CMSC 23200/33250: Introduction to Computer Security

Week	Date	Topics	Instructor	Assignments & Reading Responses	Readings (Everyone)	Research Papers (CMSC 33250 only)
Week 1	1/10	(Held on Zoom) Course Introduction and the Security Mindset [slides]	Blase & David	Reading Response 1 due 1/12 (a day later than normal because it's the first week)	Textbook Chapter 1 and Sections 5.1-5.6. Gallagher. Securing Your Digital Life, Part One: The Basics, Ars Technica, October 25, 2021. Gallagher. Securing Your Digital Life, Part Tne: The Bigger Picture—and Special Circumstances, Ars Technica, October 27, 2021. Torres-Arias. What is Log4j? A Cybersecurity Expert Explains the Latest Internet Vulnerability, How Bad It Ss and What's at Stake, The Conversation, December 22, 2021. Sharma. Fintech Firm Hit by Log4j Hack Refuses to Pay $5 Million Ransom, Bleeping Computer, December 29, 2021. CyStack Editor. The Attack on ONUS – A Real-life Case of the Log4Shell Vulnerability, CyStack, December 28, 2021.	None
	1/12	(Held on Zoom) Basic Security Concepts and Threat Modeling [slides]	David	--
	1/14	(Held on Zoom) OS Security [slides]	David	--
Week 2	1/17	No class in observance of MLK Day	--	Reading Response 2 due 1/18	Textbook Chapter 6 and Sections 7.1-7.5.	Due 1/18 (a day later than normal because of the holiday): Cha et al. Unleashing MAYHEM on Binary Code, In Proc. IEEE Symposium on Security & Privacy, 2012.
	1/19	(Held on Zoom) Memory Vulnerabilities [slides]	David	Assignment 1 due 1/20
	1/21	(Held on Zoom) Memory Protection [slides]	David	--
Week 3	1/24	Software Security Techniques [slides]	David	Reading Response 3 due 1/25	Textbook Chapter 2. CVE-2020-11500 and CVE-2018-9195. Distefano et al. Scaling Static Analyses at Facebook, Communications of the ACM, August 2019.	Due 1/24: Heninger and Durumeric et al. Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices, In Proc. USENIX Security, 2012.
	1/26	Crypto Tools I [slides]	David	Assignment 2 due 1/27
	1/28	Crypto Tools II [slides]	David	--
Week 4	1/31	Authentication I (Approaches to Authentication, Password Storage) [slides]	Blase	Reading Response 4 due 2/1	Textbook Chapter 3. Dan Goodin. Anatomy of a Hack: How Crackers Ransack Passwords Like "qeadzcwrsfxv1331", Ars Technica, May 27, 2013. Apple. Password Monitoring, Apple Platform Security, February 18, 2021. James Mickens. This World of Ours, USENIX ;login:, January 2014.	Due 1/31: Liu et al. Reasoning Analytically About Password-Cracking Software. In Proc. IEEE Symposium on Security & Privacy, 2019.
	2/2	Authentication II (Password Cracking) [slides]	Blase	Assignment 3 due 2/3
	2/4	Authentication III (Password Replacements and Additions), Usable Security, Access Control [slides]	Blase	--
Week 5	2/7	How the Internet Works Part I [slides]	Blase	Reading Response 5 due 2/8	Textbook Sections 10.6 and 9.1-9.3. Martinho. Understanding How Facebook Disappeared from the Internet The Cloudflare Blog, October 4, 2021. Aas et al. Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web, In Proc. CCS, 2019. Bode. Apple, Cloudflare Join Forces To Encrypt DNS, TechDirt, December 11, 2020.	Due 2/7: Lauinger et al. Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web, In Proc. NDSS, 2017.
	2/9	TLS and X.509 Certificates [slides]	David	Assignment 4 due 2/10
	2/11	How the Internet Works Part II, How the Web Works Part I [slides]	Blase	--
Week 6	2/14	How the Web Works Part II [slides]	Blase	Reading Response 6 due 2/15	Textbook Sections 9.4-9.8. Portis. I Learned to Love the Same-Origin Policy, CSS Tricks, 2021. McMillan. How Heartbleed Broke the Internet — And Why It Can Happen Again, Wired, April 11, 2014. James Mickens. To Wash It All Away, USENIX ;login:, March 2014.	Due 2/14: Smith et al. SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking, In Proc. CCS, 2021.
	2/16	Web Attacks and Defenses I [slides]	Blase	Assignment 5 due 2/17
	2/18	Web Attacks and Defenses II [slides]	Blase	--
Week 7	2/21	Web Tracking and Identifiability [slides]	Blase	Reading Response 7 due 2/22	Textbook Chapter 11 and Sections 10.1-10.4. Manjoo and Bremer. I Visited 47 Sites. Hundreds of Trackers Followed Me., New York Times, August 23, 2019. Bindra. Building a Privacy-first Future for Web Advertising, Google Ads & Commerce Blog, January 25, 2021. Cyphers. Google's FLoC Is a Terrible Idea, EFF Deeplinks Blog, March 3, 2021.	Due 2/21: Bock et al. Weaponizing Middleboxes for TCP Reflected Amplification, In Proc. USENIX Security, 2021.
	2/23	Network Attacks and Defenses I [slides]	Blase	Assignment 6 due 2/24
	2/25	Network Attacks and Defenses II [slides]	Blase	--
Week 8	2/28	Data Privacy and Deanonymization [slides]	David	Reading Response 8 due 3/1	Dwork-Roth Textbook pages 3-33. Mervis. Can a Set of Equations Keep U.S. Census Data Private? Science Magazine, January 4, 2019. Krebs. Scary Chip Flaws Raise Spectre of Meltdown, Krebs on Security, January 5, 2018.	Due 2/28: Kocher et al. Spectre Attacks: Exploiting Speculative Execution, In Proc. IEEE Symposium on Security & Privacy, 2019.
	3/2	Differential Privacy [slides]	David	Assignment 7 due 3/3
	3/4	Hardware Security, Machine Learning Security, IoT Security [slides]	Blase	--
Week 9	3/7	Blockchain and Cryptocurrencies [slides]	David	Reading Response 9 due 3/8	Wallace et al. Does GPT-2 Know Your Phone Number?, BAIR Blog, December 20, 2020. Mattu and Hill. The House That Spied on Me, Gizmodo, February 7, 2018. Robertson. Apple's Controversial New Child Protection Features, Explained, The Verge, August 10, 2021.	Due 3/7: Sharif et al. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition, In Proc. CCS, 2016.
	3/9	Anonymity Tools, Current Topics in Cryptography [slides]	David	Assignment 8 due 3/10
	3/11	Security in Practice	Special Guests	Assignment 9 due 3/10 (graduating students) or 3/17 (non-graduating students)

Schedule and Assignments (Winter 2022)