Systems Security Ali Abbasi, Thorsten Holz

News

01.12.2022

Solutions for the exercise sheets

The solution for the first exercise sheet is online and can be found in Materials. The grading itself, will take a bit longer, but Matteo is already working on it.

The solutions for the next exercises will be automatically unlocked right after the deadline. This... Read more

The solution for the first exercise sheet is online and can be found in Materials. The grading itself, will take a bit longer, but Matteo is already working on it.

The solutions for the next exercises will be automatically unlocked right after the deadline. This allows you to have a look at the solutions before the exercise sessions on Friday. However, if something is unclear, or you have any remaining questions regarding a past or the current exercise sheet, feel free to ask us on Friday.

See you tomorrow,

Simon & Joschua

30.11.2022

Lecture on November 30 / Second exercise

As a quick reminder: there is no lecture this week, we have uploaded a video for the remaining content of the Software Security I/II block. The second exercise sheet is available as well, CMS now should show the correct times for all exercises.

25.11.2022

Tutorial on Fridays at 2pm (s.t.)

In case you missed it in the last lecture: The time for the tutorial is now set, we have the tutorial on Fridays at 2:00pm (s.t.). The tutorial is organized in an online form, we use the same Zoom link as in the lecture (see "Information" => "Access to... Read more

In case you missed it in the last lecture: The time for the tutorial is now set, we have the tutorial on Fridays at 2:00pm (s.t.). The tutorial is organized in an online form, we use the same Zoom link as in the lecture (see "Information" => "Access to lectures").

18.11.2022

First exercise

The first exercise is now available, you can find it under Materials.

16.11.2022

No lecture on Wednesday, Nov 16

We will not have a lecture today, there is a CISPA-internal event and hence the room is blocked. The next lecture is on November 23, we will publish the first exercise sheet tomorrow.

26.10.2022

Welcome!

Welcome to Systems Security! The first course meeting is on Wednesday, Oct 26, 2022, at 10:15 am. You can participate in-person (ZSHZ - 0.05 Hörsaal - CISPA building) or remotely (you can find the Zoom link under "Information" while logged in). See you then!

Show all
 

About the course

In this course, important theoretical and practical aspects from the area of systems security are presented and discussed. The focus is on various aspects of software security and different attack and defense techniques are presented. More specifically, important attack methods (e.g., buffer overflows, race conditions, use-after-free, heap overflows, etc.) as well as defense strategies (e.g., non-executable memory, Address Space Layout Randomization, memory tagging, etc.) are discussed. Other topics of the lecture are fuzzing, symbolic execution, reverse engineering, obfuscation, and similar aspects of systems security. 

At the end of the course, students should be able to analyze security aspects of various types of software systems, detect vulnerabilities in the design and implementation, and independently develop security mechanisms. In addition, other aspects from the area of systems security, such as fuzzing and security aspects of operating systems, will be discussed. An important part of the course are exercises, which illustrate and deepen the material with practical examples.

 


Prerequisites

There are no formal prerequisites for this course. However, if you want to participate, please take the following aspects into account:

  • You should have experience in systems-oriented programming. In addition, it helps if you have experience in the C programming language to understand some of the topics, Python is helpful as well.
  • You should have a basic understanding of operating systems (e.g., memory management, scheduling, etc.).
  • You should be familiar with Linux, as the exercises are based on a remote exercise framework that is accessible via SSH only.

Background in security is also an advantage (e.g., prior participation in the Foundations of Cybersecurity lecture or Security core lecture). However, we will also cover several relevant aspects as part of the lectures.
 


Time and Location

The lecture will take place every Wednesday from 10:15-11:45 o'clock, starting on October 26, 2022. The lecture will be offered in a hybrid format: we will have regular lectures in the CISPA lecture hall (ZSHZ / 0.05) and also record the lectures. We will also offer a tutorial, more information will follow soon. You can find more information on the page "Access to lectures".


Grading

To pass the course, you must score at least 50% on the final exam. In the final exam, you can reach 100 points, so you need to achieve at least 50 points in the final exam to pass the course. To be admitted to the exam, you must achieve at least 50% of the points from the seven exercises. Your final grade is based only on your exam result and you can earn bonus points via the exercises. You can find more details below:

Assignments

During the semester there are seven assignments to be solved with a total of 240 points. You must achieve a total of at least 50% (120 points) to be admitted to the exam. The assignments are related to the topics covered in the lectures and are designed to deepen your knowledge of these topics. We strongly encourage you to solve these assignments, as this will help you understand the topics covered in the lectures in more detail. Note that the first exercise sheets will have less points compared to the later exercise sheets. You can obtain bonus points if you reach more than 120 points: the number of bonus points is (total points - 120) / 10 (rounded to nearest number). So if you achieve 183 points in the exercises, you will receive 6 bonus points, while 195 points lead to 8 bonus points. The final grade will be the points in your final exam + bonus points. 

Assignments must be submitted individually, group work is not permitted. A submission usually consists of a theoretical and a practical part. The solutions to all theoretical tasks (e.g., questions, tables to fill in, etc.) must be submitted in a single PDF file. For all practical tasks, we have prepared a remote environment equipped with all necessary tools and materials. Practical tasks are solved and submitted directly within this environment. We will provide more information in the first assignment sheet. These practical exercises are designed like CTF challenges. You will typically have the task of exploiting a vulnerable program to extract a secret flag.

  • Strict no cheating policy
    You may discuss the assignments with other students, but you are not allowed to collaborate with others on the solution. Your solution should be original and not an existing solution (e.g., from someone else or from the internet). All submissions will be automatically checked for plagiarism, as we have a strict no-cheating policy. If we find a case of plagiarism, we will assign zero points. If you ever get stuck, you can ask questions in the forum or participate in the exercise lessons. We invite you to help fellow students who have asked questions, but avoid giving away the solution. Nobody likes spoilers :)
  • Solutions
    We will upload solutions for all assignments, but the concise nature of solutions might not be able to answer all your questions. We recommend you to use the forum or join the exercise lessons if you have any questions.
  • Writing Assignments
    To simplify the grading of assignments, we only accept digital solutions and not handwritten ones. We recommend using LateX for these tasks. An example template can be found here. If you need an introduction to Latex, the overleaf documentation is a good starting point.

 

Written Exam

At the end of the semester, there will be a written exam and a re-exam, the dates will be announced at the end of October. Note that physical presence is required for the exam. The exam will consist of both theoretical questions and practical questions. The theoretical questions refer to the theoretical parts and concepts of the slides and possibly to additional content presented in the lecture that is not part of the slides. The practical questions are similar (in principle) to the practical assignments. However, the complexity of the questions is naturally scaled to fit the available exam time (e.g., you are not expected to implement a lengthy piece of assembler code). If you score at least 50% of the points, you will pass the class.

All questions of the exam are in English. Answers can be given either in English or in German, at the student’s discretion.

No lecture notes or any other materials are allowed during the exam. All materials required to solve the practical questions are provided at the exam.

 


Registration

Register for the course here in the CISPA CMS. Registration will open on October 1, 2022. 



Privacy Policy | Legal Notice
If you encounter technical problems, please contact the administrators