Cybersecurity
Course textbook: Wenliang Du, Computer Security: a hands-on approach, 3rd ed.
This is a hands-on course. It involves practical exercises developed by the author of the textbook (Professor Wenliang Du) and available from seedsecuritylabs.org. These exercises are somewhat similar to ticks, but they are not assessed and do not attract course credits. They require the use of the free Virtualbox hypervisor software, on which you will run a supplied virtual machine (the SEED VM, a preconfigured Ubuntu 20.04). For each lab you will install on it some vulnerable software to be attacked, together with the tools to attack it. Virtualbox itself only runs on machines with an x86 processor. I recommend you obtain an x86 machine ASAP and install Virtualbox on it, and then the SEED VM on that. Use of the Apple Silicon beta of Virtualbox to run the SEED labs is discouraged: it is known to be flaky and may cause you unwarranted headaches when things don't work as they should. It’s OK to use an old x86 that someone else is discarding, which you might get for free. My main Linux machine at home is about 10 years old and works fine for all the exercises in this course.
If you are unable or unwilling to procure an x86 box, a cloud-based alternative is available at very modest (even zero) cost, but you'll have to figure out how to set it up. Instructions on the SEED labs pages.
The hands-on content of the 1b security course will not be marked or ticked, so please don't waste your time and that of your supervisor by searching for solutions on the web: you will only be cheating yourself out of an education and you might as well not do the SEED labs at all. On the other hand, those who complete the labs on their own will acquire skills that will be advantageous during the exam. The practicals are as instructive as the lectures.
The course is challenging and demanding but I very much hope you will enjoy it. Best wishes and happy hacking.
Syllabus topics and associated SEED labs
There is a broad correspondence between topics and lectures but some topics may take more than 50 minutes and some less, so don't necessarily assume a 1-to-1 mapping with lecturing days.
- Introduction
- Access control
- Privilege escalation Environment_Variable_and_SetUID
- Buffer overflow Buffer_Overflow_Setuid
- Return to libc Return_to_Libc
- SQL injection Web_SQL_Injection
- Passwords
- CSRF Web_CSRF_Elgg
- XSS Web_XSS_Elgg
- TCP attacks TCP_Attacks
- Human factors
- Malware and physical security
HELPDESK
(NEW FOR 2023)We have two competent and friendly Teaching Assistants, Peter Rugg and Dimitrije Erdeljan, who will run helpdesk sessions in the Intel lab to help you sort out any problems you may encounter with the SEED labs (including setting up your VM). Please get started early on the SEED labs if you wish to be able to benefit from these sessions. It will do you no good to leave the labs until the week before the exams and then try to get help on all labs in one go when everyone else also is.
All sessions are in the Intel Lab from 14:00 to 16:00. Peter is there on Wednesday 3, 24 and 31 May 2023 while Dimitrije is there on Friday 12, 19 and 26 May 2023. Note that this is not all the Wednesdays and Fridays in term. Note also that the last two help sessions (26 and 31 May) are between the end of the lecture course and the exams.
If, depending on demand, it becomes necessary to set up a booking system, details of it will be published here.