's lifes easier, please do not submit (scans/pictures of) hand-written notes.

For exercise sheet E2, we strongly discourage handing in such documents, but will still accept them (as the deadline is already approaching). Starting from exercise sheet E3, however, we will no longer accept hand-written notes in submissions.

2. No LLM-generated content

In addition, we want to remind you of our policy regarding the use of large language models (LLMs) to solve the exercises (as outlined in the intro lecture): you may use LLMs to polish your writing or make your submission more readable, but not to generate any actual content. Keep in mind that one purpose of the exercises is to prepare you for the exam, where no LLMs will be available.

Thanks,
Till

Hey everyone,

after manually reassigning the tutorials for some people, tutorial assignments are now fixed. If you want to attend another tutorial, please find someone from your preferred tutorial to swap with.

Short reminder that tutorials start on Nov 7th, so there are no tutorials on Monday. The first sheet will be released next week Wednesday, on Nov 6th. Checkout the timetable for the latest details.

Simeon

Dear student of Security'24,

for this week, we have prepared an introductory lecture as video, as Katharina and Nils are both traveling. You will find the link to the video/slides in the material collection here on CMS. From next week on, all lectures will be in-person, starting with the lecture on October 22nd. We also plan to release an ungraded tutorial exercise (Q0) soon - you will also find it in the material collection. Please use the Askbot feature on CMS if you have any questions after watching the intro video!

Regards,

Nils