CSE 564: Computer Security and Privacy (Winter 2016)

Class Schedule

Note: Dates more than one week in the future subject to slight changes.

Date and Topic	Readings	Assignments
01/05/2016 Introduction	Optional Reading (No writeups required): Denning et al.: Computer Security in the Modern Home, CACM 2013 Roesner et al.: Security and Privacy for Augmented Reality Systems, CACM 2014
01/07/2016 Attacks	Required Reading: Halperin et al.: Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses, Oakland 2008 Mowery et al.: Security Analysis of a Full-Body Scanner, USENIX Security 2014
01/12/2016 Passwords	Optional Reading: Mickens: This World Of Ours (hilarious column on security), 2014 Required Reading: Bonneau et al.: The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes, Oakland 2012 Silver et al.: Password Managers: Attacks and Defenses, USENIX Security 2014 (You may watch the talk video instead)
01/14/2016 Web Security	Required Reading: Barth et al.: The Security Architecture of the Chromium Browser, 2008 He et al.: ShadowCrypt: Encrypted Web Applications for Everyone, CCS 2014	Project Groups Due (submit here) (11:59pm) Security Review Due (11:59pm)
01/19/2016 Web Security	Required Reading: Curtsinger et al.: ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection, USENIX Security 2011 (You may watch the talk video instead) Brubaker et al.: Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations, Oakland 2014
01/21/2016 Smartphone Security and Privacy	Required Reading: Felt et al.: Android Permissions Demystified, CCS 2011 Enck et al.: TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, OSDI 2010	Project Proposals Due (11:59pm)
01/26/2016 Smartphone Security / Ecosystem Studies	Required Reading: Zhoe et al.: Dissecting Android Malware: Characterization and Evolution, Oakland 2012 Durumeric et al.: The Matter of Heartbleed, IMC 2014	Attack Lab Out
01/28/2016 Ecosystem Studies	Required Reading: Motoyama et al.: Re: CAPTCHAs – Understanding CAPTCHA-Solving Services in an Economic Context, USENIX Security 2010 McCoy et al.:PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs, USENIX Security 2012 (You may watch the talk video intead)
02/02/2016 Software/Systems Security	Required Reading: Brumley et al.: Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications, Oakland 2008 Parno et al.: Bootstrapping Trust in Commodity Computers, Oakland 2010
02/04/2016 Systems Security	Guest lecture by Xi Wang (Franzi is away). Optional Reading (No writeups required): Chen et al.: Security bugs in embedded interpreters, APSys 2013 Wang et al.: Jitk: A Trustworthy In-Kernel Interpreter Infrastructure, OSDI 2014
02/09/2016 Usable Security	Required Reading: Schechter et al.: The Emperor’s New Security Indicators, Oakland 2007 Akhawe et al.: Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness, USENIX Security 2013
02/11/2016 Usable Crypto	Required Reading: Whitten et al.: Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0, USENIX Security 1999 Egele et al.: An Empirical Study of Cryptographic Misuse in Android Applications, CCS 2013	Project Checkpoint Due (11:59pm)
02/16/2016 Side Channels	Required Reading: Enev et al.: Televisions, Video Privacy, and Powerline Electromagnetic Interference, CCS 2011 Michalevsky et al.: Gyrophone: Recognizing Speech From Gyroscope Signals, USENIX Security 2014 (You may watch the talk video instead)
02/18/2016 Web Privacy	Required Reading: Mayer et al.: Third-Party Web Tracking: Policy and Technology, Oakland 2012 Nikiforakis et al.: Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting, Oakland 2013
02/23/2016 No Class	No class today (Franzi is away). Adrian will be available during class time for anyone with last-minute attack lab questions.	Attack Lab Due (11:59pm)
02/25/2016 Web Privacy	Required Reading: Guha et al.: Privad: Practical Privacy in Online Advertising, NSDI 2011 Lecuyer et al.: XRay: Enhancing the Web’s Transparency with Differential Correlation, USENIX Security 2014
03/01/2016 Anonymity	Required Reading: Dingledine et al.: Tor: The Second-Generation Onion Router, USENIX Security 2004 Narayanan et al.: Robust De-anonymization of Large Sparse Datasets (How To Break Anonymity of the Netflix Prize Dataset), Oakland 2008
03/03/2016 Secure Communication and Targeted Attacks	Required Reading: Borisov et al.: Off the Record Communications, or, Why Not to Use PGP, WPES 2004 Marczak et al.: When Government Hack Opponents: A Look at Actors and Technology, USENIX Security 2014 (You may watch the talk video instead)	Project Report Draft Due (11:59pm)
03/08/2016 Privacy-Enhancing Systems	Required Reading: Geambasu et al.: Vanish: Increasing Data Privacy with Self-Destructing Data, USENIX Security 2009 (You may watch the talk video instead) Lee et al.: PiBox: A Platform for Privacy Preserving Apps, NSDI 2013
03/10/2016 Emerging Technologies	Required Reading: Martinovic et al.: On the Feasibility of Side-Channel Attacks with Brain-Computer Interfaces, USENIX Security 2012 Jana et al.: Enabling Fine-Grained Permissions for Augmented Reality Applications with Recognizers, USENIX Security 2013 (You may watch the talk video instead)	Optional Assignment Due
03/14/2016 Project Presentations	Project presentations (8:30am-12:20pm)	Project Reports Due (11:59pm)