CSCI E-170 Calendar - Fall 2005
The first half of the course covers the fundamentals of computer security, defenses against passive attackers, and defenses against hostile users. The second half of the course explores phishing and active attackers.
Hour 1: Definitions and Goals of Computer Security. Policies and Perimeters. What is a security policy? Who writes it? What does it include? What does it not include? Perimeter definition and Risk assessment. Attack classification. Examination of some sample policies. Discussion of security incidents. Formulation of a security policy for the class website. Military vs. Commercial objectives. Role of Audit and verification. Codes of Ethics.
Hour 2: Understanding Privacy: data disclosure, fair information practices.
Remember: information posted to LiveJournal is not secure. For this reason, your report should be appropriately sanitized so that it does not contain any information that cannot be publicly released. Specifically, be careful not the compromise the privacy of any individuals involved (unless the details have already been made public).
Cranor and Garfinkel, Security and Usability
Cranor and Garfinkel, Security and Usability
ACM: Code of Ethics
http://www.acm.org/constitution/code.html
ACM Code of Ethics
Special Publication 800-12: An Introduction to Computer Security: The NIST Handbook
http://csrc.nist.gov/publications/nistpubs/800-12/
Chapter 5 (pp. 33-44), "Special Pub 800-12 -- An Introduction to Computer
Security: The NIST Handbook," Computer Security Resource Center
(CSRC), National Institute of Standards and Technology, 1996.
NHS patient privacy? What patient privacy! | The Register
http://www.theregister.co.uk/content/archive/29282.html
CPSR - document_view
http://www.cpsr.org/cpsr/privacy/communications/wiretap/electronic_commun_privacy_act.txt
Electronic Communications Privacy Act of 1986
Children's Online Privacy Protection Act of 1998 (COPPA)
http://www.cdt.org/legislation/105th/privacy/coppa.html
Children's Online Privacy Protection Act of 1998 (COPPA)
HIPAA Privacy Rule and Its Impacts on Research
http://privacyruleandresearch.nih.gov/
HIPAA Privacy Rule and It's Impacts on Research
Hour 1: Locks and master keys. Tempest. Soft tempest. Optical Tempest.
Hour 2: Information left on hard drives.
Obtain a storage device with more than 32MB of memory from yourself or a friend. Image the device's memory and write a 3 page report about what you find. Your report should be sanitized --- that is, the report should not include any personal information that would allow the identification of any data subjects. Be sure to discuss the tools you used, the files, deleted files, and data in the slack space. If the USB device that you have is not sufficiently interesting, or if you are unable to find one that you can image, you may use one of the images from the class website.
Although you have 2 weeks to work on this Assignment, do not wait until the second week before you start. This can be a very interesting assignment. Be sure to give it the time that it is worth. It is highly recommended that you post a status report to the class LiveJournal discussion.
You can find more information in the HW2 FAQ on the home page.
If you are unable to create your own disk image, you can download a 32MB disk image provided for the class.
M. Blaze. "Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks." March 2003. IEEE Security and Privacy. March/April 2003.
Kuhn, Markus G., Anderson, Ross, "Soft Tempest: Hidden Data Transmissions Using Electromagnetic Emanations", David Aucsmith (Ed.): Information Hiding 1998, LNCS 1525, pp. 124-142, 1998.
Kuhn, Markus, G., Optical Time-Domain Eavesdropping Risks of CRT Displays, Proceedings 2002 IEEE Symposium on Security and Privacy, 12-15 May 2002, Berkeley, CA., pp. 3-18. [FAQ]
Garfinkel., S., Shelat, A., Remembrance of Data Passed: A Study of Disk Sanitization Practices, IEEE Security and Privacy, January 2003.
Chapter 15: Garfinkel, S., "Sanitization and Usability," in Cranor and Garfinkel.
Loughry, Joe., Umphress, D., "Information Leakage from Optical Emanations, ACM Transactions on Information System Security, Vol 5, No 3., August 2002.
Bauer, Secure Data Deletion for Linux File Systems
pdd: Memory Imaging and Forensic Analysis of Palm OS Devices.
Robinson, Sara, Master-Keyed Mechanical Locks Fall to Cryptographic Attack, SIAM News, Volume 36, Number 2, 2003.
