Readings
Paper Response Guidelines
Write a ~400 word critical response and comments to each required paper. Focus on the following:
- State the problem that they try to solve and the main contributions.
- Describe the key insight or novelty of their proposed work or approach.
- What are the weakness/limitations of the paper? Write the criticisms.
- Any improvements or related ideas that you can suggest?
Your most important task is to demonstrate that you've read the paper and thought carefully about the topic. No copy and paste of the original paper text!
Paper responses are due before the start of class via Canvas Assignments.
Discussion Lead and Bonus
Please take a look at the papers in each session. If you are interested in leading the discussion of any session, you should sign up on the sign-up sheet in Canvas and get a bonus for waiving 4 paper summaries.As a discussion lead, two tasks are expected: 1) You will provide a 20-min presentation of the paper that will be discussed in class with slides. 2) You should prepare yourself by reading the technical details carefully and coming up with a list of discussion points. The discussion points should be designed to engage students in critical and creative thinking. Think about the points ahead of time and be prepared to answer questions other students may throw at you.
Send ahead of time your discussion points to me on Canvas and get feedback from me. Please allow 2 days to receive the feedback. This will be a good opportunity for you to learn to discuss ideas around a research topic and it generally helps your presentation/communication skills.
Reading List
Most papers should be publicly accessible. If any links are broken, please search for them. If any of them require paid subscription, you can access them for free when connecting on campus. For off-campus access, try UCI VPN.
Week 1
Monday, March 30
- Introduction.
- The Security Mindset, Bruce Schneier. 2008.
Wednesday, April 1 – Software Security I
- Smashing the Stack for Fun and Profit. Aleph One. Phrack 49(14), Nov. 1996. -- No summary required; Just read this and come to class
Week 2
Monday, April 6 – Software Security II
- StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. Cowan, Pu, Maier, Hinton, Walpole, Bakke, Beattie, Grier, Wagle, and Zhang. Usenix Security 1998.
- On the Effectiveness of Address-Space Randomization. Shacham, Page, Pfaff, Goh, Modadugu, and Boneh. CCS 2004.
- A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities, Wagner, Foster, Brewer, and Aiken. NDSS 2000
Wednesday, April 8 – Software Security III
- Form your project group by today!
- The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). Hovav Shacham. CCS 2007.
- Control Flow Integrity for COTS Binaries. Zhang and Sekar. Usenix Security 2013.
- N-Variant Systems: A Secretless Framework for Security through Diversity, Cox, Evans, Filipi, Rowanhill, Hu, Davidson, Knight, Nguyen-Tuong, Hiser. USENIX Security 2006
- Modular Control-Flow Integrity. Niu and Tan. PLDI 2014.
Week 3
Monday, April 13 – Software Security III (Cont'd)
- The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). Hovav Shacham. CCS 2007.
Wednesday, April 15 – Malware & Isolation
- Understanding Linux Malware. Cozzi, Graziano, Fratantonio, Balzarotti. IEEE S&P 2018.
- Reflections on Trusting Trust. Ken Thompson. Communications of the ACM, 27(8), Aug. 1984.
- SchrodinText: Strong Protection of Sensitive Textual Content of Mobile Applications. Ardalan Amiri Sani. Mobisys 2017.
- ret2dir: Rethinking Kernel Isolation. Kemerlis, Polychronakis, Keromytis. USENIX Security 2014.
- From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel. Xu, Li, Shu, and Yang. CCS 2015.
- ProtectIOn: Root-of-Trust for IO in Compromised Platforms. Dhar, Ulqinaku, Kostiainen, and Capkun. NDSS 2020.
Week 4
Monday, April 20 – Smartphone Systems Security I
-
DREBIN:
Effective and Explainable Detection of Android Malware in Your Pocket.
DArp, Spretzenbarth, Huner, Gascon, and Rieck.
NDSS 2014.
- Dissecting Android Malware: Characterization and Evolution. Zhou and Jiang. IEEE S&P 2012.
- DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis. Yan and Yin. Usenix Security 2012.
Wednesday, April 22 – Pre-Proposal Presentation
- No readings!
Week 5
Monday, April 27 – Smartphone Systems Security II
- Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks. Chen, Qian, and Mao. Usenix Security 2014.
- What the App is That? Deception and Countermeasures in the Android User Interface. Bianchi, Corbetta, Invernizzi, Fratantonio, Kruegel, and Vigna. IEEE S&P 2015.
- Cloak and Dagger: From Two Permissions to Complete Control of the UI Feedback Loop. Fratantonio, Qian, Chung, and Lee. IEEE S&P 2017.
