Computer and Network Security (203.3448/203.4448) - Winter 2011

• General Information
• Announcements
• Slides
• References and Online Material
• Homework Assignments
• Past Exams
• From the News

---

Winter 2011 General Information

Syllabus:

• In PDF

Course's staff

• Instructor: Orr Dunkelman,
  phone 8447, room 408.
  Office hour: Sun. 15:00-16:00

Class hours

• Lecture: Sun. 10:10-13:00, Jacobs 305.

Exam dates

• Final Exam A: Sun., 5/2/12.
• Final Exam B: Tue., 6/3/12.

Grading policy

• 30% Homework Magen - 5 exercises, each worth 6% Magen.
• 70% Final Exam

Exam grades below 46 will not be combined with the grades of the exercises!

Prerequisites and Requirements

• Operating Systems - 203.2110
• Introdcution to Cryptography - 203.4444

Students who did not take Introduction to Cryptography: Many of you have asked about taking this course without the prerequisite of Introduction to Cryptography.

• Graduate students may take the course, but they MUST read and understand the material of Introduction to Cryptography before the semester begins. If you are a graduate student, it is your responsibility.
• Undergraduate students - generally, you will not be allowed. However, if your average is above 90, you may consider contacting me by email (please send your name, ID #, semester, and list of courses and grades).

(the rules may change at any given time)

---

Announcements

• 1.12.11 - Next Sunday, 4.12, there will be no class.
• 18.12.11 - Please note an update to Q1 in exercise 2. There is a small correction.
• 27.12.11 - Tomorrow, 28.12, there will be a special talk in the technion concerning Stuxnet. For More info.
• 22.1.12 - Please note that in IKE, hash_r depends on SA_i and not SA_r!
• 25.1.12 - Office hour before Moed A will be held on Wed. 1/2, at 15:30-17:00.
• 29.2.12 - Office hour before Moed B will be held on Mon. 5/3, at 16:00-18:00.

---

Lecture slides:

Topic	Lecture	Slides	Comments
Introduction	30/10, 6/11	PDF
Secure Code Design	6/11, 13/11	PDF	Bobby Tables
Applied Cryptology	13/11, 20/11	PDF	The true story of Alice, Bob, and Eve
Public Key Infrastructure	27/11	PDF	Don't Drink and Sign Certificates
Entrance Control	11/12, 18/12	PDF	Password Reuse
Network Threats	18/12, 1/1	PDF	Real Threats
Firewalls	1/1, 8/1	PDF
IPsec	8/1,15/1	PDF
IKE	15/1,22/1	PDF
SSL	22/1	PDF
Wireless Security	29/1	PDF

Slides are in PDF format. I may change the slides a little bit before and after the lecture. Be aware of changes.

---

Recommended reference material

On-line material

• Cryptographic Standards:
  • DES and triple-DES Specifications
  • AES Specifications
  • FIPS-180 (SHA1, SHA2, etc.)
  • Digital Signature Standard (FIPS-186, June 2009)
  • The Keyed-Hash Message Authentication Code (HMAC) (FIPS-198 Mar 6, 2002)
  • A Stick Figure Guide to the Advanced Encryption Standard (AES)
• Security Policies:
  • SANS' Information Security Policy Templates
• Computer Security Standards:
  • A One-Time Password System (S/KEY) in RFC 2289
  • The SRP Authentication and Key Exchange System in RFC 2945
  • The Internet Key Exchange (IKE) in RFC 2409
  • The Internet Key Exchange (IKEv2) in RFC 4306
• Computer attacks:
  • Aleph One: Smashing The Stack For Fun And Profit
  • SQL Injection
  • XSS (cross site scripting)
• General computer security information:
  • Rudimentary Treatise on the Construction of Locks, 1853 (excerpt)
  • Chen, Wagner and Dean: Setuid Demystified
  • The "mizrachi verdict"
  • Thompson: Reflections on Trusting Trust
  • Default passwords in safes

---

Homework

Submission is to Orr's mailbox (#19) only.

Assignment	Due	Comments
Homework #1	5/12/2011, 14:00	Regular mine sweeper boards Special mine sweeper boards
Homework #2	21/12/2011, 14:00	Please note an update to Question 1(a). It is Cameron who signs certificates for Rutte, Putin, and Faymanni (not Tusk!)
Homework #3	11/1/2012, 14:00
Homework #4	25/1/2012, 14:00	Firewall Table SAD Table SPD Table
Homework #5	1/2/2012, 14:00

---

Past Exams

As the course is very similar to the one that I used to teach at the Technion, sample exams can be found on the Computer Security course website.

• Moed B, winter 2011
• Moed A, winter 2011

---

From the News

• Computer Virus Hits U.S. Drone Fleet (Oct 7, 2011)
• Scientists break card that secures homes, offices, transit (Oct 10, 2011)
• Sony shut down accounts due to hacking attempts (Oct 12, 2011)
• Chinese hackers hacking into American satellites (Oct 28, 2011)
• Mac OS X Trojan steals processing power to produce Bitcoins (Oct 31, 2011)
• A Malaysian CA was removed from Firefox' trusted CAs (Nov 3, 2011)
• Apple to close security researcher's account (Nov 8, 2011)
• Hackers steal sensitive information in Norway (Nov 18, 2011)
• Hackers succeeded to hack water systems in the US (Nov 20, 2011)
• Attack on water systems in the US - due to weak password (Nov 20, 2011)
• List of 25 worst passwords (Nov 20, 2011)
• Rootkit Keylogger on Most US Smartphones (Nov 30, 2011)
• Android glitch allows hackers to bug phone calls (Nov 30, 2011)
• A Zero-Day in Acrobat Reader (Dec 8, 2011)
• Hacking and Breaking in Phyiscally (Dec 8, 2011)
• Computer virus affects hospitals (Dec 20, 2011)
• TOR explained (Dec 25, 2011)

---