CS 6301-005: Language-based Security

Course Information

Title: CS 6301-005: Language-based Security
Course Registration Number: 83075
Times: MW 1:00-2:15
Location: ECSN 2.112
Instructor: Dr. Kevin Hamlen (hamlen AT utdallas)
Instructor's Office Hours: MW 2:15-3:15, ECSS 3.704

Course Summary

This course will introduce and survey the field of Language-based Software Security, in which techniques from compilers and programming language theory are leveraged to address issues in computer security. Topics include:

  1. Certifying Compilers
  2. In-lined Reference Monitors
  3. Software Fault Isolation
  4. Address Space Randomization
  5. Formal Methods
  6. Web Scripting Security
  7. Information Flow Control

The aim of the course is to allow each student to develop a solid understanding of at least one of these topics, along with a more general familiarity with the range of research in the field. In-course discussion will highlight opportunities for cutting-edge research in each area. If you do research involving software security, this course will provide you with an array of powerful tools for addressing software security issues. If you do research involving programming languages or compilers, this course will show you how to take techniques that you already know and apply them to a new and important problem domain. If your career involves management or development of high-assurance software systems, this course will provide a comparative analysis of traditional versus language-based techniques.

The course is open to Ph.D. students and Masters students. Interested undergraduates should see the instructor for permission to take the course.

Suggested (non-mandatory) prerequisite: CS 6371 Advanced Programming Languages (or taken concurrently)

Grading

Homework (30%): For the first 10 weeks of the course, students will complete selected programming exercises from the online text Software Foundations.

Quizzes (30%): Most classes will begin with a short quiz testing the students comprension of an assigned reading for the day. Questions will typically be multiple choice or short answer. The easier questions will be designed to test whether the student has read the material, and the harder ones will test deeper understanding of more subtle points.

Class Participation (10%): Students are expected to come to class having read the assigned paper(s), and prepared with questions, critiques, and discussion topics. Regular attendance and class participation will count 10% towards their grades in the course.

Project (30%): Students will work individually or in a small team for the last 6 weeks of the course to complete a small project using the Coq theorem-prover. A typical project will involve implementing and formally verifying a standard algorithm of the student's choosing. Students will present their projects in class, with the presentation counting toward their project grade.

Texts

In our study of the Coq theorem proving system, we will be using the following online textbook:

For those who wish to explore Coq in greater depth (e.g., for developing their projects), the following book by the Coq developers is highly recommended:

Additionally, the following two texts available through the UTD library may be useful for general background on type theory and computer security, respectively:

Tentative Course Schedule

Date Topic Assigned Reading(s) Coq Exercises
Program-Proof Co-development
Lecture 1:
Mon 8/25		 Introduction to Formal Methods and Secure Software Development
Lecture Slides
Coq Transcript

Basics

  1. nandb (*)
  2. andb3 (*)
  3. binary (***)
Lecture 2:
Wed 8/27		 Higher-order Types
Coq Transcript		 Software Foundations: "Basics" chapter, up to and including the first two exercises (nandb, andb3).
No Class:
Mon 9/1		 No class: Labor Day
Lecture 3:
Wed 9/3		 Machine-verified Proofs
Coq Transcript		 Software Foundations: "Basics" chapter
Lecture 4:
Mon 9/8		 Proof Tactics
Coq Transcript		 Software Foundations: "Induction" chapter

Induction

  1. basic_induction (**)
  2. binary_commute (***)
  3. binary_inverse (*****)
Lecture 5:
Wed 9/10		 Logical Operators
Coq Transcript		 F. Williams. Investigating SANS/CWE Top 25 Programming Errors. Tech. Rep. ICTN 6870, E. Carolina University, 2009.
Lecture 6:
Mon 9/15		 Constructivistic Logic
Coq Transcript		 T. Zimmermann, N. Nagappan, and L. Williams. Searching for a Needle in a Haystack: Predicting Security Vulnerabilities for Windows Vista. In Proc. 3rd Int. Conf. Software Testing, Verification and Validation (ICST), pp. 421-428, April 2010.
Lecture 7:
Wed 9/17		 Non-termination, Soundness, and Contradiction
Coq Transcript		 J. Bau and J. C. Mitchell. Security Modeling and Analysis. IEEE Security & Privacy 9(3):18-25, 2011.
Security Fundamentals
Lecture 8:
Mon 9/22		 The Science of Security
Lecture Slides		 P. Hudak. Conception, Evolution, and Application of Functional Programming Languages. ACM Computing Surveys, 21(3):359-411, May 1989.
  • Required sections: Abstract, Introduction, 2.1, 2.3, and 2.4

