419 Announcements

Breaking news about the course

December 2, 2019
I just received -- as I'm sure you did -- a message that Rutgers classes and offices will be closed effective 3pm. This, of course, means that we cannot have exam 3 tonight. It will be given on Monday, December 9, which is the last day of classes.
December 2, 2019
Given today's weather, please keep an eye on whether Rutgers will cancel classes. I live north of campus and have a 40+ minute commute to class and many of you have long commutes as well. If school is open, I will go to class and we will have the exam. If the weather gets bad enough that the Office of Emergency Management decides to cancel classes, we will have exam 3 on Monday, the last day of classes.
November 28, 2019
The third 419 exam takes place on Monday, December 2. The information is in the usual places. I recently fixed a slew of typos and content in the study guide and lecture slides:
  • Exam info page, which includes a list of topics for the exam
  • Study guide: contains a writup of the more significant topics we covered and things you should know for the exam. Please let me know if anything is unclear
  • Lecture notes: see weeks 9-13
  • Previous exams
November 13, 2019
Assignment 10 is posted. This is a programming project that is due on Monday December 2. Note that this the date of the third exam and that Thanksgiving is on November 28. Take these dates into account and plan to start - and submit - your assignment early.
November 13, 2019
There will be no 419 recitation tonight.
November 12, 2019
Assignment 9 is posted and due next week prior to the first recitation. This is a written assignment that shouldn't take too long but you'll need to allocate about 17 minutes to watch a YouTube video (if you're watching at normal playback speed).
November 6, 2019
There will be no 419 recitation tonight.
October 31, 2019
The second 419 exam takes place on Monday, November 4. In case you missed it on the class website, please check the following resources:
  • Exam info page, which includes a list of topics for the exam
  • Study guide: contains a writup of the more significant topics we covered and things you should know for the exam. Please let me know if anything is unclear.
  • Lecture notes.
  • Previous exams.
  • The recitation notes include a brief review of many of the major topics we covered thus far.
October 31, 2019

For assignments 7 and 8, some of you have been getting an empty username instead of your username. I believe this only occurs to those of you who use remote desktop software instead of ssh. I've modified the code to read an environment variable in addition to calling getlogin_r. If this affects you, please re-download the expire and grade programs. You shouldn't have to change expire but will have to fix the bytes in grade. I've pushed the deadline up by four days to give you time to make the fixes.

Also, some of you are confused about what it means for the time function to return the time both as a return parameter and in a memory location. Note that the interface for time is time_t time(time_t *tloc). The time() function is called with a pointer to a time_t variable (tloc). If it is non-NULL, your implementation of time() has to set tloc to the time in seconds. In all cases, you have to return that same value.

October 24, 2019

Answers to a few common questions on assignment 8:

  • Do I need to use \x in the shellcode string or just a \ followed by numbers?

    Both perl and python use C string conventions for specifying non-printing characters. Without a \x prefix, \nnn in a string represents the octal (base 8) value of a byte. With a \x prefix, \xnn represents the hexadecimal value of the byte. You can use either in your string.

  • vi (or some other program) crashes after I run my program.

    The vi editor (as well as various other programs) happens to call the time() function. I have no idea why it needs to do so but it does. If there is a problem with your interposed implementation, there will be a problem with programs that rely on time. You can unset LD_PRELOAD via the command

    	unset LD_PRELOAD
    

    or simply don't export LD_PRELOAD and just set it for the command:

    	LD_PRELOAD=$PWD/expire.so ./expire
    
  • I get a message stating "time(): mismatch between return value and return parameter".

    The time() call returns the current time both as a return parameter and in a memory location if you supply a non-NULL parameter. Your version of time() must do the same.

October 21, 2019
I had a typo in the writeup for Assignment 7. For your shellcode file (the hex string that will be sent as standard input), you need to escape two-digit hex characters with a \x in both perl and python.
October 18, 2019

Assignment 8 is posted. This is a function interposition programming assignment. Note that it is due at the same time as Assignment 7 and I updated the deadline for assignment 7 to midnight of October 30. This might seem like a lot but bear in mind that the amount of work you have to do for each of these assignments is tiny. For the assignment 7, you simply have to reconstruct a small set of memory values. For assignment 8, you will be writing a program that will be well under 20 lines of code.

October 16, 2019

Two assignments are posted:

  1. Assignment 6 is a written assignment that is due next week. Be aware that there is more than an average amount of reading for this one.
  2. Assignment 7 is a buffer overflow assignment and is due in two weeks. It requires using gdb and might take you only a few minutes to complete ... unless you get stuck. Start early just in case.
October 5, 2019
I posted an FAQ for assignment 3. Please look it over even if you don't have questions just to ensure that did not misunderstand anything.
October 3, 2019
The first exam takes place on Monday, October 7. To help you prepare for the exam, please check the following resources:
September 21, 2019
I just posted a very short written assignment that includes some reading material on buffer overflows and return-oriented programming (ROP). If you are not familiar with an operating system's management of a process' memory, machine language, and compiler code generation, these can be challenging concepts to grasp. I tried to find some writeups that were clear, concise, and reasonably accurate.
September 21, 2019
I've posted corrected and updated slides for Monday's lecture. I tried to add more explanations around concepts that I felt might be confusing. Tonight's recitation notes are also posted.
September 21, 2019
An astute student pointed out a mistake in my description of AddObjectToGroup("objectname", "groupname") in assignment 3. The test program should, upon adding an object name to the object group, should report success and list all the objects that are now in that group.
September 19, 2019
Two assignments are posted:
  • Assignment 2 is a written assignment and is due next week on Wednesday, September 25, 2019 prior to 6:55pm.
  • Assignment 3 is a programming assignment and is due before the end of the day on Sunday, October 6, 2019. You may work on it in a group. Think about your data structures first and don't make it too complicated.
September 18, 2019
Reminder: assignment 1 is due today prior to 6:40pm. Be sure to turn your assignment in before the deadline. If you're uploading an attachment, please submit only a plain text or pdf file. MS-Word, InDesign, Pages, etc. files will not be accepted and you will get no credit.
September 14, 2019
Lecture and recitation notes for the first week are posted:
September 12, 2019
I had a few bad links on the homework assignment. I think I copied the sakai links via right clicking on the sakai page, which resulted in links that may have been valid only within my account. I fixed those and hope they'll work correctly now. I also fixed the link to the second Rosenzweig article. I apologize for the inconvenience.
September 11, 2019
Assignment 1 is posted and due next week prior to the start of section 1 recitation. If any part of the assignment is unclear, don't hesitate to send me email.
September 4, 2019
Recitations for this class are scheduled for Wednesday. Given that we did not have our first lecture yet, there will be no recitation today. I look forward to seeing you on Monday at 6:40 pm in TIL-232.
May 30, 2019

Welcome to Computer Security. Announcements will be posted here and on the class sakai page.