Systems Security

About the course

In this course, important theoretical and practical aspects from the area of systems security are presented and discussed. The focus is on various aspects of software security and different attack and defense techniques are presented. More specifically, important attack methods (e.g., buffer overflows, race conditions, use-after-free, heap overflows, etc.) as well as defense strategies (e.g., non-executable memory, Address Space Layout Randomization, memory tagging, etc.) are discussed. Other topics of the lecture are fuzzing, symbolic execution, reverse engineering, obfuscation, and similar aspects of systems security. 

At the end of the course, students should be able to analyze security aspects of various types of software systems, detect vulnerabilities in the design and implementation, and independently develop security mechanisms. In addition, other aspects from the area of systems security, such as fuzzing and security aspects of operating systems, will be discussed. An important part of the course are exercises, which illustrate and deepen the material with practical examples.

 

---

Prerequisites

There are no formal prerequisites for this course. However, if you want to participate, please take the following aspects into account:

• You should have experience in systems-oriented programming. In addition, it helps if you have experience in the C programming language to understand some of the topics, Python is helpful as well.
• You should have a basic understanding of operating systems (e.g., memory management, scheduling, etc.).
• You should be familiar with Linux, as the exercises are based on a remote exercise framework that is accessible via SSH only.

Background in security is also an advantage (e.g., prior participation in the Foundations of Cybersecurity lecture or Security core lecture). However, we will also cover several relevant aspects as part of the lectures.
 

---

Time and Location

The lecture will take place every Wednesday from 10:15-11:45 o'clock, starting on October 26, 2022. The lecture will be offered in a hybrid format: we will have regular lectures in the CISPA lecture hall (ZSHZ / 0.05) and also record the lectures. We will also offer a tutorial, more information will follow soon. You can find more information on the page "Access to lectures".

---

Grading

To pass the course, you must score at least 50% on the final exam. In the final exam, you can reach 100 points, so you need to achieve at least 50 points in the final exam to pass the course. To be admitted to the exam, you must achieve at least 50% of the points from the seven exercises. Your final grade is based only on your exam result and you can earn bonus points via the exercises. You can find more details below:

Assignments

During the semester there are seven assignments to be solved with a total of 240 points. You must achieve a total of at least 50% (120 points) to be admitted to the exam. The assignments are related to the topics covered in the lectures and are designed to deepen your knowledge of these topics. We strongly encourage you to solve these assignments, as this will help you understand the topics covered in the lectures in more detail. Note that the first exercise sheets will have less points compared to the later exercise sheets. You can obtain bonus points if you reach more than 120 points: the number of bonus points is (total points - 120) / 10 (rounded to nearest number). So if you achieve 183 points in the exercises, you will receive 6 bonus points, while 195 points lead to 8 bonus points. The final grade will be the points in your final exam + bonus points. 

Assignments must be submitted individually, group work is not permitted. A submission usually consists of a theoretical and a practical part. The solutions to all theoretical tasks (e.g., questions, tables to fill in, etc.) must be submitted in a single PDF file. For all practical tasks, we have prepared a remote environment equipped with all necessary tools and materials. Practical tasks are solved and submitted directly within this environment. We will provide more information in the first assignment sheet. These practical exercises are designed like CTF challenges. You will typically have the task of exploiting a vulnerable program to extract a secret flag.

• Strict no cheating policy
  You may discuss the assignments with other students, but you are not allowed to collaborate with others on the solution. Your solution should be original and not an existing solution (e.g., from someone else or from the internet). All submissions will be automatically checked for plagiarism, as we have a strict no-cheating policy. If we find a case of plagiarism, we will assign zero points. If you ever get stuck, you can ask questions in the forum or participate in the exercise lessons. We invite you to help fellow students who have asked questions, but avoid giving away the solution. Nobody likes spoilers :)
• Solutions
  We will upload solutions for all assignments, but the concise nature of solutions might not be able to answer all your questions. We recommend you to use the forum or join the exercise lessons if you have any questions.
• Writing Assignments
  To simplify the grading of assignments, we only accept digital solutions and not handwritten ones. We recommend using LateX for these tasks. An example template can be found here. If you need an introduction to Latex, the overleaf documentation is a good starting point.

 

Written Exam

At the end of the semester, there will be a written exam and a re-exam, the dates will be announced at the end of October. Note that physical presence is required for the exam. The exam will consist of both theoretical questions and practical questions. The theoretical questions refer to the theoretical parts and concepts of the slides and possibly to additional content presented in the lecture that is not part of the slides. The practical questions are similar (in principle) to the practical assignments. However, the complexity of the questions is naturally scaled to fit the available exam time (e.g., you are not expected to implement a lengthy piece of assembler code). If you score at least 50% of the points, you will pass the class.

All questions of the exam are in English. Answers can be given either in English or in German, at the student’s discretion.

No lecture notes or any other materials are allowed during the exam. All materials required to solve the practical questions are provided at the exam.

The exam will take place on February 17th from 14:30 - 16:30 in the Günter-Hotz Lecture Hall (GHH). The re-exam will be on April 4th from 14:30 - 16:30 in the Günter-Hotz Lecture Hall (GHH).

 

---

Registration

Register for the course here in the CISPA CMS. Registration will open on October 1, 2022.