Syllabus - CSE 466 "System Security" Fall 2026

Course Info

Course Number: CSE 466 (73253)
Meeting Times: Thursday, 4:30pm--5:45pm
Location: Lattie Coor Hall 174 (COOR174), Tempe
Session Dates: August 20 - December 4, 2026 (Session C)
Course Discord: This course uses a private, ASU CSE466-specific Discord server for announcements, discussion, and office hours available here:

https://discord.gg/nuHd6eYEqC

Only students registered for the ASU course will be able to join the ASU CSE466 Discord.

Instructors

Instructor: Michael Tompkins
Discord Handle: frqmod
Email: [email protected]

Instructor: Ozgur Ozmen
Discord Handle: mozgurozmen
Email: [email protected]

TAs

Name: Davit Benashvili
Discord Handle: Dbena
Email: [email protected]

Course Description

This course will explore a number of ways that the Security of Computer Systems can fail. Security is a complicated thing: it is only as strong as its weakest link, and a small, single mistake can often bring down otherwise extremely secure software. Taking the intuition that, to build secure systems in the future, one must understand how security can break, we will cover a number of different failure modes of computer systems, including application security and operating system security. Each lecture will consist of an introduction to a new topic, examples of real-world effects of security failures related to the topic, and an assignment for students to explore these concepts.

These assignments will be very thorough, and by the end, students will have an intuitive understanding of how to exploit these vulnerabilities, and will have the building blocks needed to prevent them, both in the lab and in the real world.

This course will feature a flipped-classroom model. Lectures are pre-recorded, and class time is intended to largely be spent expanding upon the pre-recorded lecture content with live demonstrations focusing on answering conceptual questions surrounding the current module.

Recommended Textbook

There is no recommended textbook for this course. Any reading material assigned will be from publicly-available sources on the internet.

Prerequisites

This course will be EXTREMELY challenging, and students are expected to learn some of the necessary technologies on their own time.

This course requires a good understanding of low-level computer architecture (for example, students should understand x86 assembly) and low-level programming languages (specifically, C), and a good command of a high-level programming language (specifically, Python). You should have a very good background in operating systems (especially Linux or UNIX variants). If you do not have these skills, or do not plan on acquiring them very early in the course, you will have a hard time. A good approximation of the type of material that you will be faced with is the first six levels of the Vortex wargame.

Schedule

The listing below is the tentative module progression of the course.

Module 1: Assembly and Debugging Refresher

Dates
Start	Thursday August 20, 2026 @ 18:00
Checkpoint	Sunday August 30, 2026 @ 23:59
Due	Sunday August 30, 2026 @ 23:59

Module 2: Program Security

Dates
Start	Friday August 28, 2026 @ 16:00
Checkpoint	Sunday September 6, 2026 @ 23:59
Due	Sunday September 13, 2026 @ 23:59

Module 3: Advanced Reverse Engineering

Dates
Start	Friday September 11, 2026 @ 17:00
Checkpoint	Sunday September 20, 2026 @ 23:59
Due	Sunday September 27, 2026 @ 23:59

Module 4: Return Oriented Programming

Dates
Start	Friday September 25, 2026 @ 17:00
Checkpoint	Sunday October 4, 2026 @ 23:59
Due	Tuesday October 13, 2026 @ 23:59

Module 5: Dynamic Allocator Misuse

Dates
Start	Friday October 9, 2026 @ 17:00
Checkpoint	Sunday October 18, 2026 @ 23:59
Due	Sunday October 25, 2026 @ 23:59

Module 6: Program Exploitation

Dates
Start	Friday October 23, 2026 @ 17:00
Checkpoint	Sunday November 1, 2026 @ 23:59
Due	Sunday November 8, 2026 @ 23:59

Module 7: Race Conditions

Dates
Start	Friday November 6, 2026 @ 17:00
Checkpoint	Sunday November 15, 2026 @ 23:59
Due	Sunday November 15, 2026 @ 23:59

Module 8: Sandbox Escapes

Dates
Start	Friday November 13, 2026 @ 17:00
Checkpoint	Sunday November 22, 2026 @ 23:59
Due	Sunday November 22, 2026 @ 23:59

Module 9: Kernel Security

Dates
Start	Friday November 20, 2026 @ 17:00
Checkpoint	Sunday November 29, 2026 @ 23:59
Due	Sunday November 29, 2026 @ 23:59

Module 10: System Exploitation

Dates
Start	Friday November 27, 2026 @ 17:00
Checkpoint	Sunday December 6, 2026 @ 23:59
Due	Sunday December 13, 2026 @ 23:59

Course Communication

All routine course announcements and discussion will take place in the private ASU CSE466 Discord server. Students are expected to join the server to stay up to date on the state of the course.

