Voir la source de 4MMSR-Network Security-2011-2012

{{2A}} {{Informatique}} {{Sécurité}}
[[Catégorie:Sécurité]]
[[Catégorie:Deuxième Année]]

==Course information==
Kak dela Komrad!

===Brief summary===
The increased use of computer systems and networks for every work together with the various emerging threats
and the rise of their automation participated in security of becoming such a major concern. 
This course will present the main aspects for attacking a system that is yours (aka Offensive Security) and very important, protecting those (aka Defensive Security).
Focus will be made on network related vulnerabilities.

===Lecturer===
* [[Utilisateur:Duchenef|Fabien Duchene]] ([http://www.car-online.fr/en/spaces/fabien_duchene/pgpkey/ PGP key])
* firstname.name _a\'OR 1337=1337 imag.fr

===Assumed background===
* [[Logiciel_de_base|3MMCEP "Conception et exploitation des processeurs" / "Logiciel de base"]]  
* [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/ 3MMRTEL - Introducing communication and networks]
* [https://intranet.ensimag.fr/KIOSK/Matieres/4MMRES/news/ 4MMRES - Network]
* [https://intranet.ensimag.fr/KIOSK/Matieres/4MMPSGS2/ 4MMPSGBD - Principes des systemes de gestion de bases de données] 
* [[Systèmes_d'exploitation_et_programmation_concurrente|4MMSEPC - Systèmes d'exploitation et programmation concurrente]]
* [[Pratique_du_Syst%C3%A8me|4MMPS - Hands on OS]]

===This course relates to...===
* [https://intranet.ensimag.fr/KIOSK/Matieres/5MMTLSFT/ 5MMTLSFT Software testing and safety]
* [[5MMSSI-2011-2012| 5MMSSI Information Systems Security]]
* [https://intranet.ensimag.fr/KIOSK/Matieres/5MMMSSI/ 5MMMSSI Models for Security]
* [https://intranet.ensimag.fr/KIOSK/Matieres/4MMCSE/ 4MMCSE Operative System Design]