"Engineering and Design - Electromagnetic Pulse (EMP) and Tempest Protection for Facilities", EP 1110-3-2, 31 December 1990.
The Complete, Unofficial TEMPEST Information Page,
Ross Anderson's Home Page
http://www.cl.cam.ac.uk/users/rja14/
Markus Kuhn’s home page
http://www.cl.cam.ac.uk/~mgk25/
The Coroner's Toolkit (TCT)
http://www.porcupine.org/forensics/tct.html
Brian Carrier: Digital Forensics
http://www.cerias.purdue.edu/homes/carrier/forensics/
The Sleuth Kit & Autopsy: Digital Investigation Tools for Linux and other Unixes
http://www.sleuthkit.org/
Hour 2: Symmetric Encryption algorithms. Simple ciphers. One-time pads. DES. RC2, RC4, AES.
Haber, Stuart, Stornetta, W. Scott, How to Time-Stamp a Digital Document. Lecture Notes in Computer Science vol. 537, (1991) [CiteSeer]
Maheshwari, Umesh, Vingralek, Radek, and Shapiro, William, "How to Build a Trusted Database System on Untrusted Storage"
Marcus J. Ranum's One Time Pad FAQ
Coppersmith, "The Data Encryption Standard (DES) and its strength against attacks."
OpenSSL: Documents, md5(3)
http://www.openssl.org/docs/crypto/md5.html
OpenSSL: Documents, sha(3)
http://www.openssl.org/docs/crypto/sha.html
Crack Password - Password Recovery Software, by Elcomsoft
RFC 1321 (rfc1321) - The MD5 Message-Digest Algorithm
http://www.faqs.org/rfcs/rfc1321.html
RFC 3174 (rfc3174) - US Secure Hash Algorithm 1 (SHA1)
http://www.faqs.org/rfcs/rfc3174.html
FIPS180-2: The Secure Hash Standard
A file system using hash trees for integrity
Slides on the relative speed of hardware implementations of AES finalists and DES, 3DES
FIPS 197: The Advanced Encryption Standard
NIST 800-67: Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher
RSA. Certificates and CAs. Smart cards. PEM, PGP and S/MIME Opportunistic Encryption in SSH and SSL. Adding opportunistic encryption to SMTP. Adding opportunistic encryption to email.
Whitten, Alma, J. D. Tygar, Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. USENIX Security Symposium 1999.
D. Wagner and B. Schneier, Analysis of the SSL 3.0 Protocol , The Second USENIX Workshop on Electronic Commerce Proceedings, USENIX Press, November 1996, pp. 29-40.
Marchesini, John, Smith, S., Zhao, Meiyuan, KeyJacking: The Surprising Insecurity of Client-side SSL, Technical Report TR2004-489, Department of Computer Science, Dartmouth College, February 13, 2004
Gutmann, Peter, Lessons Learned in Implementing and Deploying Crypto Software.
Ellison, "Improvements on Conventional PKI Wisdom"
OpenSSH Project Goals
http://www.openssh.com/goals.html
OpenSSH Project History and Credits
http://www.openssh.com/history.html
Manual Pages: ssh(1)
http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1
OpenSSL: Support, Frequently Asked Questions
http://www.openssl.org/support/faq.html
Gutmann, Peter. PKI: It's not Dead, Just Resting [extended]
MIT PGP Distribution Page
http://web.mit.edu/network/pgp.html
OpenSSH
http://www.openssh.com/
OpenSSL: The Open Source toolkit for SSL/TLS
http://www.openssl.org/
RSA Crypto FAQ Section 3.1: RSA
RSA Crypto FAQ Section 3.5: Elliptic Curve Cryptosystems
Public-Key Infrastructure (X.509)
What is X.509? - A Word Definition From the Webopedia Computer Dictionary
http://www.webopedia.com/TERM/X/X_509.html
What is digital certificate? - A Word Definition From the Webopedia Computer Dictionary
http://www.webopedia.com/TERM/D/digital_certificate.html
Chapter 23. Privacy Analysis for the Casual User with Bugnosis David Martin, in Cranor and Garfinkel
Chapter 21. Five Pitfalls in the Design for Privacy Scott Lederer, Jason I. Hong, Anind K. Dey, and James A. Landay, in Cranor and Garfinkel
Detecting Web Bugs With Bugnosis: Privacy Advocacy Through Education (2002)
Experiences Running a Web Anonymising Service
Tor: The Second-Generation Onion Router
Freenet: A Distributed Anonymous Information Storage and Retrieval System (2000)
Anonymous Connections and Onion Routing (Syverson et al, 1997)
Hour 2: Watermarking
Kirovski et al, Enabling Trusted Software Integrity
Trusted Computing FAQ TC / TCG / LaGrande / NGSCB / Longhorn / Palladium
http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
Freedom to Tinker
http://www.freedomtotinker.com/
http://www.copyright.gov/legislation/dmca.pdf
Welcome to the Anti-DMCA Website
http://www.anti-dmca.org/
https://www.trustedcomputinggroup.org/
Microsoft Shared Source Initiative Home Page
http://www.microsoft.com/resources/ngscb/default.mspx
What makes interfaces good and bad. Affordances. User models Information hidden in the user interface. Why the web is not a good model for understanding usability, security and privacy. Refer links. Web logfiles and cookies. Google.