The public pwn.college Discord may of course be used for general platform support, getting help and discussing the material, but course-specific announcements, logistics information, and extra credit from help and memes will only occur in the private ASU CSE466 Discord server.

Questions may be sent directly to course staff when they involve grades, accommodations, or other private matters. Before directly messaging your question, please consider asking it in the course channel instead. This way, the entire class will benefit from your question.

Name	Discord Handle
Michael Tompkins	frqmod
Ozgur Ozmen	mozgurozmen
Davit Benashvili	Dbena

Office Hours

Office hours are held weekly. Check the ASU CSE466 Discord for announcements about cancellations or schedule changes.

When	Course Role	Name	Discord Handle	Where
Mondays, 4:00-6:00 PM	Instructor	Ozgur Ozmen	mozgurozmen	BYENG 396
Tuesdays, 9:30-10:30 AM	Instructor	Michael Tompkins	frqmod	Discord
Fridays, 2:00-3:00 PM	Instructor	Michael Tompkins	frqmod	Discord

Assignments

Students' performance will be evaluated on between 7 and 14 equally weighted homework assignments (the modules), where each assignment will consist of between 10 and 100 challenge problems.

Assessment

Component	Weight
Assignments	70%
Midterm Exam	15%
Final Exam	15%
Extra Credit (capped at 5%)	5%

Challenge-based assignments with flags as rewards.

Each assignment will consist of a large amount of varied, but related challenges, and will be live for between one and two weeks. Solving these challenges may require the use or implementation of fairly complex hacking tools. Solving each individual challenge will grant a challenge-specific passcode, called a "flag". The maximum number of flags possible to score for an assignment is equal to the total number of challenges in the assignment.

The existence of flags means that there is no wrong way to solve a challenge. If you tricked the challenge into giving you the valid flag, good job.

Module Scoring

The first 20% of an assignment is earned by solving the first 1/2 (rounded down) of the challenges by the checkpoint: you either earn it, or you don't.

• For assignments that run approximately one week, the checkpoint is the due date.
• For assignments that run two weeks, the checkpoint is one week into the assignment. The remaining 80% of an assignment is earned by solving challenges: your solves / total number of challenges.

Late Credit

Every challenge solved after its deadline earns 75% credit, regardless of how late it is.

For example, if you solve 4 out of 10 challenges on time and 5 more after the deadline, your challenge score will be (4 * 100% + 5 * 75%) / 10 = 77.5%.

Early Progress

We run the pwn.college platform, and all of the content is publicly available to the world. You may decide to work on challenges before (or after) the semester, or work on challenges not-yet-assigned throughout the semester. If you solve a challenge that ends up being part of an assignment in this course, that challenge is solved, and you will receive course credit for it. This includes challenges you solved in a previous course, in a previous semester, or entirely on your own.

We make no guarantees about which challenges will or will not be included in an assignment until that assignment is released. If you work ahead, you do so at your own risk, though hopefully you still learn something useful. You should assume things will change as we continue to iterate on this course, and while we hold this policy this semester, there are no guarantees it will hold in future semesters.

Exams

There will be two in-class, handwritten exams this semester. These exams are designed to assess your conceptual understanding of the mechanisms underlying the vulnerabilities studied throughout the course. Exams will be closed-book, and no laptops, tablets, or other electronic devices will be permitted. You may bring one cheat sheet: a single 8.5" x 11" sheet of paper with handwritten notes on both sides. Your cheat sheets will be collected at the end of the exam.

Students must attend class on exam day. Exam dates will be announced as early as possible, so please plan ahead.