==Planning==
* Lectures 
{|
| 2012-02-01
| *[[File:4MMSR-Network_Security-2011-2012-0-Introduction.pdf|0-Introduction]] (student version, if you are a security professional and are wishing the full version [[user:duchenef|contact me]])
|- 
|
| *[[File:4MMSR-Network_Security-2011-2012-1-Cryptography.pdf|1-Cryptography]], [[User:hossen|K. Hossen]] MSc2 version: [[File:5MMSSI-2011-2012-3-1.cryptography-introduction.pdf]]
|-
|
| Read again: [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/c6_crypto_3dpp.pdf 3MMRTEL (C6, Cryptography and Security)] 
|-
|
| Practical exercices for the very next lecture: Parts 3 and 4 of [[5MMSSI-2011-2012-practical_assessment-cryptography_and_applications]]
|- 
|
|
----
|-
| 2012-02-08
|-
|
| Read again: [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/c2_premiers_pas.pdf 3MMRTEL- C2 - Premiers pas dans l'Internet)] + [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/s1_adresses_DNS_3dpp.pdf 3MMRTEL - S1 - Adresses Internet et annuaire DNS] + [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/s3_mel_3dpp.pdf 3MMRTEL - S3 - Le courrier électronique]
|- 
|
| [https://intranet.ensimag.fr/KIOSK/Ensimag/2A/opt/Reseaux/pdf/R2A-4-LAN-3.pdf 4MMRES LAN] +  [https://intranet.ensimag.fr/KIOSK/Ensimag/2A/opt/Reseaux/pdf/R2A-5-Network_layer-3.pdf 4MMRES Network Layer]+ [https://intranet.ensimag.fr/KIOSK/Ensimag/2A/opt/Reseaux/pdf/R2A-5a-DHCP-NAT-3.pdf 4MMRES - DHCP and NAT] 
|-
|
|
----
|-
|
| [[File:4MMSR-Network_Security-2011-2012-2-some_network_attacks_and_counter-measures__student.pdf|2-Some networks attacks and counter-measures]] 
|-
|
| (student version, if you are a security professional and are  wishing the full version, [[user:duchenef|contact me]])
|- 
|
|Exercices for the very next lecture: read the PKI section [[File:4MMSR-Network_Security-2011-2012-1.2-some_cryptographic_applications__student.pdf|Some cryptographic applications]] and solve exercices 1 and 2 of [[5MMSSI-2011-2012-practical_assessment-cryptography_and_applications]] and exercice 2 of [[Fichier:5MMSSI-2011-2012-final_exam_session_1-FR_FR.pdf]]
|-
|
|
----
|-
| 2012-02-22
|-
|
| [[File:4MMSR-Network_Security-2011-2012-1.2-some_cryptographic_applications__student.pdf|Some cryptographic applications]]
|-
|
| For the next lecture: 
|-
|
| * Exercise 3.1 (Kerberos) of [[Fichier:TEL2A-Network_Security-Exercises-2011-04-06.pdf]]
|-
|
| * Exercise 3.2. (DNS Cache poisoning) of [[Fichier:TEL2A-Network_Security-Exercises-2011-03-23.pdf]] (read the DNS section in [[File:4MMSR-Network_Security-2011-2012-2-some_network_attacks_and_counter-measures__student.pdf|2-Some networks attacks and counter-measures]] before!)
|-
|
| * Exercices (802.11, proxy, firewall) questions 7 till 13 (included) of [[Fichier:TEL2A-Network_Security-Exercises-2011-04-20.pdf]]
|- 
| 
| * [[4MMSR-2011-2012-practical_assessment-DNS_cache_poisoning]] (will be published later on)
|- 
|
| * Watch [https://www.youtube.com/watch?v=3QnD2c4Xovk&t=39s Public Key Cryptography: Diffie-Hellman Key Exchange]
|
----
|-
| 2012-03-07
|-
|
| Read again: 
|-
| 
| * [https://intranet.ensimag.fr/KIOSK/Matieres/4MMPSGS2/ 4MMPSGBD] (everything you saw until now in Database Management Systems and especially the [https://intranet.ensimag.fr/KIOSK/Matieres/4MMPSG/Cours/SQLFrExemples.pdf Structured Query Language (SQL)])] 
|-
|
| * [https://intranet.ensimag.fr/KIOSK/Matieres/3MMRTEL/s4_www_3dpp.pdf 3MMRTEL (S4 retour sur www)]
|- 
|
| [[File:4MMSR-Network_Security-2011-2012-3-Web_security-student_version.pdf| Web Security (SOP, Path traversal, SQLi, XSS)]]
|-
|
|-
|
| For the next lecture: [[5MMMSI-2011-2012-practical_assessment-web_exploitations_and_basic_risk_analysis]] (questions 2 till 14)
|- 
|
| (Optionnal): discover within [https://code.google.com/p/webgoat/ WebGoat] and [https://google-gruyere.appspot.com/ Gruyere] vulnerabilities we saw during the lecture
|-
----
|- 
|  2012-03-13
| Seminars: 4 (total)
|-
|
|  [[User:aromatat]] + [[User:freysst]] - [[Fichier:4MMSR-2011-2012-student_seminar-A Low-cost Attack on a Microsoft CAPTCHA, Jeff Yan, Ahmad Salah El Ahmad, 2008.pdf]]
|-
|
| [[user:delpechc]] + [[user:fontainl]] - [[Fichier:4MMSR-2011-2012-student_seminar-Wi Fi Advanced Fuzzing.pdf]]  ( + [[Fichier:4MMSR-2011-2012-student_seminar-Wi Fi Advanced Fuzzing-lecture_notes.pdf|some lecturer notes (french)]])
|-
|
| [[user:wuxue]] + [[user:zhangyu]] - [[Fichier:4MMSR-2011-2012-student_seminar-Peer-to-peer botnets- overview and case study.pdf]]
|-
|
| 
----
|- 
| 2012-03-21
| Read again: [[Systèmes_d'exploitation_et_programmation_concurrente|4MMSEPC]] [[Pratique_du_Syst%C3%A8me|4MMPS]]
|-
|
| Correction of practical assessment [[5MMMSI-2011-2012-practical_assessment-web_exploitations_and_basic_risk_analysis]] (questions 2 till 14)
|-
|
| [http://www.car-online.fr/files/teaching/2012-UJF-Safe/lectures/3-Fuzzing_for_evil_and_for_profit-for_publication-Low_Rez.pdf basics in Fuzz-Testing aka. Fuzzing]
|-
|
| Seminars: 3 (total)
|- 
|
| [[user:raymonbe]] + [[user:ouinem]] - [[Fichier:4MMSR-2011-2012-student_seminar-A practical attack against GPRS_EDGE_UMTS_HSPA mobile data communications - David Perez, Jose Pico - Black-Hat DC 2011.pdf]]
|-
|
| [[user:aubertad]] + [[user:brisont]] : [[File:4MMSR-2011-2012-student_seminar-Using Client Puzzles to Protect TLS.pdf|Using Client Puzzles to Protect TLS]]
|-
|
| [[user:laviallb]] + [[user:grueld]] : [[File:4MMSR-2011-2012-student_seminar-Abusing Social Networks for Automated User Profiling.pdf|Abusing Social Networks for Automated User Profiling]]
|-
|
