Syllabus - CSE 466 "System Security" Fall 2024

Course Info

Course Numbers: CSE 466 (77384 and 77385)
Meeting Times: Tuesday, 4:30pm--5:45pm (CDN68) Meeting Times: Thursday, 4:30pm--5:45pm (CDN68) Course Discord: Join the pwn.college discord

Instructors

Instructor: Robert Wasinger
Discord Handle: robwaz Email: rwasinger@asu.edu

Instructor: Adam Doupé aka adamd
Discord Handle: adamd Email: doupe@asu.edu
Office: BYENG 472

TAs

Name: Michael Tompkins
Discord Handle: frqmod

Name: Zack Smith
Discord Handle: donkey

Name: Sam Zhu
Discord Handle: sjzhu

Course Description

This course will explore a number ways that the Security of Computer Systems can fail. Security is a complicated thing: it is only as strong as its weakest link, and a small, single mistake can often bring down otherwise extremely secure software. Taking the intuition that, to build secure systems in the future, one must understand how security can break, we will cover a number of different failure modes of computer systems, including application security and operating system security. Each lecture will consist of an introduction to a new topic, examples of real-world effects of security failures related to the topic, and an assignment for students to explore these concepts.

These assignments will be very thorough, and by the end, students will have an intuitive understanding on how to exploit these vulnerabilities, and will have the building blocks needed to prevent them, both in the lab and in the real world.

This course will feature a flipped-classroom model. Lectures are pre-recorded and class time is intended to be spent expanding upon the pre-recorded lecture content with live demonstrations focusing on answering conceptual questions surrounding the current module.

Recommended Textbook

There is no recommended textbook for this course. Any reading material assigned will be from publicly-available sources on the internet.

Prerequisites

This course will be EXTREMELY challenging, and students are expected to learn some of the necessary technologies on their own time.

This course requires a good understanding of low-level computer architecture (for example, students should understand x86 assembly) and low-level programming languages (specifically, C), and good command of a high-level programming language (specifically, Python). You should have a very good background in operating systems (especially Linux or UNIX variants). If you do not have these skills, or do not plan on acquiring them very early in the course, you will have a hard time. A good approximation of the type of material that you will be faced with is the first six levels of the Vortex wargame.

Schedule

The listing below is the tentative module progression of the course.

Module 1: Program Security

Dates
Start	Tuesday August 27, 2024 @ 18:00
Checkpoint	Monday September 2, 2024 @ 23:59
Due	Monday September 2, 2024 @ 23:59

Module 2: Advanced Reverse Engineering

Dates
Start	Tuesday September 3, 2024 @ 18:00
Checkpoint	Monday September 9, 2024 @ 23:59
Due	Monday September 16, 2024 @ 23:59

Module 3: Return Oriented Programming

Dates
Start	Friday September 13, 2024 @ 18:00
Checkpoint	Monday September 23, 2024 @ 23:59
Due	Monday September 30, 2024 @ 23:59

Module 4: Dynamic Alocator Misuse

Dates
Start	Friday September 27, 2024 @ 18:00
Checkpoint	Monday October 7, 2024 @ 23:59
Due	Monday October 14, 2024 @ 23:59

Module 5: Program Exploitation

Dates
Start	Friday October 11, 2024 @ 18:00
Checkpoint	Monday October 21, 2024 @ 23:59
Due	Monday October 28, 2024 @ 23:59

Module 6: Kernel Security

Dates
Start	Friday October 25, 2024 @ 18:00
Checkpoint	Monday November 4, 2024 @ 23:59
Due	Monday November 4, 2024 @ 23:59

Module 7: Race Conditions

Dates
Start	Friday November 1, 2024 @ 18:00
Checkpoint	Monday November 11, 2024 @ 23:59
Due	Monday November 11, 2024 @ 23:59

Module 8: Sandbox Escapes

Dates
Start	Friday November 8, 2024 @ 18:00
Checkpoint	Monday November 18, 2024 @ 23:59
Due	Monday November 18, 2024 @ 23:59

Module 9: Microarchitecture Exploitation

Dates
Start	Friday November 15, 2024 @ 18:00
Checkpoint	Monday December 25, 2024 @ 23:59
Due	Monday December 2, 2024 @ 23:59

Module 10: System Exploitation

Dates
Start	Friday November 29, 2024 @ 18:00
Checkpoint	Monday December 9, 2024 @ 23:59
Due	Monday December 16, 2024 @ 23:59

Course Communication

All announcements and communications for the class will take place on the discord, with announcements in the #announcements and discussion in the #text class-specific channel. Students are required to be on this discord.

Student may use the discord to ask questions or clarifications, and the TA, Instructor, or other students can answer. Note that sharing full solution scripts or answers is expressly prohibited, but otherwise, collaboration on the way to the solution is allowed.

Questions may be directly messaged to the instructors.

Name	Discord Handle
Robert Wasinger	robwaz
Adam Doupé	adamd

Before directly messaging your question, please consider asking it on the discord instead. This way, the entire class will benefit from your question.

Office Hours

Office hours will be held weekly. All students are encouraged to attend office hours for in-person assistance.

Course Role	Name	Office Hours
Instructor	Robert Wasinger	TBA
TA	frqmod	Monday 4:30-5:20 @ BYENG209
TA	donkey	Wednesday 4:30-5:20 @ BYENG209
TA	sjzhu	Friday 4:30-5:20 @BYENG209

Assignments

Assignments only, no exams or quizzes.

