Skip to content

ECE422

ECE422/CS461 (Introduction to Computer Security I) is a 4-credit hour course offered during the Fall and Spring. It is an approved technical elective for CE, EE, and CS majors.

Content Covered

Application Security

  • Review of (32-bit) x86 assembly and how C compiles to assembly
  • Basic stack overflow attacks: use a misconfigured buffer to redirect the instruction pointer to the stack
  • Stack overflow attack defenses: stack canaries, non-executable stack, smaller buffer sizes, etc
  • Advanced stack overflow attacks: use Return-Oriented Programming (ROP) attacks to exploit programs
  • Other attacks resulting from improper input validation: printf memory disclosure, printf memory write, etc

Web Security

  • Cross site scripting and defenses
  • SQL injection and defenses
  • Cross site request forgery and defenses
  • Best practices for storing passwords

Crypto

  • Asymmetric and symmetric cryptography
  • Message Authentication Codes (MAC)
  • Hashing and salting
  • Deniability and off the record messaging
  • Public Key Infrastructure (PKI) implementations - X.509, PGP, etc
  • Diffie-Hellman Key agreement
  • Attacks on hashing and signing algorithms including MD5 and RSA

Networks

  • 5 Layer IP model and the details of protocols at each level, including Ethernet, ARP, IP, TCP, UDP, DNS, TCP, TLS, and HTTP
  • Exploits of protocols discussed in class to achieve "man-in-the middle" (MITM) capability
  • Use of MITM capability to perform simulated attacks on websites

Prerequisites

ECE422 assumes familiarity with reading assembly code, but will review x86 assembly during the first week. It is helpful to have experience with JavaScript, Python, and networking for later parts of the course, but it is possible to complete the course while learning this material.

When to Take It

ECE422 may be taken at any time after completing prerequisites. It is a relatively difficult course with an average GPA of roughly 2.8 each semester, and so shouldn't be taken with several other heavy courses. Students interested in further security coursework or research should take ECE422 as soon as possible, since it is a prerequite for every other security course.

Course Structure

ECE422 splits the course into four parts (application security, web security, crypto, networks) with an MP for each part. MPs are completed in groups of at most two students, and require students to implement attacks using ideas discussed in lecture. MPs will typically require the student to perform some additional learning on their own, including reading given research papers, and learning JavaScript. Each MP is divided into two checkpoints, the first worth 20 points and the second worth 100. Students are given roughly 1 week to complete each checkpoint; the second checkpoint is much more time consuming so it is important to start MPs early and begin the second checkpoint before the first one is due. It is not uncommon for an MP to take a team of two students 10-15 hours per student.

Lectures typically introduce new ideas, and then attacks on those ideas, then defenses for those attacks, and so on. It is important to stay up to date with lectures since they directly build on one another.

There is one midterm exam, covering application security and web security, and one cumulative final exam. The midterm and final both contain heavily conceptual questions, and ask students to describe how they would exploit given programs or protocols.

Instructors

The instructors for ECE422 rotate each semester. It is often co-taught by two professors.

Course Tips

  • Start on MPs as soon as they are released. The later parts of each MP are often time consuming and may require you to go to office hours. It's best to go to office hours before everyone else has started, since they'll be less busy.
  • Study MPs in addition to lectures for exams. Simulated attack questions on exams are often similar to the attacks you conducted as part of your MPs.
  • Go to lab! TAs will often provide guidance and hints on how to complete MPs during labs.

While ECE422 has a reputation for being somewhat difficult, most of this difficulty can be mitigated by starting MPs early and making liberal use of office hours.

Life After

Students who enjoyed ECE422 may enjoy ECE424 (Computer Security II) or ECE524 (Advanced Computer Security). Note that ECE524 does not depend on ECE424, and since ECE424 is offered on Coursera, most students opt to take ECE524 directly. ECE524 is offered in the fall only, so students close to graduation who wish to take the course should plan accordingly.

Infamous Topics

  • Return-Oriented Programming (ROP) attacks: these attacks are difficult to perform because they require piecing together fragments of assembly code to cause a desired effect to the system. It is important to remember fundamentals of x86 assembly, such as system calls and register overflow behavior (what happens if you add 1 to 0xffffffff?), as well as general binary arithmetic; these tools will help you manipulate data.
  • NetSec MP. While all other MPs have averages over 90, this MP has an average in the 70 percent range. It requires detailed understanding of several network protocols, as well as writing lots of hard-to-test python code. It is best to start this MP early and, if pressed for time, calculate what percentage you need to get your desired grade in the class.

Resources

While course lectures are mostly sufficient, since ECE422 is not a theory course, students who want a deeper understanding of cryptography and hashing may enjoy Joy of Cryptography by Mike Rosulek.