Microsoft User Experience Group, Privacy and Security, October 2003.
Usability and trust in information systems
Pixelcentric Interface Hall of Shame
http://pixelcentric.net/x-shame/
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnanchor/html/anch_uidesigndev.asp
Today we will talk in detail about identification, authentication and authorization. They're all different!
Hour 1: Passwords Why do we use passwords? Password policies. Graphical Passwords Recovering Passwords; EBAI.
Hour 2: Biometrics
Yan et. all, "The memorability and security of passwords --- some
empirical results." (Use the book chapter if possible, otherwise use
Dhamija, Rachna and Perrig, Adrian.
Déjà
Vu: A User Study Using Images for Authentication PS, PS.GZ, PDF, HTML, BIB, with Rachna Dhamija, 9th Usenix Security
Symposium, August 2000.
Adams, Anne, and Sasse, Martina Angela, "Users are not the Enemy", Communications of the ACM, Volume 42, Issue 12, December 1999, pp. 40-46
Pankanti, Sharath, et. all, On
the Individuality of Fingerprints.
Tsutomu Matsumoto, Hiroyuki Matsumoto, Koji Yamada, Satoshi Hoshino,
Impact
of Artificial "Gummy" Fingers on Fingerprint Systems. [Gummy
Fingers Slides]
Brostoff and Sasse,
Ten Strikes and You're Out!, CHI2003 Workshop.
R. Morris and K. Thompson.
UNIX password security. Communications of
the ACM, 22(11):594--597, Nov. 1979.
Coventry et al, Honest it's
me! Self service verification, in
Workshop on Human-Computer Interaction and Security Systems, April
6, 2003.
Coventry et al, Usability and
Biometric Verification at the ATM Interface
Garfinkel, S. Email-Based
Identification and Authentication: An Alternative to PKI?, IEEE
Security and Privacy, November/December 2003.
Jermyn, I., Mayer, A., Monrose, F., Reiter, M. K., & Rubin,
A. D. (1999, August).
The
Design and Analysis of Graphical Passwords. Paper presented at the
Proceedings of the 8th USENIX Security Symposium.
National Bureau of Standards, Federal Information
Processing Standards Publication 112 --- Password Usage, May 30,
1985.
Welcome to Passfaces
Electronic Frontier Foundation, Biometrics:
Who's Watching You
Liu, Simon, and Silverman, Mark,
A Practical Guide to Biometric Security Technology
NIST: The Biometrics Resource Center Website
EPIC: "Biometric Identifiers"
United States General Accounting Office,
Using Biometrics for Border Security, November 2002.
Jim Liddell, Karen Renaud and Antonella De Angeli.
Using a Combination of Sound and Images to Authenticate Web Users.
Short Paper. HCI 2003. 17th Annual Human Computer Interaction Conference.
Designing for Society. Bath, England. 8-12 Sept, 2003."
Hour 1: Hacking
Hour 2: RFID
Boutin, Paul. Slammed!
An inside view of the worm that crashed the Internet in 15 minutes.
Staniford, Stuart, Paxson, Vern, and Weaver, Nicholas.
