Security and Privacy Technologies - CS 6431

This survey course covers a range of modern research topics in computer security and privacy.

 

Jan 25. Course overview.

Jan 30. Passwords (1).

• Notes.
• Reading: Morris and Thompson. "Password Security: A Case History" (CACM 1979).
• Reading: Florêncio and Herley. "A Large-Scale Study of Web Password Habits" (WWW 2007).
• Reading: Bonneau. "The Science of Guessing: Analyzing an Anonymized Corpus of 70 million passwords" (S&P 2012).

Feb 1. Passwords (2).

• Notes.
• Reading: Melicher et al. "Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks" (USENIX Security 2016).

Feb 6. Passwords (3).

• Notes.
• Reading: Chatterjee et al. "pASSWORD tYPOS and How to Correct Them Securely" (S&P 2016).

Feb 8. Web security: same origin policy.

• Reading: Barth. "Principles of the Same-Origin Policy" (2011).
• Reading: Klein. "DOM Based Cross Site Scripting or XSS of the Third Kind" (2005).

Feb 13. Web security: modern cross-site scripting.

• Reading: Zalewski. "Postcards from the Post-XSS World" (2011).

Feb 15. Code-reuse attacks.

• Reading: Shacham. "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)" (CCS 2007).
• Reading: Lekies et al. "Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script Gadgets" (CCS 2017).

Feb 22. Cloud security.

• Notes.
• Reading: Ristenpart et al. "Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds" (CCS 2009).
• Reading: Balduzzi et al. "A Security Analysis of Amazon's Elastic Compute Cloud Service" (SAC 2012).

Feb 27. Cache side channels.

• Notes.
• Reading: Yarom and Falkner. "FLUSH+RELOAD: a High Resolution, Low Noise, L3 Cache Side-Channel Attack" (USENIX Security 2014).
• Reading: Lipp et al. "Meltdown" (2018).

Mar 1. Web tracking.

• Reading: Mayer and Mitchell. "Third-Party Web Tracking: Policy and Technology" (S&P 2012).
• Reading: Englehardt and Narayanan. "Online Tracking: A 1-million-site Measurement and Analysis" (CCS 2016).

Mar 6. Anonymization and re-identification.

• Notes.

Mar 8. Impossibility of privacy in statistical databases.

• Reading: Dinur and Nissim. "Revealing Information while Preserving Privacy" (PODS 2003).

Mar 13. Differential privacy.

• Reading: Dwork. "A Firm Foundation for Private Data Analysis" (CACM 2011).

Mar 15. Encrypted databases.

• Notes.
• Reading: Popa et al. "CryptDB: Protecting Confidentiality with Encrypted Query Processing" (SOSP 2011).
• Reading: Naveed et al. "Inference Attacks on Property-Preserving Encrypted Databases" (CCS 2015).

Mar 20. Searchable encryption.

• Notes.
• Reading: Cash et al. "Dynamic Searchable Encryption in Very-Large Databases: Data Structures and Implementation" (NDSS 2014).
• Reading: Cash et al. "Leakage-Abuse Attacks Against Searchable Encryption" (CCS 2015).

Mar 22. Inference attacks on encrypted databases.

• Reading: Grubbs et al. "Why Your Encrypted Database Is Not Secure" (HotOS 2017).
• Reading: Bindschaedler et al. "The Tao of Inference in Privacy-Protected Databases" (2017).

Mar 27. Anonymity networks.

• Reading: Dingledine et al. "Tor: The Second-Generation Onion Router (USENIX Security 2004).
• Reading: Johnson et al. "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (CCS 2013).

Mar 29. Internet censorship.

• Reading: Winter and Lindskog. "How the Great Firewall of China is Blocking Tor" (FOCI 2012).
• Reading: Burnett and Feamster. "Encore: Lightweight Measurement of Web Censorship with Cross-Origin Requests" (SIGCOMM 2015).

Apr 10. Resisting traffic analysis (1).

• Notes.
• Reading: van den Hooff et al. "Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis" (SOSP 2015).

Apr 12. Resisting traffic analysis (2).

• Reading: Wolinsky et al. "Dissent in Numbers: Making Strong Anonymity Scale" (OSDI 2012).
• Reading: Corrigan-Gibbs et al. "Riposte: An Anonymous Messaging System Handling Millions of Users" (S&P 2015).

Apr 17. TLS and padding oracles.

• Reading: Vaudenay. "Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS..." (EUROCRYPT 2002).
• Reading: AlFardan and Paterson. "Lucky Thirteen: Breaking the TLS and DTLS Record Protocols" (S&P 2013).

Apr 19. Internet-wide measurement.

• Reading: Heninger et al. "Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices" (USENIX Security 2012).
• Reading: Durumeric et al. "ZMap: Fast Internet-Wide Scanning and its Security Applications" (USENIX Security 2013).

Apr 24. Network telescopes.

• Reading: Moore et al. "Inferring Internet Denial-of-Service Activity" (USENIX Security 2001).
• Reading: Kumar et al. "Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event" (IMC 2005).

Apr 26. NLP meets side channels.

• Reading: Zhuang et al. "Keyboard Acoustic Emanations Revisited" (CCS 2005).
• Reading: White et al. "Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on fon-iks" (S&P 2011).
• Reading: Mihalevsky et al. "Gyrophone: Recognizing Speech From Gyroscope Signals" (USENIX Security 2014).

May 1. SQL injection.

• Reading: Ray and Ligatti. "Defining Code-injection Attacks" (POPL 2012).

May 3. Attacks on machine learning (1).

• Reading: Lowd and Meek. "Adversarial Learning" (KDD 2005).
• Reading: Šrndić and Laskov. "Practical Evasion of a Learning-Based Classifier: A Case Study" (S&P 2014).

May 8. Attacks on machine learning (2).

• Notes.
• Reading: Fredrikson et al. "Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures" (CCS 2015).
• Reading: Shokri et al. "Membership Inference Attacks Against Machine Learning Models" (S&P 2017).

Botnets and e-crime.

• Notes.