[Course homepage]

CS 458/658 F23 Modules

A draft of the lecture slides for each module will be made available the evening before the module begins. The final version of the lecture slides will be made available after the module is completed and replaces the draft. Use of the draft is at your own risk!

Readings marked as mandatory contain required material for the course, and must be read before the date of the corresponding lecture.

Module Slides Lecture
number
Lecture date Textbook sections (Pfleeger et al. / van Oorschot)
1 (PDF)
Lecture 1 September 6 1.1 – 1.8 / 1.1 – 1.4, 1.6
Optional reading: The 10 privacy principles of PIPEDA
Optional reading: A terminology for talking about privacy
Optional reading: Federal privacy reform in Canada: The Consumer Privacy Protection Act
Optional reading: Modernizing Canada’s Privacy Act
Optional reading: Microsoft’s report on Russian Cyberattacks in Ukraine
Optional reading: Social Security Employees in Illinois Sentenced in Federal Court on Charges Including Bribery and Identity Theft
2 (PDF)
Lecture 2 September 11 3.1 / 6.1 – 6.8
Mandatory reading before class: Smashing The Stack For Fun And Profit
Optional reading: On the Evolution of Buffer Overflows
Optional reading: Exploiting Format String Vulnerabilities
Optional reading: Example format string vulnerabilities (November 2011)
Optional reading: Example format string vulnerabilities (May 2012)
Optional reading: A Taxonomy of Computer Program Security Flaws, with Examples
Lecture 3 September 13 3.2 / 7.1 – 7.4
Optional reading: Morris worm
Optional reading: The Spread of the Sapphire/Slammer Worm
Optional reading: Slammed!
Optional reading: Technical analysis of client identification mechanisms
Lecture 4 September 18 3.2 / 7.5 – 7.9
Mandatory reading before class: Reflections on Trusting Trust
Optional reading: US Federal Student Aid website has a Facebook web bug
Optional reading: Linux Kernel "Back Door" Attempt
Optional reading: The backdooring of SquirrelMail
Optional reading: Clickjacking attack (Interface illusion)
Optional reading: MITM Malware Re-Writes Online Bank Statements
Lecture 5 September 20 3.3 / 1.7, 6.9
Optional reading: An operating system kernel with a formal proof of security
Optional reading: Bugs in open source software: #gotofail
Optional reading: Bugs in open source software: Heartbleed
3 (PDF)
Lecture 6 September 25 5.1 / 5.1 – 5.2
Optional reading: Android permissions demystified
Optional reading: Google launches its third major operating system, Fuchsia
Lecture 7 September 27 5.1 / 3.1 – 3.4, 3.6
Optional reading: Breaking SMS-based two-factor authentication: Attacking the cellular network
Optional reading: Breaking SMS-based two-factor authentication: Android malware for stealing SMS messages
Optional reading: Passphrases that you can memorize — But that even the NSA can't guess
Optional reading: The top 50 woeful passwords exposed by the Adobe security breach
Optional reading: Password Security: A Case History
Optional reading: Facebook's password hashing scheme
Optional reading: LinkedIn Revisited - Full 2012 Hash Dump Analysis
Optional reading: Anatomy of a password disaster - Adobe's giant-sized cryptographic blunder
Optional reading: Largest password data breach in history has been leaked online
Lecture 8 October 2 5.2 / 3.5
Optional reading: 'Fake fingerprint' Chinese woman fools Japan controls
Optional reading: Politician's fingerprint 'cloned from photos' by hacker
Optional reading: Vietnamese security firm: Your face is easy to fake
Optional reading: Android facial recognition based unlocking can be fooled with photo
Optional reading: Breaking Windows Hello Face Authentication
Optional reading: Reverse-Engineered Irises Look So Real, They Fool Eye-Scanners
Optional reading: Border Drones with Facial Recognition
Lecture 9 October 4 5.2 / 1.7
Mandatory reading before class: The Protection of Information in Computer Systems, section I.A.
Optional reading: The Security Principles of Saltzer and Schroeder, illlustrated with scenes from Star Wars
Optional reading: Reliably Erasing Data From Flash-Based Solid State Drives
Optional reading: SELinux
4 (PDF)
Lecture 10 October 16 6.1, 6.2 / 9.1, 9.3, 9.6, 10.6, 11.3
Optional reading: How I Lost My $50,000 Twitter Username
Optional reading: Robin Sage
Optional reading: How Apple and Amazon Security Flaws Led to My Epic Hacking
Lecture 11 October 18 6.3, 6.4 / 11.3, 11.4, 11.6
Optional reading: Cybercrime 2.0: When the Cloud Turns Dark
Optional reading: Why Google Went Offline Today and a Bit about How the Internet Works
Optional reading: The DDoS That Knocked Spamhaus Offline (And How We Mitigated It)
Optional reading: The DDoS That Almost Broke the Internet
Optional reading: Biggest DDoS ever aimed at Cloudflare's content delivery network
Optional reading: Technical Details Behind a 400Gbps NTP Amplification DDoS Attack
Optional reading: Understanding the Mirai Botnet
Optional reading: Strange snafu misroutes domestic US Internet traffic through China Telecom