Students performance will be evaluated on between 7 and 14 homework equally weighted assignments (the modules), where each assignment will consist of between 10 and 100 challenge problems.

Assessment

Component	Weight
Assignments	100%
Extra Credit: Helpfulness	5%
Extra Credit: Memes	8%

Challenge-based assignments with flags as rewards.

Each assignment will consist of a large amount of varied, but related challenges, and will be live for between one and two weeks. Solving these challenges may require the use or implementation of fairly complex hacking tools. Solving each individual challenge will grant a challenge-specific passcode, called a "flag". The maximum number of flags possible to score for an assignment is equal to the maximum number of challenges in the assignment.

The existence of flags means that there is no wrong way to solve a challenge. If you tricked the challenge into giving you the valid flag, good job.

Extra credit: Helping Others

This course encourages collaboration. We have recruited the help of a reputation bot on the discord to this end. Whenever you get thanked by a student in a public discord channel, the reputation bot will react with a thanks emoji and log the interaction. Extra credit for receiving thanks is logarithmic (5 * log_50_(thanks)), for up to 5% extra credit at 50 thanks received. Abuse of this system is considered a violation of academic integrity.

Collaboration Policy

Collaboration is highly encouraged in this course. However, there is a delicate balance between being excessively helpful, and learning. The purpose of course collaboration is understanding concepts. As such, questions and answers should be focused on concepts, and not how to solve challenge X.

The challenges explore important concepts, and so it is fine to discuss the challenges. However, you may not discuss full or significant portions of a challenge's solution. Furthermore, you may not intentionally solve challenges as a group. The assignments must still be solved individually.

Feel free to discuss ideas important to the challenge, or tools which may be useful.

If there is any confusion, just ask! We try to assume good intentions, but egregious violations are an academic integrity violation.

Extra credit: Memes

Are you a meemer? Meme, and earn grades! If you post an on-topic meme in the #memes channel and we emoji-react to acknowledge it, you will get 0.5% extra credit, to your final grade, per week. In order to foster a good learning community, and encourage creative thinking around the material, you may receive extra credit each week for sharing educational memes in the course discord. It is important to note that memes must be relevant, educational, and non-offensive. No excessively spicy memes please. The course discord bot will acknowledge credited memes with a "good_meme" emoji if the meme is approved by the course staff. Good memes might be reviewed in class. Meme extra credit will be at most 8% of your grade.

More Extra Credit: Bug Bounty Program

Any responsibly-disclosed serious security issues in course infrastructure will earn an extra 1 to 25 "bug bounty" percentage points to their final grade, depending on the severity of the issue. Blatantly spurious reports may earn a negative percentage report of up to -5 percentage points. Allowances will be made for honest mistakes leading to a spurious bug bounty filing, but please don't waste our time on purpose.

Final Grade Calculation

The final grade will be calculated by averaging the grades of each homework assignment, equally weighted, then adding extra credit. Percentages will be translated to letter grades with the following initial cutoffs:

Percentage Grade	Letter Grade
>= 100	A+
>= 93	A
>= 90	A-
>= 88	B+
>= 83	B
>= 80	B-
>= 78	C+
>= 70	C
< 70	E

With the exception of the cutoff for A+, these cutoffs can be curved downward in the event that students do worse than expected.

Special Accommodations

Students requesting disability accommodations should register with the Disability Resource Center (DRC) and present the instructor with appropriate documentation from the DRC.

Plagiarism and Cheating

Plagiarism or any form of cheating in assignments or projects is subject to serious academic penalty. To understand your responsibilities as a student read: ASU Student Code of Conduct and ASU Student Academic Integrity Policy. There is a zero tolerance policy in this class: any violation of the academic integrity policy will result in a zero on the assignment and the violation will be reported to the Dean’s office. Plagiarism is taken very seriously in this course.

Examples of academic integrity violations include (but are not limited to):

• Sharing code with a fellow student (even if it’s only a few lines).
• Collaborating on code with a fellow student (unless explicitly allowed).
• Using another student's solution to solve a challenge and get a flag.
• Sharing a flag with another student (NEVER ALLOWED UNDER ANY CIRCUMSTANCES).

Posting your assignment solutions online is expressly forbidden, and will be considered a violation of the academic integrity policy. Note that this includes working out of a public Github repository. The Github Student Developer Pack provides unlimited private repositories while you are a student, making it easy to begin with a private GitHub repository.

Syllabus Update

Information in the syllabus may be subject to change with reasonable advance notice and an announcement on discord.

Misc

Syllabus copyright 2024 Robert Wasinger, along with all lectures and course-related written materials. During this course students are prohibited from making audio, video, digital, or other recordings during class, or selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of the faculty member teaching this course. Be reasonable.

Title IX is a federal law that provides that no person be excluded on the basis of sex from participation in, be denied benefits of, or be subjected to discrimination under any education program or activity. Both Title IX and university policy make clear that sexual violence and harassment based on sex is prohibited. An individual who believes they have been subjected to sexual violence or harassed on the basis of sex can seek support, including counseling and academic support, from the university. If you or someone you know has been harassed on the basis of sex or sexually assaulted, you can find information and resources at https://sexualviolenceprevention.asu.edu/faqs.

As a mandated reporter, I am obligated to report any information I become aware of regarding alleged acts of sexual discrimination, including sexual violence and dating violence. ASU Counseling Services, https://eoss.asu.edu/counseling, is available if you wish discuss any concerns confidentially and privately.