Students will probably be asked to work in teams of three. Your
presentation
and its handout will be assessed.
Seminars should aim to
have good technical content
be understood by the audience
be accompanied by appropriate handouts (in an open,
non-proprietary
format format, for convenient linkage to the module pages)
be interactive
Supervision arrangements
[Optional] Arrange a preliminary short meeting with your
supervisor
to get orientation about the topic and suggestions of references.
If
you already have good ideas and knowledge of your topic, you don't need
to
have this meeting.
Arrange a meeting with your supervisor three weeks before your
presentation.
By the time of this meeting, you should have
decided how you are dividing the work between members of your
group
started the reading and research
planned your presentation and drafted your handout at a high
level.
Arrange a meeting with your supervisor one week before your
presentation.
By this time, you should have everything in near-final form. Your
supervisor
can help you with minor adjustments.
Please look at the main page to see which
supervisor
has been allocated to your group. You can arrange your meetings at the
lectures
or by email:
Mark Ryan <M.D.Ryan at cs.bham.ac.uk>
Andy Brown <A.J.Brown at cs.bham.ac.uk>
Assessment (50% on the seminar, 50% exam)
The 50% based on the seminar will be judged according to these criteria:
presentation
handouts
depth of knowledge
ability to answer questions
management (= team mgt, prep for mtgs with sup)
Sources of information
It's vital to get good sources on which to base your presentation.
Obviously,
there is a lot of information on the web, and if you select carefully
then
the web is a very valuable resource. But it's vital to select
carefully,
because there is a huge amount of rubbish, misunderstandings and poor
explanations
out there. Look at the author's name and the web site's name, as well
as
the content, to form your judgment. You should also use books. In a
fast-moving
area like computer security, books cannot be relied on for current
practice
and standards. But they can be more relied on for a sound theoretical
basis,
than the web. More selection has been done for you, by book authors and
publishers,
than by amateurs who write well-intended but ill-informed web pages.
Some suggested topics and references
The topics that the instructors have particular interest in are near
the
top, so you are encouraged to pick one of those. The references/links
given
are certainly not complete or
adequate!
You need to do your own literature search. At the bottom of the list of
topics,
there are some interesting ones for which I haven't had the time to
write
a description or find a few links.
Digital Rights Management is a cluster of techniques
designed to restrict unwanted copying and distribution of intellectual
property, such as music, video, and software. Examples include Apple's
iTunes/Fairplay, Windows Media Player, RealNetworks. Paper
by W.Ku et al, ISC'04. (local copy) Wikipedia
entry has some links.
Quantum cryptography, or more accruately, quantum key
exchange.
The idea is to use quantum effects and the uncertainly principle to
exchange
keys in a way which makes interception detectable. id Quantique is a company
selling
it. Techworld
story.
Signcryption is a new
cryptographic primitive that performs signing and encryption
simultaneously, at a cost significantly lower than that required by the
traditional signature then encryption approach. This topic has similar
mathematical content to the lecture on RSA.
Paper by Y.Zheng, CRYPTO'97
Paper by G.Wang et al, ISC'04.
Captchas are tests that
distinguish humand from software bots in an online environment, used to
stop bots abusing services intended for humans. Paypal and Yahoo have
captchas in their new user registration process, but there are programs
to overcome them. Investigate proposals for new kinds of captchas. The ca[ptcha project.
Paper by M.Chew and J.Tygar in ISC'04.
Random number generation
is
an important topic for cryptography, for generating keys. But most
naive
ways of generating random numbers are flawed because they are not truly
random.
PGP/GPG use mouse and keyboard events to help randomise. In your
presentation,
explain the problems; try to identify how serious they really are; and
explain
approaches and solutions.
Viruses and worms.
This is a huge topic; you'll need to plan carefully.
Firewalls.
Classify main types against network layers: packet firewalls,
application
firewalls, etc. What languages do large firewall vendors such as Cisco
provide,
in order to help manage the huge complexity of rule tables?
CSS and DeCSS.
CSS is the encryption system used on DVD players, and DeCSS program
encoding
the crack, written by a 16-year old Norwegian programmer called Jon
Johansen
who wrote DeCSS. David Touretzky's
DeCSS
web page includes a tutorial and other resources.
Human factors. Only half
of
computer security is about technology. The other half is the human.
If
people choose their pet's name for their password, the system will be
insecure.
