Computer Security and Privacy PDF SLIDES

Computer Security and Privacy
Instructor : Tadayoshi
Textbook : Security Engineering Ross Anderson.
Download slides from here

Attack Trees. Security Criteria for Electronic Voting Security and Privacy for Implantable Medical Devices. Optional Reading: Why Cryptosystems Fail. Analysis of an Electronic Voting System. Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses. Computer Security in the Real World.

Required Reading: Secrecy, Flagging, and Paranoia: Adoption Criteria in Encrypted E-Mail. Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems. Human-in-the-loop: rethinking security in mobile and pervasive systems. Users are Not the Enemy. An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants. Franklin, Paxson, Perrig, and Savage. CCS 2007.

Required Reading: Value Sensitive Design and Information Systems. How Much is Location Privacy Worth?. Valuating Privacy.

Required Reading: A Usability Study and Critique of Two Password Managers. On User Choice in Graphical Password Schemes. Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. In Search of Usable Security: Five Lessons from the Field.

Required Reading: Helios: Web-based Open-Audit Voting. VoteBox: A Tamper-evident, Verifiable Electronic Voting System.: Analysis of an Electronic Voting System. Strategies for Software Attacks on Voting Machines. Cryptographic Voting Protocols: A Systems Perspective. Simple Verifiable Elections.

Required Reading: Problem Areas for IP Security Protocols. Cryptanalytic Attacks on Pseudorandom Number Generators. Optional Reading: Analysis of the SSL 3.0 Protocol Prudent Engineering Practice for Cryptographic Protocols.

Required Reading: Capturing System-wide Information Flow for Malware Detection and Analysis. Privacy Oracle: a System for Finding Application Leaks Using Black-box Differential Testing.

Required Reading: Off-the-Record Communication, or, Why Not To Use PGP. Improved User Authentication in Off-The-Record Messaging Optional Reading: Secure off-the-record messaging Privacy-Preserving Location Tracking of Lost or Stolen Devices: Cryptographic Techniques and Replacing Trusted Third Parties with DHTs

Required Reading: Improving Wireless Privacy with an Identifier-Free Link Layer Protocol. Sign up to be an advocate or skeptic! Wireless Device Identification using Radiometric Signatures. Sign up to be an advocate or skeptic! Optional Reading: Inference Attacks on Location Tracks.

Required Reading: Language-Based Information-Flow Security. Slides (PPT). Optional Reading:

Required Reading: Inferring Internet Denial-of-Service Activity. How to 0wn the Internet in Your Spare Time. Mapping Internet Sensors with Probe Response Attacks. Vulnerabilities of Passive Internet Threat Monitors. Self-Stopping Worms.

Required Reading: Spamalytics: an Empirical Analysis of Spam Marketing Conversion. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants.

Required Reading: An Architecture for Privacy-Sensitive Ubiquitous Computing. AnonySense: Privacy-Aware People-Centric Sensing. Optional Reading: Developing Privacy Guidelines for Social Location Disclosure Applications and Services. Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems. Smart-Phone Attacks and Defenses.

Required Reading: Privacy and Security in Library RFID Issues, Practices, and Architectures. RFIDs and Secret Handshakes: Defending Against Ghost-and-Leech Attacks and Unauthorized Reads with Context-Aware Communications. Optional Reading: Amigo: Proximity-Based Authentication of Mobile Devices Shake Well Before Use: Authentication Based on Accelerometer DataRFID Security and Privacy: A Research Survey. Attack Lab slides: Slides 1 Slides 2

Required Reading: Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features. The Emperor's New Security Indicators. Optional Reading: Social Phishing. Why Phishing Works.

Required Reading: Authenticated Encryption in SSH: Provably Fixing the SSH Binary Packet Protocol. Identity based encryption from the Weil pairing. Optional Reading: Practice-oriented Provable Security.

Required Reading: Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications. Towards Automatic Generation of Vulnerability-Based Signatures. Optional Reading: SubVirt: Implementing malware with virtual machines. Designing and implementing malicious hardware.

Required Reading: Free Haven. Tor: The Second-Generation Onion Router. Optional Reading: Crowds: Anonymity for Web Transactions.

Required Reading: Remote physical device fingerprinting. Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems. Optional Reading: Timing Attacks on Web Privacy. Differential Power Analysis. Optical Time-Domain Eavesdropping Risks of CRT Displays Information Leakage from Optical Emanations. Spot me if you can: Uncovering spoken phrases in encrypted VoIP conversations. On the limits of steganography. Keyboards and Covert Channels. Information Hiding --- A Survey

Optional Reading: Protection and Communication Abstractions for Web Browsers in MashupOS. Wang, Fan, Howell, and Jackson. SOSP 2007. Robust Defenses for Cross-Site Request Forgery.Barth, Jackson, and Mitchell. CSS 2008. Protecting Browsers from DNS Rebinding Attacks. Jackson, Barth, Bortz, Shao, And Boneh. CCS 2007.