• View
• Edit
• History
• Print

ReadingList

Past:

• General
  • Gray hat hacking
• Reading for Thursday, 1/24:
  • Reflections on Trusting Trust (short)
  • Protection of Information in Computer Systems (long)
  • A Contemporary Look at Saltzer and Schroeder's 1975 Design Principles
  • Suggested operating systems review: from Operating Systems: Three Easy Pieces
    • Chapter 6: Limited direct execution
    • Chapter 39:Files and directories
    • Chapter 15:Address translation
• Readings for Tuesday, 1/29:
  • Multics Security Evaluation: Vulnerability Analysis
  • TOCTTOU Vulnerabilities in UNIX-Style File Systems: An Anatomical Study
• Tuesday 2/5:
  • A Crash Course in x86 Assembly for Reverse Engineers
• Thursday: 2/7:
  • Smashing the stack for fun and profit
  • Basic integer overflows
    • Extra: Improving Integer Security for Systems with KINT
  • Format string vulnerabilities
  • Low-level Software Security by Example
• Tuesday 2/12:
  • The Hacker Strategy
  • Real world fuzzing
  • Syzkaller
  • Address Sanitizer
  • The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)
    • Extended version: Return-Oriented Programming:Systems, Languages, and Applications
• Thursday 2/14:
  • StackGuard
  • On the Effectiveness of Address-Space Randomization
  • Adapting Software Fault Isolation to Contemporary CPU Architectures
• Tuesday 2/19:
  • Securing Frame Communication in Browsers
  • Browser Security: Lessons from Google Chrome
• Thursday 2/21:
  • Cross Site Scripting Explained
  • Robust Defenses for Cross-Site Request Forgery, Barth et al.
  • Clickjacking Vulnerability and Countermeasures
  • Advanced SQL Injection In SQL Server Applications
• Thursday 2/28:
  • A Method for Obtaining Digital Signatures and Public-Key Cryptosystem
• Tuesday 3/12:
  • Transport layer security
  • Address Resolution Protocol Spoofing and Man-in-the-Middle Attacks
  • A Look Back at 'Security Problems in the TCP/IP Protocol Suite
• Tuesday 3/26:
  • An Illustrated Guide to the Kaminsky DNS Vulnerability
  • A Survey of BGP Security
• Tuesday 4/2:
  • Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
  • Bro: A System for Detecting Network Intruders in Real-Time
• Thursday 4/4:
  • Ignoring the great firewall of China
  • Tor: The second generation onion router
  • When Virtual is Harder than Real: Security Challenges in Virtual Machine Based Computing Environments
• Tuesday 4/9:
  • Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds
• Tuesday 4/16:
  • Intel Trusted Execution Technology
  • Introduction to the TPM
  • Attestation and Trusted Computing
  • A Trusted Open Platform
  • Using Innovative Instructions to Create Trustworthy Software Solutions
  • Intel® Software Guard Extensions(Intel® SGX) slides
  • Intel SGX Explained very long...
  • Bitlocker
• Reading for Thursday 4/18:
  • On the Spectre and Meltdown Processor Security Vulnerabilities
  • Time protection - the missing OS abstraction
• Tuesday 4/23
  • Exploiting the DRAM Rowhammer bug to gain kernel privileges
  • longer: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors
• Thursday 4/25
  • Why Information Security is Hard – An Economic Perspective
  • Why cryptosystems fail
• Tuesday 4/30:
  • How does Ethereum work anyway?
  • Bitcoin: A Peer-to-Peer Electronic Cash System