Security

A.Y. 2019/2020
6
Max ECTS
48
Overall hours
SSD
INF/01
Language
Italian
Learning objectives
This course we will explore the foundations of software security. We will consider important software vulnerabilities and attacks that exploit them -- such as buffer overflows, heap overflow and use after free -- and we will consider defenses that prevent or mitigate these attacks, including advanced testing and program analysis techniques such as symbolic execution and fuzzing.
Expected learning outcomes
Successful learners in this course will typically be able to apply basic low attack techniques such as buffer overflow, heap overflow. Moreover he/she will be able to understand the state-of-the-art of the defensive techniques along with such specific program testing and program analysis techniques for discovering memory errors in C/C++ languages. The student should have completed junior-level undergraduate work in a technical field, have some familiarity with programming, ideally in C/C++, and have prior exposure to algorithms.
Single course

This course cannot be attended as a single course. Please check our list of single courses to find the ones available for enrolment.

Course syllabus and organization

Single session

Responsible
Lesson period
First semester
Course syllabus
Low-Level Attacks
1 - Introduction
2 - Buffer Overflow
3 -Lab Buffer overflow
4- Heap Overflow Lab Heap Overflow
5 -Use after Free (UAF)
6 -Lab UAF

Low-Level Security: Defense
1- Introduction
2- Memory Safety
3- Type Safety + Avoid Exploitation
4- ROP Return Oriented Programming
5- ROP lab
6- CFI

Static and Dynamic Flow
1 - Introduction
2- Static Analysis
3- Data Flow analysis

Symbolic Execution
1 - Introduction
2 - Symbolic Execution
3 - Lab of Symbolic Execution
Prerequisites for admission
The Prerequisite for this course are:

1 - Operating System Course
2 - Security and Privacy Course
3 - Good Knowledge of C programming language
Teaching methods
Classic Lecture
Assessment methods and Criteria
The exam is split in two parts: (1) First part is a test with several questions to attest the theoretical background of the student, (2) and the second part is a practical session where the student will check its own security hands-on skill.
INF/01 - INFORMATICS - University credits: 6
Lessons: 48 hours
Professor: Lanzi Andrea
Shifts:
-
Professor: Lanzi Andrea
Professor(s)