Optional reading: A $152,000 Cryptocurrency Theft Just Exploited A Huge Blind Spot In Internet Security
Lecture 12 October 23 6.7, 6.8 / 10.1, 10.2, 11.1, 11.2
Optional reading: The Inside Story of the Kelihos Botnet Takedown
Optional reading: Gameover
Optional reading: Backstage with the Gameover Botnet Hijackers
Optional reading: Attacking an IDS
5 (PDF)
Lecture 13 October 25 2.3, 12 / 2
Optional reading: Known Plaintext Attacks - How Alan Turing Cracked the Enigma Code
Optional reading: Attack based on keystream reuse
Optional reading: One-time pad
Optional reading: A Stick Figure Guide to AES
Lecture 14 October 30 2.3, 12 / 2
Optional reading: Twenty Years of Attacks on the RSA Cryptosystem
Optional reading: Why it's harder to forge a SHA-1 certificate than it is to find a SHA-1 collision
Optional reading: SHA-1 collision found
Optional reading: PGP keys, software security, and much more threatened by new SHA1 exploit
Lecture 15 November 1 6.6 / 8.1, 8.2, 8.4, 8.5, 9.2
Optional reading: Tree of Trust (red: root CA; green: intermediate CA)
Optional reading: Turkish Registrar Enabled Phishers to Spoof Google
Optional reading: Comodogate
Optional reading: DigiNotar incident
Optional reading: Chrome's Plan to Distrust Symantec Certificates
Optional reading: Lest We Remember: Cold Boot Attacks on Encryption Keys
Lecture 16 November 6 6.3 / 12.1, 12.2, 12.3, 12.4, 12.5, 12.16, 12.8, 10.4, 10.5
Optional reading: Intercepting Mobile Communications: The Insecurity of 802.11
Optional reading: Cracking WEP in 60 seconds
Optional reading: WireGuard
Optional reading: Let's Encrypt - Free SSL/TLS Certificates
Lecture 17 November 8 9.2 / 10.3
Optional reading: The Tor Project
Optional reading: Thousands of Tor exit nodes attacked cryptocurrency users over the past year
Optional reading: Re-identifying Tor users
Optional reading: SSH: passwords or keys?
Lecture 18 November 13 4.4, 9.6 / 4.3, 8.6, 8.7
Optional reading: A Survey of Anonymous Communication Channels
Optional reading: Why Johnny Can't Encrypt
Optional reading: Ed Snowden Taught Me To Smuggle Secrets Past Incredible Danger
Optional reading: DH Key-Exchange
Optional reading: Off-the-Record Messaging
Optional reading: Signal's Double Ratchet
6 (PDF)
Lecture 19 November 15 7.1 – 7.4 /
Optional reading: A quick-start tutorial on relational database design
Optional reading: Doctors snooped on Humboldt Broncos records, privacy commissioner finds
Optional reading: Using police databases for personal gain
Lecture 20 November 20 9.4 /
Optional reading: Social Security Numbers Deduced From Public Data
Optional reading: Identifying spies with data aggregation (final four paragraphs)
Optional reading: A reading list on differential privacy
Lecture 21 November 22 9.4 /
Optional reading: Data mining and integrity: Russia Warned U.S. About Tsarnaev, But Spelling Issue Let Him Escape
Optional reading: Data mining and integrity: How Obama Officials Cried 'Terrorism' to Cover Up a Paperwork Error
Optional reading: How Companies Learn Your Secrets
Optional reading: FOILing NYC's Taxi Trip Data
Optional reading: A Face Is Exposed for AOL Searcher No. 4417749
Optional reading: ℓ-Diversity: Privacy Beyond k-Anonymity
Optional reading: t-Closeness: Privacy Beyond k-Anonymity and ℓ-Diversity
Optional reading: Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization
7 (PDF)
Lecture 22 November 27 11.6, 11.7, 10.1 – 10.6 / 1.3 – 1.6
Optional reading: Ethically questionable behaviour: Clearview AI
Optional reading: Ethically questionable behaviour: Cambridge Analytica
Optional reading: Ethically questionable behaviour: AT&T hacker
Optional reading: Ethically questionable behaviour: Attacking Tor exit nodes
Optional reading: Ethically questionable behaviour: Deanonymizing Tor users
Optional reading: Ethically questionable behaviour: Facebook mood manipulation
Optional reading: Ethically questionable behaviour: Unaccountable algorithms
Optional reading: ACM code of ethics
Optional reading: IEEE code of ethics
Optional reading: CIPS code of ethics
Optional reading: Investigation into the loss of a hard drive at Employment and Social Development Canada
Optional reading: IST Pandemic Plan
Optional reading: Waterloo's Information Security Policies, Standards, and Guidelines
Optional reading: databreaches.net
Lecture 23 November 29 11.1 – 11.5 /
Optional reading: uWaterloo's Electronic Media Disposal Guidelines
Optional reading: The Computer Centre Incident at Concordia
Optional reading: Twitter thread on Rogers' outage
Optional reading: Roger's report on July 2022 Canada-wide service outage (abridged)
Lecture 24 December 4 10.1 – 10.6 /
Optional reading: How Winnie-the-Pooh highlights flaws in U.S. copyright law — and what that could mean for Canada
Optional reading: Access Copyright v. York University
Optional reading: Unintended Consequences: Ten Years under the DMCA
Optional reading: A Death in Athens
Optional reading: On the Juniper backdoor
Optional reading: Bruce Schneier on Full Disclosure
Optional reading: Google's view
Optional reading: Microsoft's view
Optional reading: Disclosing breaches to the government