EECS 765, Spring 2026

Introduction

• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 1

Buffer Overflow Exploit
The source code getscore.c The sample score file score.txt
Supporting older ciphers, key exchange protocols, and MACs on newer SSH clients.
Virtual machine used in the demonstration redhat8.

• Unix - File Permission / Access Modes.
• Unix Permissions Calculator.
• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Appendix D

Buffer Overflow Exploit (continued)

• OS and function call primer slides.
• Setuid demystified.

Remote Buffer Overflow Attack

If you choose to use a host in 2003 Eaton for PA1, please see Using Clonezilla
(Contact Bryan if you need help with setting up your PA1 environment)

Mitigation of Buffer Overflow Exploits

Due to a technical glitch, the video has no sound.

Mitigation of Buffer Overflow Exploits (continued)

Reading Assignment Presentations
Reading Assignment Evaluation Sheet

Reading assignment 1 (Presentation 1, Presentation 2, Presentation 3): The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86).

Reading Assignment 2 (Presentation 4, Presentation 5, Presentation 6): Hacking Blind.

• StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks.
• Bypassing stackguard and stackshield.
• Getting around non-executable stack (and fix).
• The advanced return-into-lib(c) exploits: PaX case study.
• Install-time Vaccination of Windows Execs to Defend Against Stack Smashing Attacks.
• x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique.
• defeating compiler-level buffer overflow protection.

Basic Cryptography

Reading assignment 3 (Presentation 7, Presentation 8, Presentation 9): Framing Signals - A Return to Portable Shellcode.

Reading Assignment 4 (Presentation 10, Presentation 11, Presentation 12): ASLR-Guard: Stopping Address Space Leakage for Code Reuse Attacks.

• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 10

Authentication and Authorization

• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 13

Windows Remote Buffer Overflow Attack

Reading assignment 5 (Presentation 13, Presentation 14, Presentation 15): Modeling and Discovering Vulnerabilities with Code Property Graphs.

Reading Assignment 6 (Presentation 16, Presentation 17, Presentation 18): How to Make ASLR Win the Clone Wars: Runtime Re-Randomization.

Reading Assignment 7 (Presentation 19, Presentation 20, Presentation 21): Shuffler: fast and deployable continuous code re-randomization.

Practical Authentication Protocols
Updated information about the "Reading Assignment Presentations" (see slides)

• Secure Shell Protocol

Man-in-the-Middle Attacks

Reading assignment 8 (Presentation 22, Presentation 23, Presentation 24, and Presentation 25): FuzziFication: Anti-Fuzzing Techniques

Authentication in a Distributed Environment (Kerberos)

• Kerberos: An Authentication Service for Computer Networks
• On the Origin of Kerberos
• Limitations of the Kerberos authentication system

Reading Assignment Presentations:

Reading Assignment 1 (Presentation 1, Presentation 2, Presentation 3)

Reading Assignment Presentations:

Reading Assignment 3 ( Presentation 7, Presentation 8, Presentation 9)

Reading Assignment 4 ( Presentation 10, Presentation 11, Presentation 12)

Public-Key Infrastructure (PKI)

Final Report - Requirements, Guidelines, and Example Topics
Report Topics Due: March 26, 2026
Final Report Due: May 7, 2026

• Peter Gutmann's article on X.509 and his slides
• Comodo, Diginotar Attacks Expose Crumbling Foundation of CA System.
• Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1
• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapters 11.4 and 11.5

Introduction to Network Security

• (Optional) Textbook: M. Bishop. 2019. Computer Security, 2nd Edition - Chapter 28
• ARP Poisoning Attack
• IP Spoofing Attack