CSE 564: Computer Security and Privacy (Winter 2015)

Class Schedule

Note: Dates more than one week in the future subject to slight changes.

Date and Topic	Readings	Assignments
01/06/2015 Introduction	Optional Reading (No writeups required): Denning et al.: Computer Security in the Modern Home, CACM 2013 Roesner et al.: Security and Privacy for Augmented Reality Systems, CACM 2014
01/08/2015 Attacks	Required Reading: Halperin et al.: Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses, Oakland 2008 Mowery et al.: Security Analysis of a Full-Body Scanner, USENIX Security 2014
01/13/2015 Passwords	Optional Reading: Mickens: This World Of Ours (hilarious column on security), 2014 Required Reading: Bonneau et al.: The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes, Oakland 2012 Silver et al.: Password Managers: Attacks and Defenses, USENIX Security 2014
01/15/2015 Web Security	Required Reading: Barth et al.: The Security Architecture of the Chromium Browser, 2008 He et al.: ShadowCrypt: Encrypted Web Applications for Everyone, CCS 2014	Project Groups Due (11:59pm) Security Review #1 Due (11:59pm)
01/20/2015 Web Security	Required Reading: Curtsinger et al.: ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection, USENIX Security 2011 (You may watch the talk video instead) Brubaker et al.: Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations, Oakland 2014
01/22/2015 Smartphone Security and Privacy	Required Reading: Felt et al.: Android Permissions Demystified, CCS 2011 Enck et al.: TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, OSDI 2010	Project Proposals Due (11:59pm)
01/27/2015 Smartphone Security / Ecosystem Studies	Required Reading: Zhoe et al.: Dissecting Android Malware: Characterization and Evolution, Oakland 2012 Durumeric et al.: The Matter of Heartbleed, IMC 2014	Attack Lab Out
01/29/2015 Ecosystem Studies	Required Reading: Motoyama et al.: Re: CAPTCHAs – Understanding CAPTCHA-Solving Services in an Economic Context, USENIX Security 2010 Thomas et al.: Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse, USENIX Security 2013 (You may watch the talk video instead)
02/03/2015 Software/Systems Security	Required Reading: Brumley et al.: Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications, Oakland 2008 Parno et al.: Bootstrapping Trust in Commodity Computers, Oakland 2010
02/05/2015 Systems Security	No required reading: guest lecture by Xi Wang (Franzi is away).
02/10/2015 Usable Security	Required Reading: Schechter et al.: The Emperor’s New Security Indicators, Oakland 2007 Akhawe et al.: Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness, USENIX Security 2013
02/12/2015 Usable Crypto	Required Reading: Whitten et al.: Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0, USENIX Security 1999 Egele et al.: An Empirical Study of Cryptographic Misuse in Android Applications, CCS 2013
02/17/2015 Side Channels	Required Reading: Enev et al.: Televisions, Video Privacy, and Powerline Electromagnetic Interference, CCS 2011 Michalevsky et al.: Gyrophone: Recognizing Speech From Gyroscope Signals, USENIX Security 2014
02/19/2015 Web Privacy	Required Reading: Mayer et al.: Third-Party Web Tracking: Policy and Technology, Oakland 2012 Nikiforakis et al.: Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting, Oakland 2013	Project Checkpoint Due (11:59pm) (moved from 2/12) Attack Lab Due (11:59pm)
02/24/2015 Web Privacy	Required Reading: Guha et al.: Privad: Practical Privacy in Online Advertising, NSDI 2011 Lecuyer et al.: XRay: Enhancing the Web’s Transparency with Differential Correlation, USENIX Security 2014
02/26/2015 Anonymity	Required Reading: Dingledine et al.: Tor: The Second-Generation Onion Router, USENIX Security 2004 Narayanan et al.: Robust De-anonymization of Large Sparse Datasets (How To Break Anonymity of the Netflix Prize Dataset), Oakland 2008	OPTIONAL: Security Review #2 Due (11:59pm)
03/03/2015 Surveillance and Targeted Attacks	Required Reading: Angwin et al.: The NSA Revelations All in One Chart, 2014 (no writeup required) Borisov et al.: Off the Record Communications, or, Why Not to Use PGP, WPES 2004 Marczak et al.: When Government Hack Opponents: A Look at Actors and Technology, USENIX Security 2014 (You may watch the talk video instead)
03/05/2015 Privacy-Enhancing Systems	Required Reading: Geambasu et al.: Vanish: Increasing Data Privacy with Self-Destructing Data, USENIX Security 2009 Lee et al.: PiBox: A Platform for Privacy Preserving Apps, NSDI 2013	Project Report Draft Due (11:59pm)
03/10/2015 Emerging Technologies	Required Reading: Martinovic et al.: On the Feasibility of Side-Channel Attacks with Brain-Computer Interfaces, USENIX Security 2012 Jana et al.: Enabling Fine-Grained Permissions for Augmented Reality Applications with Recognizers, USENIX Security 2013 (You may watch the talk video instead)
03/12/2015 Bitcoin	Required Reading: Nielsen: How the Bitcoin protocol actually works (blog post), 2013 Choose one of: Miller et al.: Permacoin: Repurposing Bitcoin Work for Data Preservation, Oakland 2014 Ben-Sasson et al.: Zerocash: Decentralized Anonymous Payments from Bitcoin, Oakland 2014
03/16/2015 Project Presentations	Project presentations (8:30am-12:20pm)	Project Reports Due (11:59pm)