ENEE457 Computer Systems Security: Fall 2024 Lecture Summaries

• Lecture 1 (8/26, corresponds to pre-recorded Lecture 1). Some additional class notes (see slides 26-35) can be found here.
• Lecture 2 (8/28, corresponds to pre-recorded Lecture 2).
  Next class (9/4) we will do a Class Exercise that will help you on Project 1. If you'd like to download the code for the class exercise it can be found here. You may bring your laptop to class and follow along if you wish, but it is not required.
• Lecture 3 (9/9, corresponds to pre-recorded Lecture 3).
• Lecture 4 (9/11, corresponds to pre-recorded Lecture 4). See also Class Exercise which we will do together during class. See also Class Exercise Solutions.
• Lecture 5 (9/16, corresponds to pre-recorded Lecture 5).
• Lecture 6 (9/18, corresponds to pre-recorded Lecture 6).
• Lecture 7 (9/23, corresponds to pre-recorded Lecture 7). See also Class Exercise. See also Class Exercise Solutions.
• Lecture 8 (9/25, corresponds to pre-recorded Lecture 8). Some additional class notes can be found here.
• Lecture 9 (9/30, corresponds to pre-recorded Lecture 9). Some additional class notes can be found here.
• Lecture 10 (10/2, corresponds to pre-recorded Lecture 10). Some additional class notes can be found here. See also Class Exercise which we will do together during class. See also Class Exercise Solutions.
• (10/7)--Finishing up material posted above for 10/2. Some additional class notes can be found here.
• Lecture 11 (10/9, some overlap but does not exactly correspond to pre-recorded Lecture 11). On (10/21) we finished this lecture. Some additional class notes can be found here.
• Lecture 12 (10/23, some overlap but does not exactly correspond to pre-recorded Lecture 12). Some additional class notes can be found here.
• Lecture 13 (10/28, corresponds to pre-recorded Lecture 13).
• Lecture 14 (10/30, corresponds to pre-recorded Lecture 14). See also Class Exercise which we will do together during class. See also Class Exercise Solutions.
• Lecture 15 (11/9, corresponds to pre-recorded Lecture 15). See also Class Exercise which we will do together during class. See also Class Exercise Solutions.
• In Class Lab 1 (11/6). Please download lab setup files from here. Students who have an Apple Silicon machine may complete the same lab using the Setup files for Apple Silicon machines (the Labsetup-arm.zip file). You will also need Sniffer, Spoofer, Sniff and Spoof.
  
  Overview: We will do a brief introduction to TCP/IP. We will then setup the lab (docker containers) and discuss the various tools that will be used throughout the lab (SCAPY, Wireshark, Telnet, ping, ifconfig). We will do a first task together that is not from the SEED labs. You will then work on Tasks 1.2 and 1.3 from here individually or in small groups. Finally, you will be asked to begin working on Task 1.4 from here and, once completed, turn in a short lab report (describing what you did to successfully complete Task 1.4) with screenshots of your code and of your terminal during a successful attack (due date: Nov 13 at 11:59pm).
  
  
• In Class Lab 2 (11/11). Please download lab setup files from here (lab setup files for Apple Silicon machines can be found there too). You will also need Synflood, Reset, Reverse Shell.
  
  Overview: We will look in more detail at the TCP protocol. We will then setup the lab (docker containers) and discuss the three types of attacks on TCP that we will run. We will work on the first attack together (SYN Flooding Task 1 from here). You will then work on the RST attack from Task 2 here individually or in small groups. Finally, you will be asked to begin working on the session hijacking/reverse shell attack from Task 4 here and, once completed, turn in a short lab report with screenshots of your code, of your terminal, and of Wireshark, during a successful attack (due date: Nov 18 at 11:59pm).
  
  The following commands will be useful for the SYN Flooding attack:
  sysctl net.ipv4.tcp_max_syn_backlog
  sysctl -w net.ipv4.tcp_max_syn_backlog=80
  netstat -nat
  netstat -tna | grep SYN_RECV | wc -l
  ss -n state syn-recv sport = :23 | wc -l
  ip tcp_metrics show
  ip tcp_metrics flush
  
  
• In Class Lab 3 (11/13). Please download lab setup files from here (Apple Silicon files can be found on that page as well). You will also need DNS Cache Poisoning.
  
  Overview: We will learn all about DNS Servers! We will then setup the lab (docker containers) and execute three attacks of increasing severity, culminating in a full-fledged DNS Cache Poisoning attack. We will work on the first attack together (Task 1 from here). You will then work on the second attack from Task 2 here individually or in small groups. Finally, you will be asked to begin working on Task 3 here and, once completed, turn in a short lab report with screenshots of your code, of your terminal, and of Wireshark, during a successful attack (due date: Nov 20 at 11:59pm). Please make sure that your attack exhibits a behavior that occurs after correctly launching Task 3 but does not occur after launching Task 2.
  
  The following commands will also be useful:
  rndc dumpdb -cache
  rndc flush
  cat /var/cache/bind/dump.db
  grep "example" /var/cache/bind/dump.db
  tc qdisc add dev eth0 root netem delay 100ms
  tc qdisc del dev eth0 root netem
  tc qdisc show dev eth0
  
  
• In Class Lab 4 (11/18). Please download lab setup files from here. (Apple Silicon files can be found on that page as well).
  
  Overview: We will go through a brief introduction on Firewalls and specifically on a built-in firewall on Linux known as iptables. We will then setup the lab (docker containers) and experiment with setting various rules in iptables for the INPUT, OUTPUT, and FORWARD chains (Tasks 2.A, 2.B, 2.C from here). Finally, you will be asked to begin working on Task 3 (both parts A and B) here and, once completed, turn in a short lab report with screenshots of your iptable commands, your firewall rules, and terminals of the relevant docker containers (due date: Nov 25 at 11:59pm).
  
  The following commands will also be useful:
  iptables -t filter -L -n --line-numbers
  iptables -P OUTPUT DROP
  iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  iptables -A FORWARD -p icmp --icmp-type echo-request -j DROP
  iptables -A FORWARD -i eth0 -p tcp --sport 5000 -j ACCEPT
  
  A comprehensive list of iptables commands can be found here.
• Lecture 16 (11/20, corresponds to pre-recorded Lecture 17).
• Optional Lecture 17 (11/25, corresponds to pre-recorded Lecture 16).
• Lecture 18 (12/2, corresponds to pre-recorded Lecture 19).
• Lecture 19 (12/4, corresponds to pre-recorded Lecture 18). See also Class Exercise which we will do together during class. See also Class Exercise Solutions.
• Notes from Final Review Session (12/9).