Overview
|
Course Summary
In this course, we will investigate the causes of programming errors that often lead to exploitation and examine techniques to prevent such errors and their exploitation. The course aims to teach students about the types of flaws programmers may create, techniques to detect such flaws in programs, and defensive programming techniques to avoid such flaws and prevent exploitation. In addition, programmers often need to implement and maintain security mechanisms into their programs, so this course will teach students about common security mechanisms and methods for implementing such mechanisms.
Topics will include a review of C programming fundamentals, typical program exploits, safe programming practices to avoid flaws that lead to exploits, program-wide defenses to prevent exploitation of flaws, program testing methods, additional flaws and defenses, and some related research experience studies.
A detailed list of a lecture by lecture contents, assignments, and due dates (subject to change as semester evolves) is available on the course schedule.
Grading
The course will be graded on programming projects, exams, occasional quizzes, and class participation in the following proportions:
| 30% | Programming Projects |
| 25% | Midterm Exam |
| 35% | Final Exam |
| 10% | Class Participation |
Projects
During this course, students will implement a few programming projects in the C programming language. It is assumed that students are proficient in C programming (as CMPSC 473 - and implicitly CMPSC 311 are prerequisites). We will push the boundaries of C programming in some cases, as this is where the flaws lie and how they are exploited. While the course will teach these techniques, a solid background in C programming is expected. The course will also teach defenses and testing techniques that require a solid knowledge of program semantics and runtimes. Some background will be assumed. These projects aim to give you a familiarity with techniques for building programs that can defend themselves from exploitation.
Grades will be based on the factors specific to each project.
Exams
This course will have midterm and final exams. The midterm will be given in class. The final exam will be comprehensive.
Class Participation
Class participation includes grades from quizzes and participation in lectures. Quizzes will bbe given throughout the semester. Some quizzes will be for me to measure background and/or comprehension. These will graded based on whether they are taken. Other quizzes may be given at the conclusion of a subject and will be graded based on correctness of responses.
Lectures are augmented by various readings, which are expected to be read prior to class (note: reading materials twice - once before and once after the lecture worked for my comprehension). During the lecture, we will discuss the readings, and students are required to participate in discussions during each lecture. Ultimately, the students' ability to exhibit comprehension of readings is essential to a good grade.
Lateness Policy
All milestones are assesed a 20% per-day late penalty, up to a maximum of 4 days. Unless the problem is apocalyptic, don't give me excuses. Students with legitmate reasons who contact the professor before the deadline may apply for an extension.
Course Outline
A rough outline of the class is as follows:
|
Academic Integrity Policy
Academic integrity is the pursuit of scholarly activity in an open, honest and responsible manner. Academic integrity is a basic guiding principle for all academic activity at The Pennsylvania State University, and all members of the University community are expected to act in accordance with this principle. Consistent with this expectation, the University’s Code of Conduct states that all students should act with personal integrity, respect other students’ dignity, rights and property, and help create and maintain an environment in which all can succeed through the fruits of their efforts.
Academic integrity includes a commitment by all members of the University community not to engage in or tolerate acts of falsification, misrepresentation or deception. Such acts of dishonesty violate the fundamental ethical principles of the University community and compromise the worth of work completed by others.
The course projects are to be carried out individually. Students are explicitly not allowed to share information, source code, or even discuss the contents of the projects. Any violation of this policy will be considered cheating and will result in the student receiving an 'F' grade for the project and a full letter grade off the final grade for the course. Students with more than one violation may face stronger penalties per the university policy.
Students are forbidden from copying code, makefiles, or any other material from the Internet (such as publicly available Github repos). Plagiarism will be strictly enforced through in-depth reviews of your submissions. Any violation in the letter or spirit of this policy will also be considered cheating, and handled as described above. Note that any publication of the assignments (e.g., via github or other system) is considered a violation of the above policy.
More information on The Department of Computer Science and Engineering’s Academic Integrity Standards, which are applicable to this course, can be found at EECS Academic Integrity Standards.
Ethics Statement
This course considers topics involving software exploitation techniques. As part of this investigation we will cover technologies whose abuse may infringe on the rights of others. As an instructor, I rely on the ethical use of these technologies. Unethical use may include circumvention of existing security or privacy measurements for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Exceptions to these guidelines may occur in the process of reporting vulnerabilities through public and authoritative channels. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class.
When in doubt, please contact the instructor for advice. Do not undertake any action that could be perceived as technology misuse anywhere and/or under any circumstances unless you have received explicit permission from Professor Jaeger.