How to 0wn the Internet in Your Spare Time. Proceedings of the
11th USENIX Security Symposium (Security '02)
R. Morris and K. Thompson.
UNIX password security. Communications of
the ACM, 22(11):594--597, Nov. 1979.
Aleph One,
Aleph One, Smashing the Stack for Fun and Profit, in Phrack issue 49,
November 9, 1996.
eEye Digital Security: Analysis of the Code Red Worm
CERT Incident Note IN-2001-09: "Code Red II:" Another Worm Exploiting Buffer Overflow In IIS Indexing Service DLL
Zelonis, Avoiding the Cyber Pandemic: A Public Health Approach to
Preventing Malware Propagation.
Computer Records and the Federal Rules of Evidence
Audit
Trails in Evidence - A Queensland Case Study
Dynamic Instrumentation of Production Systems Paper (PDF - 236K)
SWATCH: The Simple WATCHer of Logfiles
LogAnalysis.Org
Security Utilities - Logfiles
Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations
The National Strategy to Secure Cyberspace
Stanford Website Credibility Project
Spoofing "Is it safe to enter my password into this window?". Trusted Path Micros0ft.com. Paypai.com.
Chapter 14, "Fighting Phishing at the User Interface," in Cranor and Garfinkel, Security and Usability.
Chapter 25, "Social Approaches to End-User Privacy Management," in Cranor and Garfinkel, Security and Usability.
Chou, Ledesma, Teraguchi, Boneh, and Mitchell, Client-side defense against web-based identity theft
Chapter 14, "Guidelines and Strategies for Secure Interaction Design,"
in Cranor and Garfinkel, Security and Usability.
Chapter 34, "Why Johnny Can't Encrypt,"
in Cranor and Garfinkel, Security and Usability.
Whitten, Alma, and J. D. Tygar, Safe
Staging for Computer Security, the CHI 2003 workshop paper
introducing safe staging.
Whitten, Alma, and J. D. Tygar, Usability
of Security: A Case Study, CMU-CS-98-155, the 26-page version of
Why Johnny Can't Encrypt
Dr. Andrew Patrick
Giving Johnny the Keys, Alma Whitten
Order of presentation:
Optional Readings
http://www.realuser.com/
Real User Corporation, PassFaces (cognometric authentication)
Links
Biometrics: The Journal of the International Biometric Society
Lecture 9 - Nov 21 : Threat Models, Computer Crime, Secure Coding and Translucent Databases
Midterm projects due
Lecture 10 - Nov 28 : Hacking and RFID
Required Readings
Optional Readings
http://www.cert.org/incident_notes/IN-2001-09.html
Lecture 11 - Dec 05 : Computer Crime, The Law, Logging, and Integrity Management
Hour 1: LOGGING What gets logged? Who are logs for? Logging in Unix and Windows. Logfile management. Data management. Visualization of logfiles Log file policies - who gets to see them. Anonymizing PII
Required Readings
Information Warfare (From Technology Review)
Links
CSI 2005 computer crime report.
http://swatch.sourceforge.net/
http://www.loganalysis.org/
http://www.ja.net/CERT/JANET-CERT/software/functions/logfiles.html
Optional Readings
The graphical analysis of computer log
Eick, files, Communications of the ACM, December 1994.
Lecture 12 - Dec 12 : Social Engineering and Phishing
Worms, Spyware, Social Engineering and Spoofing
Links
Trust Management for Humans -- Waterken YURL
http://www.waterken.com/dev/YURL/Name/
Lecture 13 - Dec 19 : Aligning Security and Usability
Can desktop software be designed in such a way as to promote interaction that is inherently more secure than is commonly seen today? We will focus on two proposals: Ka-Ping Yee's "User Interaction Design for Secure Systems" and Alma Whitten's "Safe Staging." Please read the first two papers and skim the full Whitten and Tygar report and come prepared to discuss.
Required Readings
Optional Readings
Links
Interaction Design for End-User Security
http://www.sims.berkeley.edu/~ping/sid/design.html
http://www.andrewpatrick.ca/
Lecture 14 - Jan 09 : Presentation of Final Projects 1
Order of presentation:
After the presentation we will have discussion.
Lecture 15 - Jan 23 : Presentation of Final Projects 2
Final project papers due at the start of class.
After the presentation we will have discussion.
After the presentation we will have discussion.