Lists

  1. snd_fst_is_swap (*)
  2. list_funs (**)
  3. list_exercises (***)
Lecture 9:
Wed 9/24		 Formally Verified Compilation
Lecture Slides		 X. Leroy. Formal Verification of a Realistic Compiler. Communications of the ACM, 52(7):107-115, 2009.
Lecture 10:
Mon 9/29		 Guest Speaker: Richard Wartell, FireEye/Mandiant
Class will meet in the TI Auditorium		 G. Stewart. Computational Verification of Network Programs in Coq, In Proc. 3rd Int. Conf. Certified Programs and Proofs (CPP), pp. 33-49, December 2013.

Polymorphism

  1. poly_exercises (**)
  2. split (**)
  3. map_rev (***)
Model-checking
Lecture 11:
Wed 10/1		 Intro to Model-checking
Lecture Slides		 M. Müller-Olm, D. Schmidt, and B. Steffen. Model-Checking: A Tutorial Introduction. In Proc. 6th Int. Sym. Static Analysis (SAS), pp. 330-354, September 1999.
  • Required sections: 1–4.2 and 5
  • I will not quiz you on the parts about fixed point theory in Section 3.3, but do read the paragraph on Computational Tree Logic.
Lecture 12:
Mon 10/6		 Hardware Verification with Coq
Guest Speaker: Yiorgos Makris		 T. Ball, V. Levin, and S.K. Rajamani. A Decade of Software Model Checking with SLAM. Communications of the ACM, 54(7):68-76, 2011.
In-lined Reference Monitors
Lecture 13:
Wed 10/8		 Theory of IRMs
Lecture Slides		 F. B. Schneider. Enforceable Security Policies. ACM Transactions on Information and System Security, 3(1):30-50, 2000.
Lecture 14:
Mon 10/13		 Aspect-Oriented Programming and IRMs
Lecture Slides		 M. Jones and K. W. Hamlen. Disambiguating Aspect-oriented Security Policies. In Proc. 9th Int. Conf. Aspect-Oriented Software Development (AOSD), pp. 193-204, March 2010.

MoreCoq

  1. silly_ex (**)
  2. sillyex1 (*)
  3. beq_nat_true (**)
Lecture 15:
Wed 10/15		 Type-based Certification of IRMs
Lecture Slides		 K. W. Hamlen, G. Morrisett, and F. B. Schneider. Certified In-lined Reference Monitoring on .NET. In Proc. 1st ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), pp. 7-16, June 2006.
Lecture 16:
Mon 10/20		 Model-checking IRMs
Lecture Slides		 K. W. Hamlen, M. M. Jones, and M. Sridhar. Aspect-oriented Runtime Monitor Certification. In Proc. 18th Int. Conf. Tools and Algorithms for the Construction and Analysis of Systems (TACAS), pp. 126-140, March-April 2012.

Prop

  1. b_timesm (*)
  2. gorgeous_sum (**)
  3. double_even (*)
Code-reuse Attacks and Defenses
Lecture 17:
Wed 10/22		 Return-oriented Programming
Lecture Slides		 E. J. Schwartz, T. Avgerinos, and D. Brumley. Q: Exploit Hardening Made Easy. In Proc. 20th USENIX Security Symposium, 2011.
Lecture 18:
Mon 10/27		 Artificial Diversity and Derandomization
Lecture Slides
Project Slides		 H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. On the Effectiveness of Address-Space Randomization. In Proc. ACM Conf. Computer and Communications Security (CCS), pp. 298-307, 2004.

