CE6107
電腦攻擊與防禦
The Attack and Defense of Computers

• 錢宇倫 (rumyyyy283 at gmail dot com)
  • Office Hour:
  • Location: Room B322-1
• 陳衍廷 (yenting95015 at gmail dot com)
  • Office Hour: .
  • Location: Room B322-1

Grade

• Total Grades (posted: )

1. Syllabus (8th Sep.)
2. Buffer Overflow Attacks (15th Sep.)
   • Do NOT go to the classroom.
   • Video (posted: 14th Sep.)
3. Return-into-libc attacks, BOA Countermeasures (22nd Sep.)
4. Malware: Logic Bombs, Key Logger, URL Injection, Browser Hijackers, Trojan Horses, Spyware, and Internet Worms. (29th Sep.)
5. Malware: Logic Bombs, Key Logger, URL Injection, Browser Hijackers, Trojan Horses, Spyware, and Internet Worms. (6th Oct.)
6. Disk Layout, BIOS, and Viruses(13th Oct.)
7. Fileless Malware (20th Oct.)
   • Windows Fileless Malware
     • Powershell
     • Registy
     • Macro
     • HTA
     • Metasploit
     • PsExec
   • Linux Fileless Malware
   • Do NOT go to the classroom.
   • Video
8. Magic Cookies, Web Bugs, and HTTP cookie (27th Oct.)
9. Magic Cookies, Web Bugs, and HTTP cookie (3rd Nov.)
10. Cross-Site Scripting (XSS) (10th Nov.)
11. Cross-stie Request Forgery
    SQL Injection (17th Nov.)
12. Midterm (24th Nov.)
    • Date:24th Nov.
    • Location: Classroom
    • The exam questions are given in the short essay form.
    • Close book exam.
13. DoS/DDoS Attacks. (1st Dec.)
14. Security of AI (8th Dec.)
15. Vehicle Security (15th Dec.)
    • Do NOT go to the classroom.
    • Video
16. Final Exam (22nd Dec.)
    • Date:22nd Dec.
    • Location: classroom

• supplementary material, not covered in the final exam.
  • Botnet
  • Backdoors.
  • sniffer, and Rootkits for Linux/Unix
  • Rootkits for Windows
  • DOM-based XSS
  • Account Stealing and TCP Session Hijacking
  • ARP Spoofing and Format String Attacks
  • Whois Server
  • Idle Scan, OS Fingerprinting, Footprinting, and Port Scanning.
  • DNS Servers and DNS Server Attacks

Bonus Competition

• If you win an excellent award in the following important contests this semester, we may add at most 80 points to your final grade of this course.
  • 金盾獎：https://security.cisanet.org.tw/index.aspx
  • HITCON CTF： 這個是線上的比賽，來參賽的隊伍都是世界各地的高手，難度會高一點。

Project

• GDB & PWN Tools
• VirtualBox
• 分組名單。
• Project 1 will be posted around 12th Oct.
• Project 2 will be posted around 11th Nov.

Announcement

• Project Teammate (posted: 5th Sep.)
  • Each team has 3 members.
  • If you cannot find your teammates, the TAs will assign your teammates for you. However, because we do not know you, our arrangement may not be good for you; hence, you had better find your teammates yourself.
  • Please send your team member list to the TA before 1st Oct. After then the TA will find your team members for you.
  • Your grade of this course is determined by the projects; hence, if you cannot find appropriate project teammates and you cannot handle the projects alone, please consider carefully whether it is appropriate for you to take this course.

Referenced Material

• Shell Code
• Function Pointer Tutorials
• Some interesting security-related or attacker web sites:
  • National Vulnerability Database
  • US CERT
  • SANS InfoSec Reading Room
  • Phrack Magazine
  • Blackhat
  • SecurityFocus
• Buffer Overflow-Related Papers
  • Smashing The Stack For Fun And Profit
  • Stack Smashing Vulnerabilities in the Unix Operating System
  • The Art of Writing Shellcode, by smile