If banks don't use public key cryptography to sign their emails, their
customers
won't know if the emails are genuine or from fraudsters. Why don't they
sign
their emails? Why doesn't everyone? Why Johnny can't
encrypt
is an interesting article attempting to explain why people can't/don't
want
to use PGP. The problems here are the most difficult ones in computer
security.
Microsoft passport and other single-signon systems. How
do they work? What are the issues and problems?
Microsoft passport: http:...
Liberty Alliance alternative single sign-on system. Aimed at
corporations
rather than individuals, in contrast with MSPP.
Security of Open-Source Software.
Why is OSS (such as the GNU/Linux operating system) much less
vulnerable
to attacks than MS Windows?
Linux attacks increasing: http://msn.vnunet.com/News/1133518
Linux viruses:
http://www.claws-and-paws.com/virus/articles/linux_viruses.shtml
Differential cryptanalysis. is an approach to trying to
break
crypto systems such as DES, which has been quite successful. It is
based
on comparing the encryptions of two plaintexts which differ only
slightly.
This topic is quite complicated, but enjoyable if you liked getting to
understand
the details of the crypto algorithms.
Government control of crypto; the Clipper Chip. A few
years
ago the US government was bent on controlling crypto so that it could
always
decrypt messages sent by fraudsters, terrorists, enemy countries, etc.
The
Clipper chip was an effort at providing the government with escrowed
keys.
They banned export of crypto systems and software. Have they been
defeated,
and have they abandoned all their attempts at control? Or have they
discovered
an RSA exploit?
Holes in popular software.
Internet Explorer v > 4.0 allows web server to run
arbitrary
code on your system. Demonstration: http://www.cs.bham.ac.uk/~mer/hole.html
launches MS Calculator, but could just as easily reformat your hard
drive.
Win Media Player.
http://msn.vnunet.com/News/1133109
http://www.microsoft.com/technet/security/bulletin/ms02-032.asp
Vulnerabilities on routers, switches, other hardware. Cisco using IIS software on its hardware, had to release
firmware
patch
Known bugs with the Linksys cable/DSL routers (Linksys Cable/DSL
version
1.42.7 (BEFSR11 / BEFSR41 / BEFSRU31) )
Have a look here: http://www.governmentsecurity.org/exploits.php
Kerberos.
IPSec.
SSH.
The following topics were done last year, and are not available
this year.
Steganography and digital watermarking are about
techniques
used to hide messages inside a file whose apparent purpose is something
else.
For example, one can hide a message in the least significant bit of
each
24-bit pixel of an image file, without having an appreciable effect on
the
quality of the image. This is useful for digitally watermarking an
image,
to later claim ownership. To be effective, steganography should be
Not easily identifiable or removable (the technique described
for
images is both identifiable and removable)
Robust to normal operations on the file (such as image
resizing,
or even printing out and scanning in again, or re-recording a
watermarked
audio file).
Spyware and Trojan horses.
Spyware is apparently useful software whose real purpose is to spy on
your
activities and report back to its master, who may hit you with targeted
junk
popups or worse. Example: Aureate.
How widespread is this problem?
How can one check software and/or defend against spyware?
Does spyware affect any open-source software? How could one
hide
spyware in OSS?
Zero Knowledge proofs are
used to prove something without giving out any information: the prover
can
convince the verifier that he knows some secret without revealing
anything
about the secret and without enabling the verifier to replicate the
proof
to someone else. Among othe uses, Zero Knowledge techniques can be used
for
user identification purposes.
Biometrics. Saviour or niche-market?
Classify the main approaches and their associated problems.
Programming language security.
What features of Java make it more secure than (say) C?
Compile-time and run-time checks
Java security package
Java applet sandboxing
Buffer overflow vulnerability in C
Problems with CGI scripts, such as field entries which change
the
meaning of an SQL query
DDoS.
http://grc.com/dos/grcdos.htm
This one is a description of an actual attack, and how the victim
traced
the attack to a 13 year old, using IRC to coordinate the attacks. If
you
are running windows on any kind of internet connection, better make
sure
your machine is not infected with those bots...
http://www.caida.org/outreach/papers/backscatter/
The second article use an ingenious method to actually count the number
of
DDoS happening at any time on the internet, and come up with worrying
numbers.
After reading the previous article, I(TS) think they might miss a lot
of
attacks (those originating from windows machines) ?