CSC 495 — More Information
Stories from Lecture 1 (Jan. 13)
Heartbleed links
Related to Lecture 2 (Jan. 15)
-
Guidelines for Security Vulnerability Reporting and Response - from the Organization for Internet Safety, Sept. 1, 2004
Mailing lists and feeds for vulnerability announcements and security news
-
SecurityFocus mailing lists, including Bugtraq
-
US-CERT feeds - includes alerts and weekly bulletins
-
Open Source Security group
News sites and blogs
A few more high-quality blogs that are not in the slides
-
A Few Thoughts on Cryptographic Engineering - Matthew Green’s blog
Related to Lecture 3 (Jan 22)
Note: Several other links in the lecture notes
-
Software Insecurity: The Problem with the White House Cybersecurity Proposals - Steve Bellovin’s blog post
-
Shopping for Zero-Days: A Price List for Hackers' Secret Software Exploits - by Andy Greenberg (Forbes)
-
Cards Stolen in Target Breach Flood Underground Markets - Krebs on Security article with info about underground card shops (markets for stolen credit cards)
-
Before we knew it: an empirical study of zero-day attacks in the real world by Leyla Bilge and Tudor Dumitras. 2012 ACM Conference on Computer and Communications Security (CCS). Full paper at the link from UNCG hosts, or this link from anywhere
-
The NSA hacks other countries by buying millions of dollars' worth of computer vulnerabilities - The Washington Post
-
Bug Bounty and Responsible Disclosure Programs
-
The Known Unknowns: Empirical Analysis of Publicly Unknown Security Vulnerabilities, by Stefan Frei (NSS Labs)
-
Meet the Hackers Who Sell Spies the Tools To Crack Your PC (And Get Paid Six-figure Fees) - by Andy Greenberg (Forbes) - a particularly good story on the Vupen "vulnerability vendor"
Related to Systems Review Lectures (Jan 29 and Feb 3)
-
GDB Cheat Sheet - PDF version - this "cheatsheet" is focused on GDB commands that are often used in reverse engineering rather than source-level debugging
Related to Feb. 5 lecture
-
Recent vulnerability story: The GHOST Vulnerability - from the Qualys Blog
Related to Assignment 2
grep is a very powerful tool that is integral to Assignment 2, and everyone who works with Unix systems in a technical way should become comfortable with this tool. The following tutorials get you started using grep — there’s a whole lot more to it than just this, however!
-
Drew’s grep tutorial - an excellent introduction to the basics of grep (with a link to a more extensive tutorial on regular expressions)
-
How To Search Your Source With Grep - a few examples specifically oriented at search source code
-
15 Practical Grep Command Examples in Linux/Unix - examples, example, examples!
Related to Static Analysis
-
A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World - CACM article by Al Bessey, Ken Block, Ben Chelf, Andy Chou, Bryan Fulton, Seth Hallem, Charles Henri-Gros, Asya Kamsky, Scott McPeak, and Dawson Engler. Amusing tales of the challenges of taking a Stanford research project and turning it into a commercial product (the Coverity Static Analysis tool).
Some recent and relevant news stories and publications
-
MIT Researchers Debut Debugger for Integer Overflows - story on Threatpost (Kaspersky Labs)
-
Toward More Secure Software - essay by Dorothy Denning in the April 2015 Communications of the ACM about approaches to vulnerability markets and liability
-
Researchers try to hack the economics of zero-day bugs - Story at Ars Technica (by Sean Gallagher) reporting on research about vulnerability markets
More on Secure Design/Coding
-
SAFECode: Fundamental Practices for Secure Software Development, 2nd edition — A Guide to the Most Effective Secure Development Practices in Use Today (our focus is on "Secure Coding Practices" on pages 12-38)
-
The Protection of Information in Computer Systems - Saltzer and Schroeder’s classic 1975 paper introducing their 8 design principles