CSE 564: Computer Security and Privacy (Winter 2018)

Class Schedule

Note: Contents / topics / papers more than one week in the future subject to slight changes.

Date and Topic	Readings	Assignments
01/03/2018 Introduction	No Readings
01/05/2018 Attacks	Required Reading: Checkoway, et al.: Comprehensive Experimental Analyses of Automotive Attack Surfaces, USENIX Security 2011 Silver, et al.: Password Managers: Attacks and Defenses, USENIX Security 2014
01/10/2018 People and Context	Required Reading: Marczak et al.: When Government Hack Opponents: A Look at Actors and Technology, USENIX Security 2014 McGregor, et al.: Investigating the Computer Security Practices and Needs of Journalists, USENIX Security 2015
01/12/2018 Authentication and Design	Required Reading: Bonneau, et al.: The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes, Oakland 2012 Ross, et al.: Stronger Password Authentication Using Browser Extensions, USENIX Security 2005	Project Groups Due (4:30pm)
01/17/2018 Design and Build	Required Reading: Cowan, et al.: StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks, USENIX Security 1998 Geambasu, et al.: Vanish: Increasing Data Privacy with Self-Destructing Data, USENIX Security 2009	Security Reviews (Two) Due (4:30pm)
01/19/2018 Measure	Required Reading: Moore, et al.: Inferring Internet Denial-of-Service Activity, USENIX Security 2001 Durumeric, et al.: The Matter of Heartbleed, IMC 2014	Project Proposals Due (4:30pm) "Workshopping of Projects" Projects Groups and Topics Due (4:30pm)
01/24/2018 Web Security	Required Reading: Bojinov, et al.: XCS: Cross Channel Scripting and its Impact on Web Applications, CCS 2009 Barth, et al.: The Security Architecture of the Chromium Browser, 2008
01/26/2018 Cyber-physical and Physical Systems	No class. You are encouraged to participate in the Allen School Ski Day. While there, please think about the security of the ski facilities -- both the computer and physical systems, as well as the interconnects between the computer and physical systems. You might conduct a Security Review (thought exercise only!) of the ski site.
01/31/2018	No Readings; Part 1 of "Workshopping of Projects"	Summary of Projects Due (9:15am); bring printouts to class
02/02/2018	No Readings; Part 2 of "Workshopping of Projects"	Review of Projects Due (9:15am); TBD what to bring to class
02/07/2018 Web Security and Usability	Required Reading: Akhawe, et al.: Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness, USENIX Security 2013 Felt, et al.: Improving SSL Warnings: Comprehension and Adherence, CHI 2015	Class participation mid-term score reported
02/09/2018 The Web and Privacy	No Class.	Project Checkpoint Due (4:30pm)
02/14/2018 Systems Security	Required Reading: Parno, et al.: Bootstrapping Trust in Commodity Computers, Oakland 2010 Baumann, et al.: Shielding Applications from an Untrusted Cloud with Haven, OSDI 2014
02/16/2018	No Class.
02/21/2018 Mobile Security and Web Privacy	Required Reading: Felt et al.: Android Permissions Demystified, CCS 2011 Egele et al.: An Empirical Study of Cryptographic Misuse in Android Applications, CCS 2013 Mayer, et al.: Third-Party Web Tracking: Policy and Technology, Oakland 2012
02/23/2018 Emerging Technologies	Required Reading: Lebeck, et al.: Securing Augmented Reality Output, Oakland 2017 Fernandes, et al.: Security Analysis of Emerging Smart Home Applications , Oakland 2016
02/28/2018 Applied Crypto	Required Reading: Popa, et al.: CryptDB: Protecting Confidentiality with Encrypted Query Processing, SOSP 2011 Malkhi, et al.: Fairplay — A Secure Two-Party Computation System, USENIX Security 2004
03/02/2018 Adversarial ML	Required Reading: Carlini and Wagner: Towards Evaluating the Robustness of Neural Networks, Oakland 2017 Papernot, et al.: SoK: Towards the Science of Security and Privacy in Machine Learning, IEEE EuroS&P 2018	Project Report Draft Due (4:30pm)
03/07/2018 Side Channels	Required Reading: Kocher, et al.: Spectre Attacks: Exploiting Speculative Execution, 2018 (The course schedule previously listed this paper, which is no longer assigned: Kocher: Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems, Crypto 1996) Wright, et al.: Language Identification of Encrypted VoIP Traffic: Alejandra y Roberto or Alice and Bob?, USENIX Security 2007
03/09/2018 Anonymity and Web Privacy	Required Reading: Dingledine, et al.: Tor: The Second-Generation Onion Router, USENIX Security 2004 Narayanan, et al.: Robust De-anonymization of Large Sparse Datasets (How To Break Anonymity of the Netflix Prize Dataset), Oakland 2008 Nikiforakis, et al.: Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting, Oakland 2013
03/12/2018 Project Presentations	Project presentations (2:30-6pm)	Project Reports Due (8pm)