Logic

  1. and_assoc (*)
  2. or_distributes_over_and_2 (**)
  3. contrapositive (**)
  4. dist_not_exists (*): This theorem is not in the most current Software Foundation textbook. If it's not in your version, add it:
    • Theorem dist_not_exists: forall (X:Type) (P:X->Prop), (forall x, P x) -> ~(exists x, ~ P x).
Lecture 19:
Wed 10/29		 Control-flow Integrity
Lecture Slides		 M. Abadi, M. Budiu, Ú. Erlingsson, and J. Ligatti. Control-Flow Integrity: Principles, Implementations, and Applications. In Proc. ACM Conf. Computer and Communications Security, pp. 340-353, 2005.
Lecture 20:
Mon 11/3		 Software Fault Isolation of Legacy Software R. Wartell, V. Mohan, K. W. Hamlen, and Z. Lin. Securing Untrusted Code via Compiler-Agnostic Binary Rewriting. In Proc. 28th Annual Computer Security Applications Conf. (ACSAC), pp. 299-308, December 2012.
Lecture 21:
Wed 11/5		 TCB Minimization of SFI G. Morrisett, G. Tan, J. Tassarotti, J.-B. Tristan, and E. Gan. RockSalt: Better, Faster, Stronger SFI for the x86. In Proc. 33rd ACM SIGPLAN Conf. Programming Languages Design and Implementation (PLDI), pp. 395-404, June 2012.

Project
Web Security
Lecture 22:
Mon 11/10		 JavaScript Security
Guest Speaker: Dr. Phú Phung
Class will meet in the TI Auditorium		 P.H. Phung, M. Monshizadeh, M. Sridhar, K.W. Hamlen, and V.N. Venkatakrishnan. Between Worlds: Securing Mixed JavaScript/ActionScript Multi-party Web Content. IEEE Transactions on Dependable and Secure Computing (TDSC), 2014, forthcoming.
Lecture 23:
Wed 11/12		 Malvertising
Lecture Slides		 Z. Li, K. Zhang, Y. Xie, F. Yu, and X. Wang. Knowing Your Enemy: Understanding and Detecting Malicious Web Advertising. In Proc. ACM Computer and Communications Security, pp. 674-686, 2012.
Honey-pots
Lecture 24:
Mon 11/17		 Intro to Honey-pots
Coq Transcript		 N. Provos. A Virtual Honeypot Framework. In Proc. 13th USENIX Security Symposium, August 2004.
Lecture 25:
Wed 11/19		 Honey-patching F. Araujo, K.W. Hamlen, S. Biedermann, and S. Katzenbeisser. From Patches to Honey-Patches: Lightweight Attacker Misdirection, Deception, and Disinformation. In Proc. ACM Computer and Communications Security (CCS), 2014, forthcoming.
No Class:
Mon 11/24		 No class: Fall break
No Class:
Wed 11/26		 No class: Fall break
Type-based Information Flow Control
Lecture 26:
Mon 12/1		 Intro to Type-based Information Flow Tracking A. Sabelfeld and A. C. Myers. Language-Based Information-Flow Security. IEEE J. Selected Areas in Communications, 21(1):5-19, 2003.
Lecture 27:
Wed 12/3		 Info Flow for Java A. C. Myers. JFlow: Practical Mostly-Static Information Flow Control. In Proc. 26th ACM Sym. Principles of Programming Languages (POPL), pp. 228-241, 1999.
Presentations
Presentations:
Mon 12/8		 Final Project Presentations Student Presentations:
  1. Course Summary (Hamlen)
  2. Nguyen, Tran, and Tucker
  3. Duan
Presentations:
Wed 12/10		 Final Project Presentations Student Presentations:
  1. Are, McDonald, McMillin, and Stallbohm
  2. Charlton, Eshwarappa, Kumar, and Shapouri
  3. Joseph, Marshall, and Thompson