| * For the next lecture (mandatory) [http://www.car-online.fr/files/teaching/2012-UJF-Safe/practical/TP3-Fuzzing.pdf Practical Assessment: Protocol Fuzzing in a BlackBox approach]
|-
|
| Ask your questions on [[4MMSR-2011-2012-TP_Fuzzing]]
|-
|
| (Optional): 
|-
|
| * [[File:4MMSR-Network_Security-2011-2012-4-In-Memory_exploitation_and_Shellcodes-student.pdf]]
|-
|
| * [[5MMSSI-2011-2012-practical_assessment-basics_in_exploitation]]
|-
----
|- 
| 2012-03-28
|-
|
| Correction of [http://www.car-online.fr/files/teaching/2012-UJF-Safe/practical/TP3-Fuzzing.pdf Practical Assessment: Protocol Fuzzing in a BlackBox approach]
|-
|
| Seminars: 4 (total)
|-
|
| [[user:hachicmo]] + [[user:sabilfa]] : [[File:4MMSR-2011-2012-student_seminar-Rainbow Tables probabilistes.pdf|Rainbow Tables probabilistes]]
|-
|
| [[user:mendyn]] + [[user:soumarmo]] : [[File:4MMSR-2011-2012-student_seminar-Reflection Scan- an Off-Path Attack on TCP, Jan Wrobel, 2012.pdf|Reflection Scan: an Off-Path Attack on TCP, Jan Wrobel, 2012]]
|- 
|
| [[user:lavaletl]] + [[user:broussep]] :     [[File:4MMSR-2011-2012-student_seminar-Deception 2.0-Social networks for information operations - Christophe DEVAUX, Arnauld MASCRET, Frederic Raynal - HITB 2010.pdf|Deception 2.0-Social networks for information operations - Christophe DEVAUX, Arnauld MASCRET, Frederic Raynal - HITB 2010]]
|-
|
| [[user:gsimm]] + [[user:benhamow]] : [[File:4MMSR-2011-2012-student_seminar-Injecting SMS Messages into Smart Phones for Security Analysis, Collin Mulliner, Charlie Miller, USENIX 2009|Injecting SMS Messages into Smart Phones for Security Analysis, Collin Mulliner, Charlie Miller, USENIX 2009]]
|-
----
|- 
| 2012-04-05
| * P. Malterre - The Onion Router (TOR). (slides will not be publicly available. contact the author or [[user:duchenef]])
|-
|
| * P. Malterre - Information System Monitoring (slides will not be publicly available. contact the author or [[user:duchenef]])
|-
|
|
----
|- 
| 2012-04-18
| [[User:hossen|K. Hossen]]
|-
|
| Seminars: 4
|-
|
| [[user:boumertl]] + [[user:boukioam]] :   [[File:4MMSR-2011-2012-student_seminar-Analysis and Signature of Skype VoIP Session Traffic - Sven Ehlert, Sandrine Petgang.pdf]]
|-
|
| [[user:soutorid]] + [[user:yanenkod]] + [[user:richterf]] : [[File:4MMSR-2011-2012-student_seminar-W32.Stuxnet Dossier, Nicolas Falliere, Liam O Murchu, and Eric Chien - 2011.pdf]]
|-
|
| [[user:myesserh]] + [[user:mbarekw]] : [[File:4MMSR-2011-2012-student_seminar-Bitcoin- A Peer-to-Peer Electronic Cash System.pdf]]
|-
|
| [[user:martincl]] + [[user:tollardt]] [[File:4MMSR-2011-2012-student_seminar-Recent advances in IPv6 insecurities - Marc van Hauser Heuse - 27C3-CCC 2010.pdf]]
|- 
|
| Homework for 2012-04-30:
|-
| 
| * [http://car-online.fr/files/teaching/2012-Ensimag-4MMSR/practical_assessments/TP7-The_Onion_Router/Ensimag-4MMSR-TP7-TOR.pdf TOR practical assessment] (P. Malterre and F. Duchene) [[4MMSR-Network_Security-2011-2012-practical_assessment-Network_Forensics-The_Onion_Router|Network Forensics practical assessment discussion page]]
|-
|
| * [http://car-online.fr/files/teaching/2012-UJF-Safe/practical/TP2-metasploit.pdf Metasploit - pratical assessment] (ONLY '''2. Information Gathering''') [[4MMSR-Network_Security-2011-2012-practical_assessment-metasploit|Metasploit practical assessment discussion page]]
|-
|
----
|- 
| 2012-04-30
|-
|
| [[user:hossen|K. Hossen]]
|-
|
| Correction of [http://car-online.fr/files/teaching/2012-Ensimag-4MMSR/practical_assessments/TP7-The_Onion_Router/Ensimag-4MMSR-TP7-TOR.pdf TOR practical assessment] (P. Malterre and F. Duchene) [[4MMSR-Network_Security-2011-2012-practical_assessment-Network_Forensics-The_Onion_Router|Network Forensics practical assessment discussion page]]
|-
|
| Correction of [http://car-online.fr/files/teaching/2012-UJF-Safe/practical/TP2-metasploit.pdf Metasploit - pratical assessment] (ONLY '''2. Information Gathering''') [[4MMSR-Network_Security-2011-2012-practical_assessment-metasploit|Metasploit practical assessment discussion page]]
|-
|
| Work in small groups on previous theoretical exams (after seminars)
|-
| 
| Seminar: 2 (total)
|-
|
| [[user:perniequ]] + [[user:gellenok]] + [[user:akp]] [[File:4MMSR-2011-2012-student_seminar-PoC(k)ET, les détails d'un rootkit pour Windows Mobile 6 - Cedric Halbronn - SSTIC 2010.pdf]]
|-
|
| [[user:Rocariem]] + [[user:petitalb]] : [[File:4MMSR-2011-2012-student_seminar-iPhone data protection in depth - Jean-Baptiste Bedrune, Jean Sigwald - HITB Amsterdam 2011.pdf]]
|-
|
| "Opening" homework for 2012-05-14: 
|-
|
| * Web Services Security testing: some research advances in automated blackbox type-1 XSS vulnerability discovery using model inference assisted evolutionary fuzzing (dissemination of [http://www.itea2-diamonds.org/index.html ITEA2 DIAMONDS research project])
|-
|
| * [http://bit.ly/HvMtGL XSS Vulnerability Detection Using Model Inference Assisted Evolutionary Fuzzing] 
|-
|
| *watch and synthesize  [http://www.studiosevent.com/newscenter/?id=MSR20_MASS_UUS Retroactive Security] a short talk given by [http://research.microsoft.com/en-us/um/people/blampson/ Butler W. Lampson] Microsoft Research
|-
|
| 
----
|-
|
| (optional) If you have some free time..
|- 
|
| * watch and synthesize [http://research.microsoft.com/apps/video/default.aspx?id=153125 Applications of Grammatical Inference in Security and Program Analysis], [http://www.domagoj-babic.com Domagoj Babic] (Berkeley), talk at Microsoft Research  '''(and especially the part regarding how they semi-automatically infer a formal conjecture / model of the botnet)'''
|-