Midterm Date: Thursday October 29, 2026

Final Exam Date: Thursday December 10, 2026, 4:30-6:20 PM (tentative)

Extra credit: Helping Others

This course encourages collaboration. We have recruited the help of a reputation bot on the Discord to this end. Students can thank other students by reacting to helpful messages with the :upvote: emoji on the ASU CSE466 Discord server. Whenever you get thanked this way by a student in a public Discord channel, the reputation bot will also react with a thanks emoji and log the interaction. Extra credit for receiving thanks is logarithmic (5 * log_50(thanks + 1) percentage points), reaching the full 5% at 50 thanks received. Abuse of this system is considered a violation of academic integrity.

Extra credit: Memes

If you post an on-topic meme in the #memes channel and we emoji-react to acknowledge it, you will get 0.5% extra credit to your final grade per week (weeks run Sunday to Sunday; only one acknowledged meme per week counts). In order to foster a good learning community, and encourage creative thinking around the material, you may receive extra credit each week for sharing educational memes in the course Discord. It is important to note that memes must be relevant, educational, and non-offensive. No excessively spicy memes please. The course Discord bot will acknowledge credited memes with an :upvote: emoji if the meme is approved by the course staff. Good memes might be reviewed in class. Meme extra credit will be at most 5% of your grade.

Help and meme extra credit are hard-capped at a combined 5%!

More Extra Credit: Bug Bounty Program

Any responsibly-disclosed serious security issues in course infrastructure will earn an extra 1 to 25 "bug bounty" percentage points to their final grade, depending on the severity of the issue. Blatantly spurious reports may earn a negative percentage reward of up to -5 percentage points. Allowances will be made for honest mistakes leading to a spurious bug bounty filing, but please don't waste our time on purpose.

Final Grade Calculation

Your final grade is the weighted sum of the three components in the table above, plus extra credit:

• Assignments (70%) — the average of your module grades, each module weighted equally. Within a module, the checkpoint is worth 20% and the challenges 80%.
• Midterm Exam (15%)
• Final Exam (15%)
• Extra credit is then added on top, capped as described above.

Percentages will be translated to letter grades with the following initial cutoffs:

Percentage Grade	Letter Grade
>= 100	A+
>= 93	A
>= 90	A-
>= 88	B+
>= 83	B
>= 80	B-
>= 78	C+
>= 70	C
< 70	E

With the exception of the cutoff for A+, these cutoffs can be curved downward in the event that students do worse than expected.

Collaboration Policy

Collaboration is highly encouraged in this course. However, there is a delicate balance between being excessively helpful, and learning. The purpose of course collaboration is understanding concepts. As such, questions and answers should be focused on concepts, and not how to solve challenge X.

The challenges explore important concepts, and so it is fine to discuss the challenges. However, you may not discuss full or significant portions of a challenge's solution. Furthermore, you may not intentionally solve challenges as a group. The assignments must still be solved individually.

Feel free to discuss ideas important to the challenge, or tools which may be useful.

If there is any confusion, just ask! We try to assume good intentions, but egregious violations will result in an academic integrity violation.

Where You May Collaborate

You are encouraged to collaborate with your peers. However, you may only collaborate with other students either in the official ASU CSE466 Discord or the official pwn.college Discord, in public channels. Discussing course material with other students on any other Discord, in private messages between students, or elsewhere, will be considered an Academic Integrity Violation.

This restriction is about peer collaboration. It does not limit how you reach course staff: you may always message the instructors directly, and you are encouraged to do so when a public channel isn't appropriate (see Course Communication).

Generative AI

This course allows you to use generative AI, with some important caveats that you must follow.

Generative AI can be an incredibly powerful tool for learning, and it will likely be a critical part of the future of education and software development. However, it can also be extremely detrimental if you rely on it to do the thinking and problem solving for you. If an LLM is doing more of the problem-solving or actual labor than you are, you are not learning the material and that will hurt you both in this course and in your future career.

Your goal while using generative AI in this course should always be to learn, not simply to improve your grade. Asking an LLM or utilizing an LLM agent to solve a challenge for you is not acceptable.

SENSAI (Preferred AI Tool)

The platform provides SENSAI, an LLM augmented with data from your running challenge.

If you want (generative AI) help related to a specific challenge, SENSAI should be your first choice. SENSAI is designed to provide educationally-appropriate guidance.

