The process and the practice of assessing a computer system’s existing information security posture. Detailing the time-tested practices of experienced security architects; how to deliver the right security at the right time in the implementation lifecycle. Includes secure coding practices and methods, code review, and malware analysis.
Credits: 3
Session length: 2 hours and 45 minutes
Prerequisites
This class focuses on low-level concepts, however, proficiency in C/x86 assembly is not expected. You will not be coding from scratch—this course is focused on analysis. Pre-recorded videos covering C and assembly basics will be provided.
You may use an LLM to write and form an initial understanding of code. See the AI policy.
Topics you are expected to be comfortable with early on:
- Stack, heap, C memory allocation
- Pointer arithmetic
- Basic x86-64 stack prologues and epilogues
Course Objectives
- Analyze vulnerable software using disassembler and debugger output.
- Understand how to apply and bypass modern binary protections.
- Assess the information security posture of a computer system.
- Map insecure coding practices to common security frameworks.
AI Policy
Using LLMs has become increasingly popular for exploit development. This has increased efficiency and created novel methods to identify vulnerabilities which simply cannot be accomplished at the same human speed. It has also introduced a decrease in understanding of the exploits that LLMs generate, leading to incomplete patches and adjacent vulnerabilities appearing.
We will not shy away from this—first use AI to learn what a binary’s purpose is, then learn how to exploit it. Through in-class labs, presentations, and Q&As, you will build your reasoning.
Choosing your Model
You may use any agent. You are expected to purchase your own subscription if you wish to do so.
Usage
You are encouraged to use AI in this course.
However, there are rules for AI usage that must be strictly followed:
- You may NOT make use of any agent during live presentations.
- There are no exceptions to this rule.
Reporting
You are not permitted to work in teams for reports. All work written must be your own.
For additional questions about policy or usage, consult with me before submission.
Lab Setup
For each lab, students will be split into teams (red team/blue team). Lab roles rotate each offered week.
Red team responsibilities involve:
- Analyze the binary for attack vectors
- Write the exploit
- Explain impact of exploit
- Assess ease of patch
Blue team responsibilities:
- Analyze the binary for attack vectors
- Analyze compromised binary and logs
- Assign a hypothetical CVSS score to said exploit
- Patch it
Each team’s production will be evaluated live. If the exploit and patch pass basic checks, one student from each side will be chosen to defend the team’s work live. The lowest lab score will be dropped.
Note: Lab 0 does not affect your grade, and is used as a self-check for you to gauge your current level.
Final Project
Each student will submit their own final project, including an end-of-semester presentation. More details available soon.
Grading
| Category | Weight |
|---|---|
| Labs (x5) | 45% |
| Final Project | 30% |
| Reports | 15% |
| Participation | 10% |
Tentative Schedule
| Week | Topics | Due |
|---|---|---|
| Week 1 | Environment setup, definition of Trusted Software Systems, C Introduction | Lab 0 |
| Week 2 | x86-64 & C Review: Stack, heap, calling conventions | |
| Week 3 | Introduction to GDB, memory corruption vulnerabilities, secure coding | |
| Week 4 | Analyzing simple binaries with Ghidra, basic logic flaws | Lab 1 |
| Week 5 | Stripped binaries and binary patching in Ghidra | |
| Week 6 | Binary Protections I, checksec | Lab 2 |
| Week 7 | Binary Protections II | |
| Week 8 | MITRE CWE framework and common vulnerability classifications | Lab 3 |
| Week 9 | Spring Break | |
| Week 10 | Runtime instrumentation, coverage-guided fuzzers, ASan | |
| Week 11 | Analyzing crash logs | Lab 4 |
| Week 12 | Introduction to automated vuln discovery | |
| Week 13 | CVSS scoring, responsible disclosure, SECURITY.md | Lab 5 |
| Week 14 | Prepare Projects | |
| Week 15 | Final Project Presentations | |
| Week 16 | Enjoy your break! |
Acknowledgements
This course’s framework, AI policy, and lab setup were inspired by Dr. Yueqi Chen’s course, CSCI 5573 Graduate Operating Systems, at CU Boulder.