----
|-
| 2012-05-03
| [[user:hossen|K. Hossen]]
|-
|
| Practical examination
|
|-
|
| Grenoble INP - Perform evaluation (S. Abry)
----
|-
| 2012-05-14
| Theoretical examination - Ensimag D207, 10pm30-12pm30. For more details, see [[4MMSR-Network_Security-2011-2012#Examinations]]
|
|}



Rooms and sessions available on:
[http://ade52-inpg.grenet.fr/ade/custom/modules/plannings/direct_planning.jsp?projectId=90&login=voirIMATEL&password=imatel&resources=662 ADE 4MMSR]

==Seminars==
* 5/20
You will form groups of 2 people (1 person only if the number of students is an odd number).
After having selected a paper in the list (see below), you will prepare slides and present them to the class for 17 minutes (~ from 10 to 20 slides, including first slide, summary, references) + 3 minutes question.
Slides have to be in english. Speech can be in french or english (your choice).
Btw, I highly prefer references on the same slide as where you refer from...

===Paper and week-choice===
Send me an email, putting your buddy as CC, with title ''4MMSR-2011-seminar'', and indicate:
* your '''ensimag usernames''' + firstname + last name
* your 3 favorite papers that are not yet chosen (ordered by descending preference). 
* your 3 favorite talk dates (descending order)
Remark: FIFO paper attribution. No guarantee you will get your first choices.
{{Warning|
* Read (even very quickly) the paper you choose, to be sure you are interested in them! 
* You have to form your group and choose 3 papers, and a presentation date before '''Monday Feb 6th 2012, 11pm59 GMT+1'''. I will assign a group +  paper +  date to students who have not choosen by that time.}}

===Slides advices===
====Basics in creating a presentation====
* [http://research.microsoft.com/pubs/67052/giving-a-talk-slides.pdf How to give a Good Research Talk?] Simon L Peyton Jones, John Hughes, and John Launchbury [https://research.microsoft.com/en-us/um/people/simonpj/papers/giving-a-talk/giving-a-talk-html.html (aditionnal advices)]
* Suggested table of content (it is not MANDATORY to strictly follow such an order, but it might help you):
** 1st slide: paper title, paper authors, paper year of publication, in which conference? students names + firstname + student email @ensimag.fr + link to this webpage https://ensiwiki.ensimag.fr/index.php/4MMSR
** paper authors short bio (corporation / university, diplomas, field of work, h-index, g-index use [http://academic.research.microsoft.com academic.research.microsoft.com])
** table of content
** introduction / background knwoledge
** the problem authors are trying to solve
** their proposed solution / method
** experiment results
** limitations, counter-measures
** conclusions / summary / overview of the key concepts and findings
** references
** backup slides: additional details, some questions people will ask you and for which you already have the answer, other cool stuff about the security researchers, also a small presentation of the researchers who are authors of that paper

* '''WARNING: do not forget the very basics...''' on EACH slide: 
** slide number / total slide number 
** paper title, paper authors, year of publication
** seminar date

====Templates====
* [[4MMSR-2011-2012-seminar-talk-talk__title-student_1_and_student_2.pptx|PowerPoint / Open-Office seminar talk slides]]
* [https://github.com/fabien-duchene/] (latex beamer seminar talk slides)

===Pre-talk reviews===
Before your actual presentation, you will have several deadlines (see below). At each deadline, I will provide you comments such as: focus more on that given point, add a schema for explaining that notion, introduce more background, describe more formally the problem... 
Mail subject: <pre>4MMSR-Seminar-2012-[title_of_the_paper_you_choosed]</pre>
'''Attached file: PDF version ONLY''' ; name your file ''DATE_OF_YOUR_TALK_-_STUDENT_1_-_STUDENT_2.pdf''
----
At each step N+1 you should have included comments I made you at step N:
* 3 weeks before: send a summary of the talk (dont write a too long summary and don't spend too much time on that 1 page is enough. 2 pages max), and a table of content (=TXT file) + in case of some points are unclear to you, write down the questions you are not able to answer yet regarding that paper.
* 2 weeks before: send a first talk draft + the additional paper and sources references you will provide (=PDF file)
* 1 week before: work in progress. should be nearly final (=PDF file)
* 3 days before: nearly final version (=PDF file)
* 1 day before: you would consider presenting to the class with those slides.  an email containing your slides + a link to the paper should be sent to the teacher who will forward it to the class  (=email containting PDF file + link)

===Papers list===
You can choose a paper (or eventually a talk) within that list, or propose me a topic by email (I will consider how it relates to the lecture content, its ''freshness'' and interest and then will decide if your proposed topic is accepted).
====Offensive Security====
* [http://www.blackhat.com/presentations/bh-usa-09/MILLER/BHUSA09-Miller-FuzzingPhone-PAPER.pdf Fuzzing the phone in your phone - Collin Mulliner, Charlie Miller - Black-Hat USA 2009]
* [http://arxiv.org/pdf/1201.2074v1 Reflection Scan: an Off-Path Attack on TCP, Jan Wróbel, 2012]
* [http://www.usenix.org/events/sec08/tech/full_papers/halderman/halderman.pdf Lest We Remember: Cold Boot Attacks on Encryption Keys. J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul,Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten -  USENIX, 2008]
* [https://db.usenix.org/event/hotbots07/tech/full_papers/grizzard/grizzard.pdf Peer-to-peer botnets: overview and case study, Julian B. Grizzard, Vikram Sharma, Chris Nunnery, and Brent ByungHoon Kang, David Dagon - USENIX, 2007]
* [http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf W32.Stuxnet Dossier, Nicolas Falliere, Liam O Murchu, and Eric Chien - 2011] (focus on ''Stuxnet Propagation Methods'')
* [http://www.sstic.org/2011/presentation/rainbow_tables_probabilistes/ Rainbow tables probabilistes, Alain Schneider, SSTIC, 2011]
* [http://homepages.cs.ncl.ac.uk/jeff.yan/msn_draft.pdf A Low-cost Attack on a Microsoft CAPTCHA, Jeff Yan, Ahmad Salah El Ahmad, 2008] 
* [https://db.usenix.org/event/woot10/tech/full_papers/Rizzo.pdf Practical Padding Oracle Attacks - Juliano Rizzo, Thai Duong - Black-Hat USA 2010]
* [http://iseclab.org/papers/raid2010.pdf Abusing Social Networks for Automated User Profiling, Marco Balduzzi, Christian Platzer, Thorsten Holz, Engin Kirda, Davide Balzarotti and Christopher Kruege, RAID, 2010]
* [http://www.taddong.com/docs/BlackHat_DC_2011_Perez-Pico_Mobile_Attacks-wp.pdf A practical attack against GPRS/EDGE/UMTS/HSPA mobile data communications - David Perez, Jose Pico - Black-Hat DC 2011] (provide additional background)
* [http://repo.zenk-security.com/Cryptographie%20.%20Algorithmes%20.%20Steganographie/Security%20Flaws%20Induced%20by%20CBC%20Padding%20Applications%20to%20SSL,%20IPSEC,%20WTLS....pdf Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS... - Serge Vaudenay - 2002]
* [https://www.blackhat.com/presentations/bh-europe-07/Butti/Presentation/bh-eu-07-Butti.pdf Wi-Fi Advanced Fuzzing - Laurent BUTTI – France Télécom / Orange Division R&D - Black-Hat EU 2007]
* [http://events.ccc.de/congress/2010/Fahrplan/attachments/1808_vh_thc-recent_advances_in_ipv6_insecurities.pdf Recent advances in IPv6 insecurities - Marc “van Hauser” Heuse - 27C3/CCC 2010]
* [http://www.usenix.org/event/woot09/tech/full_papers/mulliner.pdf Injecting SMS Messages into Smart Phones for Security Analysis, Collin Mulliner, Charlie Miller, USENIX 2009]
* [http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-iphonedataprotection.pdf iPhone data protection in depth - Jean-Baptiste Bedrune + Jean Sigwald - HITB Amsterdam 2011]
* [https://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf Bitsquatting - DNS Hijacking without exploitation, Artem Dinaburg, Black-Hat US 2011]
* [http://www.sstic.org/media/SSTIC2011/SSTIC-actes/attaques_dma_peer-to-peer_et_contremesures/SSTIC2011-Article-attaques_dma_peer-to-peer_et_contremesures-lone-sang_duflot_nicomette_deswarte.pdf Attaques DMA peer-to-peer et contremesures, Fernand Lone Sang, Vincent Nicomette, Yves Deswarte, and Loic Duflot, SSTIC, 2011]
* [http://esec-lab.sogeti.com/dotclear/public/publications/10-sstic-wm6_article.pdf PoC(k)ET, les détails d'un rootkit pour Windows Mobile 6 - Cédric Halbronn - SSTIC 2010]
* [http://www.security-labs.org/fred/docs/10-hitb-deception2.0.pdf Deception 2.0-Social networks for information operations - Christophe DEVAUX, Arnauld MASCRET, Frederic Raynal - HITB 2010]
* [https://media.blackhat.com/bh-eu-11/George_Hedfors/BlackHat_EU_2011_Hedfors_Owning_the_datacenter-Slides.pdf Owning the data centre, Cisco NX-OS - George Hedfors - Black-Hat EU 2011]
* [http://esec-lab.sogeti.com/dotclear/public/publications/10-hack.lu-nicreverse_slides.pdf Closer to metal: Reverse engineering the Broadcom NetExtreme’s firmware - Guillaume Delugré - 2010 - Hack.Lu]

====Defensive Security====
* [http://cclab.ntpu.edu.tw/ccclab_meeting/paper/2011-10-12_An%20Efficient%20and%20Secure%20RFID%20Security%20Method%20with%20Ownership%20Transfer.pdf An Efficient and Secure RFID Security Method with Ownership Transfer, Kyosuke Osaka Tsuyoshi Takagi, Kenichi Yamazaki, Osamu Takahashi, 2011]
* [http://www.antiphishing.org/ecrimeresearch/2007/proceedings/p60_abu-nimeh.pdf A Comparison of Machine Learning Techniques for Phishing Detection, Saeed Abu-Nimeh, Dario Nappa, Xinlei Wang, and Suku Nair - 2007]
* [http://www.sstic.org/media/SSTIC2010/SSTIC-actes/Trusted_Computing_Limitations_actuelles_et_perspec/SSTIC2010-Article-Trusted_Computing_Limitations_actuelles_et_perspectives-remi_guihery_guiheux_.pdf Trusted Computing : Limitations actuelles et perspectives, Frédéric Guihery, Frédéric Remi, Goulven Guiheux, SSTIC 2010]
* [http://sparrow.ece.cmu.edu/group/pub/parno_luk_gaustad_perrig_sensorRouting.pdf Secure Sensor Network Routing: A Clean-Slate Approach, Bryan Parno, Mark Luk, Evan Gaustad, Adrian Perrig, CoNEXT 2006 Lisboa, Portugal]
* [https://media.defcon.org/dc-19/presentations/Arlen/DEFCON-19-Arlen-Nano-Seconds.pdf Security when nanoseconds count, James Arlen, DEFCON 19, 2011] (the uggly truth regarding banking sector security)
* [http://www.ai-lab.it/armando/pub/sec2011.pdf From Multiple Credentials to Browser-based Single Sign-On: Are We More Secure? - Alessandro Armando, Roberto Carbone, Luca Compagna, Jorge Cuellar, Giancarlo Pellegrino, and Alessandro Sorniotti - 2011]
* [https://db.usenix.org/events/sec2001/full_papers/dean/dean.pdf Using Client Puzzles to Protect TLS - Drew Dean, Adam Stubblefield - 2001 -  USENIX]
* [http://www-stud.hs-fulda.org/~fdai2634/EB/Skype/Ehlert_SkypeSignature_2006.pdf Analysis and Signature of Skype VoIP Session Traffic - Sven Ehlert, Sandrine Petgang - 2006]
* [http://bitcoin.org/bitcoin.pdf Bitcoin: A Peer-to-Peer Electronic Cash System - Nakamoto, Satoshi  - 2009]
* [http://www.accuvant.com/sites/default/files/images/webbrowserresearch_v1_0.pdf Browser Security Comparison-A quantitative Approach - oshua Drake, Paul Mehta, Charlie Miller, Shawn Moyer, Ryan Smith, Chris Valasek - 2011] (focus on ''JavaScript JIT Hardening'' and ''URL blacklist services'')
* [http://kt.agh.edu.pl/~korczynski/An%20Accurate%20Sampling%20Scheme%20for%20Detecting%20SYN.pdf An Accurate Sampling Scheme for Detecting SYN Flooding Attacks and Portscans - Maciej Korczynski, Lucjan Janowski and Andrzej Duda - 2011]
* [http://www2007.org/workshops/paper_114.pdf New Metrics for Reputation Management in P2P Networks - Debora Donato, Mario Paniccia, Maddalena Selis, Carlos Castillo, Giovanni Cortese, Stefano Leonardi - 2007]

===Grading scheme===
* '''speakers''':
** CONTENT:
*** index, synthesis
*** schema
*** formal explanation of the problem
*** identification of security properties
*** counter-measures (even if not present within the article, in that case you have to propose some and we will discuss them)
*** hardness of the topic
*** questions asked to the authors
*** questioning about such a choice, or (if applicable) discussion about the interpretation of results
*** demonstration of the attack or the counter-measure (if any)
** FORM:
*** scheduling and respect of the time limit
*** balance in speaker time and content
*** interactions with public
* '''audience''':
** participation: you are supposed to actively participate as public, and thereby prepare and ask questions
** during the semester, each student is supposed to ask at least 3 questions 
* '''both''': 
** courtesy
** clarity, scientific rigor of talk and when asking or replying to questions
** ability to critic a scientific approach in a constructive fashion (eg: in what extends are the results promising? limitations: how widely can this approach be applied? are some hypotheses too restrictive, unrealistic?... how can you improve what is proposed?)
* '''theoritical exams'''
** 5 presented papers among the total (~ 15) will be selected and questions will be asked during the exam
** (thus '''take notes''')
** (ask questions if a point is unclear for you!)

===Acknowledgements===
* This exercise takes some inspiration from one of my former lecturer [http://www.uq.edu.au/uqresearchers/researcher/portmannm.html?uv_category=bio Marius Portmann] of [http://itee.uq.edu.au/~coms4507/ COMS4507 - Advanced Computer and Network Security] at the [http://www.uq.edu.au University of Queensland], [http://www.sydney-australia.biz/western-australia/graphics/western-australia-kangaroo-beach.jpg Australia].
* Thanks to [[User:hossen| K. Hossen]], [http://www.informatik.uni-trier.de/~ley/db/indices/a-tree/g/Groz:Roland.html R. Groz], [http://stalkr.net/ StalkR], [http://membres-liglab.imag.fr/rousseau/Site/Franck/Welcome.html F. Rousseau] for their advices

===SecurIMAG===
If the students are willing to, best presentations will be presented by themseleves at [[SecurIMAG]] (no bonus point granted, but interesting for you and securimag members)

==Practial assessments==
All allong the semester you will have short practical assessments that you will do at home and that we will correct the very next lecture.
* for practical exercises requiring a virtual machine, see the [[VirtualBox]] webpage.

==Examinations==
* WARNING: Electronic devices (including but not limited to cell phones, smartphones such as BlackBerry devices or iPhones, PDAs and other electronic and photographic devices) are not permitted during the exam. If you use them during the test, you will be dismissed from the exam, and will get a zero.
* Only one two-sided A4 sheet will be authorized. Since specific tools and commands will only be evaluated during the practical assessment, you write TWO two-sided A4 pages: 1 for the practical assessment and one for the theoretical one. 
===Practical Examination===
* At the end of the semester, a [[5MMSSI-2011_Hacking_CTF_like_practical_exam|CTF like practical examination]] will take place. 
* individual
* Weight: 5/20 (1/4 of the course grade)
* [[File:4MMSSR-2011-2012-practical_exam-rules.pdf|rules]]

====Synthesis: example of table of content====
'''cryptography'''
* cryptool
* gpg

'''web exploitation''' 
* nmap
* telnet
* live http headers
* burp

'''virtual machines'''
* virtualbox: configure virtual adapters and networks (bridge, host-only ...)

'''fuzzing'''
* sulley - state based protocol fuzzing: 
** defining states 
** choosing fuzz primitives for each state according to the vulnerability you target
** configuring transitions ("links" between states)

'''metasploit'''
* writing a msfconsole scanner
* loading it, configuring it, and running it

'''TOR'''
* argus, ra, racluster
* tshark, wireshark, tcpdump
* ssldump

===Theoretical Examination===
* weight: 10/20 (1/2 of the course grade)
* 3 papers over the total (~ 15) will be selected and questions will be asked during the exam
* additional exercices will be in the exam
* train yourself:
====Previous THEORETICAL examinations====
* [[Fichier:4MMSR-Ensimag-Telecom-2A-Network_Security-Examination-2011-2012-FR_FR.pdf]]
* [[Fichier:5MMSSI-2011-2012-final_exam_session_1-FR_FR.pdf|5MMSSI-2011-2012 final exam (french)]]
* [[Fichier:5MMSSI-2010-2011-final_exam_session_1-FR_FR.pdf|5MMSSI-2010-2011 final exam (french)]]
* 4MMSR 2010-2011 final exams:
** [[Fichier:4MMSR-Ensimag-Telecom-2A-Network_Security-Examination-2011-EN_US.pdf|english]]
** [[Fichier:4MMSR-Ensimag-Telecom-2A-Network_Security-Examination-2011-FR_FR.pdf|french]]
** [[Fichier:4MMSR-Ensimag-Telecom-2A-Network_Security-Examination-2011-2nd_session-EN_US.pdf|2nd session exam (english only)]]

====Synthesis: Example of Table of Content====
'''A. LECTURE'''

'''0. introduction''' 
* security properties
'''1.1. cryptography - introduction''' (K. Hossen)
* Vigenère
* EBC vs CBC
* RSA
* DH
* symetric vs asymmetric crypto
'''1.2. crypto applications'''
* PKI: Signature, Certificat, CA, Revocation
* WEP attack
* Kerberos: Accès inter-domaine
 
'''2. Network Security'''
* VLAN attacks
* DHCP attacks
* DNS cache poisoning
* Firewall: gen 1, gen 2: TCP state model aware, gen 3:DPI
* TOR (P. Malterre):
** noeud entrant, sortant, comment est assuré l'anonymat?
** comment detecte-t-on le traffic TOR (point de vue DPI) comment rend-t-on la détection plus difficile?
* Intrusion Detection (P. Malterre)
** points de capture: localisation, techniques

'''2. web vulnerabilities'''
* injection
* XSS (type-1, type2)
* SQL injection
* Path Traversal, LFI

'''3. fuzzing'''
* mutation
* generation
* model-based
* evolutionary

'''B. SEMINARS'''

An exercice within the theoretical examination will deal with topics we saw during the seminar. 
I suggest you use few space for seminars on your synthesis sheet, since I will print you the presentation related to chosen papers. 
Questions such as: what is the problem authors do tackle? how do they (partly) solve it? what is the limitation of their approach? what are the violated security properties on which objects? how would you suggest doing for going beyond the limitations?

==Links==
* [[4MMSR-Network_Security-2010-2011]]
* [[5MMSSI-2011-2012]]
* [[Securimag]]

===Career===
* [[Portail:SecurIMAG_Ensimag_IT_security_and_hacking_club/career]]
* [[A_career_in_Information_Security]]
* [[Portail:SecurIMAG_Ensimag_IT_security_and_hacking_club/studies]]