Cybersecurity
Course textbook: Wenliang Du, Computer Security: a hands-on approach, 3rd ed.
The course handout is available for download by Cambridge CST1b students. It does not replace the textbook.
Prerequisite: Unix Tools
The very useful Unix Tools course is a prerequisite to this one. If you are a wizard of the Unix command line, good for you. If you unwisely skipped Unix Tools in Michaelmas because it was not examinable, please catch up now (at least the first three lectures) or you'll have trouble following Cybersecurity.
Practical work: the SEED labs
This is a hands-on course. It involves practical exercises developed by the author of the textbook (Professor Wenliang Du) and available from seedsecuritylabs.org. These exercises are somewhat similar to ticks, but they are not assessed and do not attract course credits. They require the use of the free Virtualbox hypervisor software, on which you will run a supplied virtual machine (the SEED VM, a preconfigured Ubuntu 20.04). For each lab you will install on it some vulnerable software to be attacked, together with the tools to attack it. Virtualbox itself only runs reliably on machines with an x86 processor.
It is OK to use an old x86 that someone else is discarding, which you might get for free. My main Linux machine at home is over 10 years old and works fine for all the exercises in this course.
If you are unable or unwilling to procure an x86 box, you may use a cloud-based alternative instead, many of which are currently free to Cambridge students. Instructions on the SEED labs pages will help you figure out how to set it up. Among the free options, our TA recommends Azure, which he has just re-tested for 2024.
The hands-on content of the 1b security course will not be marked or ticked, so please don't waste your time and that of your supervisor by searching for solutions on the web: you will only be cheating yourself out of an education and you might as well not do the SEED labs at all. On the other hand, those who complete the labs on their own will acquire skills that will be advantageous during the exam. Solving the challenges in the practicals is as instructive as studying the lectures.
The course is challenging and demanding but I very much hope you will enjoy it. Best wishes and happy hacking.
Syllabus topics and associated SEED labs
There is a broad correspondence between topics and lectures but do not assume a 1-to-1 mapping with lecturing days. Here is the mapping between topics and SEED labs.
- Introduction
- Access control
- Privilege escalation Environment_Variable_and_SetUID
- Buffer overflow Buffer_Overflow_Setuid *
- Return to libc Return_to_Libc
- SQL injection Web_SQL_Injection *
- Passwords
- CSRF Web_CSRF_Elgg
- XSS Web_XSS_Elgg *
- Human factors
- Malware and physical security
Helpdesk
We have a competent and friendly Teaching Assistant, Peter Rugg, who will run weekly helpdesk sessions to help you sort out any problems you may encounter with the SEED labs (including setting up your VM). Please get started early on the SEED labs if you wish to be able to benefit from these sessions.
The helpdesk sessions are in the Intel Lab on the first four Fridays in May 2024 (3, 10, 17, 24) from 14:00 to 16:00.