CS591Home ClassInfo PhotoAlbum Grade Assignments Homeworks Q&A Research Projects News Exams

Course No.: CS 591 Instructor: C. Edward Chow Class Time: MW 5:50-7:05 pm Office Address: ENS 186 Class Room: EN101 Office Hour: MW: 5:20-5:50pm; 7:05-7:35pm T:9:30-10:30am Office Phone: 262-3110 Email: chow@cs.uccs.edu; cedwardchow (screenname) on MS Messenger or use my email address to establish contact.

This web page has been accessed  times since 12/22/2006.

Course Objective:

Introduction to the study of computer and network security from the view of information warfare. Topics include information system threats, vulnerabilities and defensive mechanisms, including cryptography, authentication, digital signatures, PKI, vulnerability analysis, IDS/firewall..

• Introduction to Computer and Network Security
  • Metaspolit
  • Buffer Overflow Attack and Defense, related tools.
• Cryptography
  • Tanenbaum Chapter 8.
  • Secure Web Access
• Security Protocols
• Passwords
  • Security Engineering Chapter 3.
  • Linux Pluggable Authentication Modules (PAM).
• Access Control
  • MAC: SELinux
• Multilevel Security
• Multilateral Security
• Banking and Bookeeping
• Monitoring Systems
• Security Printing and Seals
• Biometrics
• Physical Tamper Resistance
• Electronic and Informatoin Warefare
• Telecom System Security
• Network Attack and Defense
  • Penetration Testing ; Colorado CTF (CANVAS) events
  • Firewall
  • IDS
  • DDoS and Autonomous Anti-DDoS Defense.
  • Secure Collective Network Defense.
• Protecting E-Commerce Systems
• Copyright and Privacy Protection
• E-Policy
• Management Issues
• System Evaluation and Assurance

Grades:

midterm(20%), final exam(20%), homework assignments(40%), web research/development project(20%)

Grade Query Web page

Class Info:

Class email list:You can send class related email to cs591-l@uccs.edu. Email to this mailing list will be forwarded to all cs591 class email accounts on uccs.edu. Use with caution.

Spring 2007 Class photo Album

F2005 Class photo Album


Please create a personal web page on CS Unix machines with your personal photo, basic vita,  your interests in this class,  and including later on the potential semester projects that you may work on .  Note that in Unix system, your personal web site will be located in a subdirectory called public_html of your home directory. Create an images directory under public_html. Put your photo image file there with <login>.jpg. Reference it as <img src="images/login.jpg">. This will allow your classmates to find common interests and know each other. I will use a Perl script to copy your photo images and create a class photo album. See http://cs.uccs.edu/~cs301/graphics/scanning.htm for scanning your personal photo.  If you do not have recent photo, drop by my office. I can take it with my digital camera. You can also use my personal web page as a template. If you do not know how to setup your personal web page, drop by my office and I will help you get started.  This is part of your hw#1.

If you use Windows system at home, try to use free SSH Secure Shelll software package with SSH Secure Shell Client,/Secure File Transfer Client, from http://www.ssh.org/support/downloads/secureshellwks/non-commercial.html, to login to CS Unix machines. It is secure since the password is not transmitted as clear text and all data are encrytped.
You can also setup xterm over ssh http://www.linuks.mine.nu/windows/sshx.html

Through Microsoft MSDN Academic Alliance program, our EAS system admin will setup an account for you on http://msdn07.e-academy.com/elms/Storefront/Home.aspx?campus=ucoloradohae_cs to download the software packages such as WinXP, Win2003 Server, Visual Studio 2005, SQL2005, visio2003 for the exercises/projects of this class.

In EAS 138 and 149, there are PCs. 3GHz, 1GB memory, Dell Optiplex GX270 for PCs in EAS138; 3.4GHz, 2GB memory, Dell OptiPlex GX280 for PCs in EAS149 faster. I have set up Fedora Core 6, WinXP, vista, Win20003 Server, Longhorn server, and previous iCTF vulnerability box image as virtual machines using VMWare for penetration testing, firewall/IDS/DMZ configuration, vulnerability analysis . For security reason, these virtual machines are configured with Local-Only network connection. They can talk to each other but not to the Internet

In EAS 143, we have set up 4 Dell Optiplex GX620 with Pentium D 3.2 GHz, 3.5GB memory, called viva, walrus, wind, and walden, to run the vmware server software package and configure customized Fedora Core 6 and Win2003 server virtual machines as servers for CS591 exercises. You can download and install the vmware server client GUI software in you own PC to configure and run the virtual machines on these servers.