Wednesday, April 29 – Smartphone Systems Security
III: Guest Lecture, Prof. Joshua
Garcia (Informatics)
- Written proposal due on Friday, May
1!
- No readings!
- Android Permissions Remystified: A Field Study on Contextual Integrity. Wijesekera, Baokar, Hosseini, Egelman, Wagner, and Beznosov. USENIX Security 2015.
- Android Permissions Demystified. Felt, Chin, Hanna, Song, and Wagner. CCS 2011.
- PScout: Analyzing the Android Permission Specification. Au, Zhou, Huang, and Lie. CCS 2011 .
Week 6
Monday, May 4 – IoT/CPS Systems Security I
- ContexIoT: Towards Providing Contextual Integrity to Appified IoT Platforms. Jia, Chen, Wang, Rahmati, Fernandes, Mao, and Prakash. NDSS 2017.
- Security Analysis of Emerging Smart Home Applications. Fernandes, Jung, and Prakash. IEEE S&P 2016.
- SoK: Security Evaluation of Home-Based IoT Deployments. Alrawi, Lever, Antonakakis, and Monrose. IEEE S&P 2019.
Wednesday, May 6 – IoT/CPS Systems Security II
- Plug-N-Pwned: Comprehensive Vulnerability Analysis of OBD-II Dongles as A New Over-the-Air Attack Surface in Automotive IoT. Wen, Chen, and Lin. Usenix Security 2020.
- Comprehensive Experimental Analyses of Automotive Attack Surfaces. Checkoway, McCoy, Kantor, Anderson, Shacham, Savage, Koscher, Czeskis, Roesner, and Kohno. Usenix Security 2011.
- Experimental Security Analysis of a Modern Automobile. Koscher, Czeskis, Roesner, Patel, Kohno, Checkoway, McCoy, Kantor, Anderson, Shacham, and Savage. IEEE S&P 2010.
- Remote Exploitation of an Unaltered Passenger Vehicle. Miller and Valasek. DEF CON 23, Aug. 2015.
Week 7
Monday, May 11 – IoT/CPS Systems Security III
- Exposing Congestion Attack on Emerging Connected Vehicle based Traffic Signal Control. Chen, Yin, Feng, Mao, and Liu. NDSS 2018.
- Green Lights Forever: Analyzing the Security of Traffic Infrastructure. Ghena, Beyer, Hillaker, Pevarnek, and Halderman. Usenix WOOT 2014.
Wednesday, May 13 – Machine Learning Security I
- Fooling Detection Alone is Not Enough: Adversarial Attack against Multiple Object Tracking. Jia, Lu, Shen, Chen, Chen, Zhong, and Wei. ICLR 2020.
- Towards Evaluating the Robustness of Neural Networks. Carlini, and Wagner. IEEE S&P 2017.
- Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks. Papernot, McDaniel, Wu, Jha and Swami. IEEE S&P 2016.
Week 8
Monday, May 18 – Machine Learning Security II
- Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. Wang, Yao, Shan, Li, Viswanath, Zheng, and Zhao. IEEE S&P 2019.
- Certified Robustness to Adversarial Examples with Differential Privacy. Lecuyer, Atlidakis, Geambasu, Hsu, and Jana. IEEE S&P 2019.
- Formal Security Analysis of Neural Networks using Symbolic Intervals. Wang, Pei, Whitehouse, Yang, and Jana. Usenix Security 2018.
Wednesday, May 20 – Sensor/Analog Security
- Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving. Cao, Xiao, Cyr, Zhou, Park, Rampazzi, Chen, Fu, and Mao. CCS 2019.
- DolphinAttack: Inaudible Voice Commands. Zhang, Yan, Ji, Zhang, Zhang, and Xu. CCS 2017.
- Illusion and Dazzle: Adversarial Optical Channel Exploits against Lidars for Automotive Applications. Shin, Kim, Kwon, and Kim. CHES 2017.
- Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors. Tu, Lin, Li, and Hei. Usenix Security 2018.
Week 9
Monday, May 25
No class! Enjoy the Memorial Day!Wednesday, May 27 – Physical Security
- An Introduction to Lock Picking: How to Pick Pin Tumbler Locks -- No summary required; Just read this and come to class
- Reconsidering Physical Key Secrecy: Teleduplication via Optical Decoding. Laxton, Wang, and Savage. CCS, 2008.
- Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks. Matt Blaze. IEEE Security and Privacy, 2003.
- Security Analysis of a Widely Deployed Locking System. Weiner, Massar, Tews, Giese, and Wieser. CCS 2013.
Week 10
Monday, June 1 – Project Presentation
- No readings!
Wednesday, June 3 – Project Presentation
- No readings!