SENSAI also includes monitoring features that allow course staff to understand how it is being used. If we see something concerning, we will typically reach out and talk with you about it first.

Using Other Generative AI Tools

You may use other generative AI tools (e.g., ChatGPT, Claude, etc.) for conceptual learning.

Examples of acceptable use include:

• Asking for factual information or explanations of concepts (e.g., asking what the argument order for a given syscall is or asking how stack pivoting works at a conceptual level)
• Clarifying specifics (e.g., call vs jmp, or how a particular instruction affects flags)
• Asking the AI to quiz you on course material

A useful rule of thumb:

If the help you are asking for is similar to something you might ask in the course Discord, it is probably acceptable.

However, external AI tools may NOT be used for challenge-specific guidance, including:

• Asking how to solve a specific challenge
• Asking what the next step in a challenge should be
• Asking an AI to analyze challenge binaries, exploits, or code you are writing

Similarly, at no point should you be utilizing an agentic workflow to solve these challenges.

If you're ever unsure, you should default to SENSAI.

Finally, keep in mind that you will be tested on material in the class in person without the help of an AI.

Honors Contracts

This course offers honors contracts! Honors students must create a custom pwn.college module on a computing topic of their choice, and submit it as a contribution to the Honors Dojo. There should be 4-10 challenges progressively teaching the concept, as well as either accompanying text or lecture videos (at least 10 minutes per challenge) to help explain ideas. Interested students should contact the instructors over email.

Special Accommodations

Suitable accommodations are made for students having disabilities. Students needing accommodation must register with the ASU Student Accessibility and Inclusive Learning Services (SAILS) office and provide documentation of that registration to the instructor. Students should communicate the need for an accommodation in enough time for it to be properly arranged. See ACD 304-08 Classroom and Testing Accommodations for Students with Disabilities.

Excused absences for classes will be given without penalty to the grade in the case of (1) a university-sanctioned event [ACD 304-02]; (2) religious holidays [ACD 304-04] — a list of religious holidays can be found here; (3) work performed in the line-of-duty according to SSM 201-18. Students who request an excused absence must follow the policy/procedure guidelines. Excused absences do not relieve students of responsibility for any part of the course work required during the period of absence.

Plagiarism and Cheating

Plagiarism or any form of cheating in assignments or projects is subject to serious academic penalty. To understand your responsibilities as a student read: ASU Student Code of Conduct and ASU Student Academic Integrity Policy. There is a zero tolerance policy in this class: any violation of the academic integrity policy will result in a zero on the assignment and the violation will be reported to the Dean's office. Plagiarism is taken very seriously in this course.

Examples of academic integrity violations include (but are not limited to):

• Sharing code with a fellow student (even if it's only a few lines).
• Collaborating on code with a fellow student (unless explicitly allowed).
• Using another student's solution to solve a challenge and get a flag.
• Sharing a flag with another student (NEVER ALLOWED UNDER ANY CIRCUMSTANCES).

Posting your assignment solutions online is expressly forbidden, and will be considered a violation of the academic integrity policy. Note that this includes working out of a public GitHub repository. The GitHub Student Developer Pack provides unlimited private repositories while you are a student, making it easy to begin with a private GitHub repository.

Syllabus Update

Information in the syllabus may be subject to change with reasonable advance notice and an announcement on Discord.

Misc

Syllabus copyright 2026 Michael Tompkins, along with all lectures and course-related written materials. During this course students are prohibited from making audio, video, digital, or other recordings during class, or selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of the faculty member teaching this course.

Be reasonable. We're all doing our best.

Title IX is a federal law that provides that no person be excluded on the basis of sex from participation in, be denied benefits of, or be subjected to discrimination under any education program or activity. Both Title IX and university policy make clear that sexual violence and harassment based on sex is prohibited. An individual who believes they have been subjected to sexual violence or harassed on the basis of sex can seek support, including counseling and academic support, from the university. If you or someone you know has been harassed on the basis of sex or sexually assaulted, you can find information and resources at https://sexualviolenceprevention.asu.edu/faqs.

As a mandated reporter, I am obligated to report any information I become aware of regarding alleged acts of sexual discrimination, including sexual violence and dating violence. ASU Counseling Services, https://eoss.asu.edu/counseling, is available if you wish to discuss any concerns confidentially and privately.