Disability Service:

If you have a disability for which you are requesting an accommodation, you are encouraged to contact the Disability Services Office within the first week of classes. The Disability Services Office is located in Main Hall #105. (Phone # is 262-3354.)

Text:

"Security Engineering," Ross Anderson. He just put this book online. You can purchase hard copy if you like from John Wiley & Sons, ISBN 0-471-38922-6.

References

• Glossary:
  • Internet Security Glossary: rfc2828 by Bob Shirey of GTE/BBN May 2000
  • National Informaiton Assurance (IA) Glossary by CNSS, revised May 2003.
    
• Related Textbooks:
  • Charles P. Pfleeger, Shari Lawrence Pfleeger, "Security in Computing," 2003.
  • Matt Bishop, “Computer Security”
  • William Stallings. “Network Security Essentials: Applications and Standards.”
  • Kaufman, Perlman, Speciner. “Network Security: Private Communication in a Public World”.
  • Chapter 8 of Tanenbaum's Computer Networks.
• Os Hardening wiki.
• Cross Domain Solution wiki.
• UCCS iCTF 2006 wiki.
• Prof. Eugene H. Spafford's Keynote Speech, "What Comes Next in Infosec Research?", September 2003.
• Secure Programming for Linux and Unix HOWTO, by David Wheeler.
• Related Security Class Web Site:
  • Professor Vitaly Shmatikov's CS378: Network Security and Privacy
  • Stanford's CS155: Computer and Network Security
    
• SHA-1 is broken in Bruce Schneier’s Crypto-Gram Newsletter, 3/15/2005.
• Slammed! An inside view of the worm that crashed the Internet in 15 minutes, by Paul Boutin, July 11 2003 Wire magazine.
• Nice diagram on BGP message volume during attack
• Nice diagram on the number of jammed routes (cisco inferno), shows it took 24 hours to stamp out the worm.
• Screendump of a more complete slammer code, including the whole UDP payload.
• The Spread of the Sapphire/Slammer Worm, by David Moore Vern Paxson Stefan Savage Colleen Shannon Stuart Staniford Nicholas Weaver.
• Contains info about
• original advisory from David L it chfield of NGSSoftware,
• the disassembly code w it h annotation at eeye.com, it does not include buffer overflow part of the payload.
• the binary and disassembly code (no annotation) at immun it ysec.om
• Reflections on Trusting Trust, by Ken Thompson’s 1983 Turing Award lecture.
• It talks about self-reproducing program and Trojan horse.
• Comment on moral and “whiz kid” hacker.
• “You can't trust code that you did not totally create yourself.”
• “No amount of source-level verification or scrutiny will protect you from using untrusted code.”
• W32/Mydoom@MM Virus info from McAfee Virtual Information library.
• BBC new on mydoom.
• Method of Infection:
• Hosts Infected by executing the email attachment w it h virus.
• Copy it self to %SysDir%\taskmon.exe
• Create the following registry entry to hook Windows startup:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
• Create %SysDir%\shimgapi.dll (4,096 bytes)
• Inject shimgapi.dll into the EXPLORER.EXE upon reboot via this registry key:
  HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 "(Default)" = %SysDir%\shimgapi.dll
• Harvest email addresses by searching for  files w it h wab, adb, tbb, dbx, …, extension.
• It avoids certain addresses including .gov, .mil, Berkeley , bsd,…!
• Create new email addresses using harvested domain name w it h a set of common usernames.
• Send emails via it s own SMTP engine.
• When run after 2/1/2004 16:09:18 (UTC), it changes its behavior from mass mailing to initiating a denial of service attacks, 64 threads with HTTP GET requests to port 80 of www.sco.com.
• Peer to Peer Propagation. Copies itself to KaZaa Shared directory
• Remote Access Component: Open/listen TCP 3127 and 3198 ports

Related Web Site: