4MMSR-Network Security-2012-2013-old paper presentation-exercise
You will form groups of 3 people. After having selected a topic in the list (see below), you will perform the assigned tasks and prepare demonstration + slides and present them to the class for 17 minutes (~ from 10 to 20 slides, including first slide, summary, references) + 3 minutes question. Slides have to be in english. Speech can be in french or english (your choice). Btw, I highly prefer references on the same slide as where you refer from...
Sommaire
Paper and week-choice
Send me an email, putting your buddies as CC, with title 4MMSR-2012-seminar, and indicate:
- your ensimag usernames + firstname + last name
- your 3 favorite papers that are not yet chosen (ordered by descending preference).
- your 3 favorite talk dates (descending order)
Remark: FIFO paper attribution. No guarantee you will get your first choices.

- You have to form your group and choose 3 papers, and a presentation date before Monday Feb 6th 2012, 11pm59 GMT+1. I will assign a group + paper + date to students who have not choosen by that time.
Slides advices
Basics in creating a presentation
- How to give a Good Research Talk? Simon L Peyton Jones, John Hughes, and John Launchbury (aditionnal advices)
- Suggested table of content (it is not MANDATORY to strictly follow such an order, but it might help you):
- 1st slide: paper title, paper authors, paper year of publication, in which conference? students names + firstname + student email @ensimag.fr + link to this webpage https://ensiwiki.ensimag.fr/index.php/4MMSR
- paper authors short bio (corporation / university, diplomas, field of work, h-index, g-index use academic.research.microsoft.com)
- table of content
- introduction / background knwoledge
- the problem authors are trying to solve
- their proposed solution / method
- experiment results
- limitations, counter-measures
- conclusions / summary / overview of the key concepts and findings
- references
- backup slides: additional details, some questions people will ask you and for which you already have the answer, other cool stuff about the security researchers, also a small presentation of the researchers who are authors of that paper
- WARNING: do not forget the very basics... on EACH slide:
- slide number / total slide number
- paper title, paper authors, year of publication
- seminar date
Templates
- PowerPoint / Open-Office seminar talk slides
- [1] (latex beamer seminar talk slides)
Pre-talk reviews
Before your actual presentation, you will have several deadlines (see below). At each deadline, I will provide you comments such as: focus more on that given point, add a schema for explaining that notion, introduce more background, describe more formally the problem...
Mail subject:4MMSR-Seminar-2012-[title_of_the_paper_you_choosed]
Attached file: PDF version ONLY ; name your file DATE_OF_YOUR_TALK_-_STUDENT_1_-_STUDENT_2.pdf
At each step N+1 you should have included comments I made you at step N:
- 3 weeks before: send a summary of the talk (dont write a too long summary and don't spend too much time on that 1 page is enough. 2 pages max), and a table of content (=TXT file) + in case of some points are unclear to you, write down the questions you are not able to answer yet regarding that paper.
- 2 weeks before: send a first talk draft + the additional paper and sources references you will provide (=PDF file)
- 1 week before: work in progress. should be nearly final (=PDF file)
- 3 days before: nearly final version (=PDF file)
- 1 day before: you would consider presenting to the class with those slides. an email containing your slides + a link to the paper should be sent to the teacher who will forward it to the class (=email containting PDF file + link)
Papers list
You can choose a paper (or eventually a talk) within that list, or propose me a topic by email (I will consider how it relates to the lecture content, its freshness and interest and then will decide if your proposed topic is accepted).
Offensive Security
- Fault-Based Attack of RSA Authentication - 2010 - Andrea Pellegrini, Valeria Bertacco and Todd Austin
- Finding Buffer Overflow Inducing Loops in Binary Executables - Sanjay Rawat and Laurent Mounier - SERE 2012
- Low-Cost Traffic Analysis of Tor, Steven J. Murdoch and George Danezis - IEEE Symposium on Security and Privacy 2005
- Weaponizing Femtocells: The Effect of Rogue Devices on Mobile Telecommunication - Nico Golde, Ke ́vin Redon, Ravishankar Borgaonkar - NDSS '12
- Taint Analysis - Edgar Barbosa - H2HC 2009
- Would you mind forking this process? A Denial of Service attack on Android (and some countermeasures), Alessandro Armando, Alessio Merlo, Mauro Migliardi, Luca Verderame 2012
- Lest We Remember: Cold Boot Attacks on Encryption Keys. J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul,Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten - USENIX, 2008
- W32.Stuxnet Dossier, Nicolas Falliere, Liam O Murchu, and Eric Chien - 2011 (focus on the used 0-days)
- Practical Padding Oracle Attacks - Juliano Rizzo, Thai Duong - Black-Hat USA 2010
- Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS... - Serge Vaudenay - 2002
- iPhone data protection in depth - Jean-Baptiste Bedrune + Jean Sigwald - HITB Amsterdam 2011
- Bitsquatting - DNS Hijacking without exploitation, Artem Dinaburg, Black-Hat US 2011
- Attaques DMA peer-to-peer et contremesures, Fernand Lone Sang, Vincent Nicomette, Yves Deswarte, and Loic Duflot, SSTIC, 2011
- Owning the data centre, Cisco NX-OS - George Hedfors - Black-Hat EU 2011
- Closer to metal: Reverse engineering the Broadcom NetExtreme’s firmware - Guillaume Delugré - 2010 - Hack.Lu
- Off-Path Attacking the Web, Yossi Gilad and Amir Herzberg - Apr. 2012
Defensive Security
- Measuring and Fingerprinting Click-Spam in Ad Networks, SigComm2012
- Des clés dans DNS, un successeur à X.509?, Stéphane Bortzmeyer, JRES 2011
- An Efficient and Secure RFID Security Method with Ownership Transfer, Kyosuke Osaka Tsuyoshi Takagi, Kenichi Yamazaki, Osamu Takahashi, 2011
- A Comparison of Machine Learning Techniques for Phishing Detection, Saeed Abu-Nimeh, Dario Nappa, Xinlei Wang, and Suku Nair - 2007
- Trusted Computing : Limitations actuelles et perspectives, Frédéric Guihery, Frédéric Remi, Goulven Guiheux, SSTIC 2010
- Secure Sensor Network Routing: A Clean-Slate Approach, Bryan Parno, Mark Luk, Evan Gaustad, Adrian Perrig, CoNEXT 2006 Lisboa, Portugal
- Security when nanoseconds count, James Arlen, DEFCON 19, 2011 (the uggly truth regarding banking sector security)
- From Multiple Credentials to Browser-based Single Sign-On: Are We More Secure? - Alessandro Armando, Roberto Carbone, Luca Compagna, Jorge Cuellar, Giancarlo Pellegrino, and Alessandro Sorniotti - 2011
- Browser Security Comparison-A quantitative Approach - oshua Drake, Paul Mehta, Charlie Miller, Shawn Moyer, Ryan Smith, Chris Valasek - 2011 (focus on JavaScript JIT Hardening and URL blacklist services)
- An Accurate Sampling Scheme for Detecting SYN Flooding Attacks and Portscans - Maciej Korczynski, Lucjan Janowski and Andrzej Duda - 2011
- New Metrics for Reputation Management in P2P Networks - Debora Donato, Mario Paniccia, Maddalena Selis, Carlos Castillo, Giovanni Cortese, Stefano Leonardi - 2007
Grading scheme
- speakers:
- CONTENT:
- index, synthesis
- schema
- formal explanation of the problem
- identification of security properties
- counter-measures (even if not present within the article, in that case you have to propose some and we will discuss them)
- hardness of the topic
- questions asked to the authors
- questioning about such a choice, or (if applicable) discussion about the interpretation of results
- demonstration of the attack or the counter-measure (if any)
- FORM:
- scheduling and respect of the time limit
- balance in speaker time and content
- interactions with public
- CONTENT:
- audience:
- participation: you are supposed to actively participate as public, and thereby prepare and ask questions
- during the semester, each student is supposed to ask at least 3 questions
- both:
- courtesy
- clarity, scientific rigor of talk and when asking or replying to questions
- ability to critic a scientific approach in a constructive fashion (eg: in what extends are the results promising? limitations: how widely can this approach be applied? are some hypotheses too restrictive, unrealistic?... how can you improve what is proposed?)
- theoritical exams
- 5 presented papers among the total (~ 15) will be selected and questions will be asked during the exam
- (thus take notes)
- (ask questions if a point is unclear for you!)
Acknowledgements
- This exercise takes some inspiration from one of my former lecturer Marius Portmann of COMS4507 - Advanced Computer and Network Security at the University of Queensland, Australia.
- Thanks to K. Hossen, R. Groz, StalkR, F. Rousseau for their advices