EECS 588 Reading List

This list is subject to change. Updates will be posted by the end of the day on the Friday before each lecture.

Some articles require paid subscriptions to journals and digital libraries. You can access these for free when connecting on campus. For off-campus access, try the U-M VPN or the MLibrary Proxy Server Bookmarklet.

Essential Crypto

Tuesday, January 11 No written response required for today.

A Brief Introduction to Practical Cryptography

Thursday, January 13 No reading for today.

Crypto Attacks

Tuesday, January 18

MD5 To Be Considered Harmful Someday. Dan Kaminsky. 2004.
MD5 Considered Harmful Today. Sotirov, Stevens, Appelbaum, Lenstra, Molnar, Osvik, and Weger. CCC 2008.

Public Key Distribution and Certificates and TLS and SSL. Debby Koren, et al. Secure Networking Protocols Portal, 2009.

Thursday, January 20

Lessons Learned in Implementing and Deploying Crypto Software. Peter Gutmann. USENIX Security 2002.
Why Cryptosystems Fail. Ross Anderson. Commun. ACM, 37(11), Nov. 1994.

Cryptanalytic Attacks on Pseudorandom Number Generators. Kelsey, Schneier, Wagner, and Hall. FSE 1998.
Cryptanalysis of the Windows Random Number Generator. Dorrendorf, Gutterman, and Pinkas. CCS 2007.

Attacking Software

Tuesday, January 25

Smashing the Stack for Fun and Profit. Aleph One. Phrack 49(14), Nov. 1996.
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns. Pincus and Baker. IEEE Security and Privacy, July–Aug. 2004.

English Shellcode. Mason, Small, Monrose, and MacManus. CCS 2009.
Nozzle: A Defense Against Heap-spraying Code Injection Attacks. Ratanaworabhan, Livshits, and Zorn. 2008.

Thursday, January 27

On the Effectiveness of Address-Space Randomization. Shacham, Page, Pfaff, Goh, Modadugu, and Boneh. CCS 2004.
The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). Hovav Shacham. CCS 2007.

When Good Instructions Go Bad: Generalizing Return-Oriented Programming to RISC. Buchanan, Roemer, Shacham, and Savage. CCS 2008.

Defending Software

Tuesday, February 1

Reflections on Trusting Trust. Ken Thompson. Communications of the ACM, 27(8), Aug. 1984.
Towards Automatic Generation of Vulnerability-Based Signatures. Brumley, Newsome, Song, Wang, and Jha. IEEE Symposium on Security and Privacy, 2006.

Thursday, February 3

CloudAV: N-Version Antivirus in the Network Cloud. Oberheide, Cooke, and Jahanian. USENIX Security 2008.
Leveraging Legacy Code to Deploy Desktop Applications on the Web. Douceur, Elson, Howell, and Lorch. OSDI 2008.

Native Client: A Sandbox for Portable, Untrusted x86 Native Code. Yee, Sehr, Dardyk, Chen, Muth, Ormandy, Okasaka, Narula, and Fullagar. IEEE Symposium on Security and Privacy, 2009.
Safe Kernel Extensions Without Run-Time Checking. Necula and Lee. OSDI 1996.

Web Security I

Tuesday, February 8

Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers. Louw and Venkatakrishnan. IEEE Symposium on Security and Privacy, 2009.
Robust Defenses for Cross-Site Request Forgery. Barth, Jackson, and Mitchell. CSS 2008.

Thursday, February 10

Beware of Finer-Grained Origins. Jackson and Barth. Web 2.0 Security and Privacy 2008.
Protection and Communication Abstractions for Web Browsers in MashupOS. Wang, Fan, Howell, and Jackson. SOSP 2007.

Securing Browser Frame Communication. Barth, Jackson, and Mitchell. USENIX Security 2008.

Human Factors

Tuesday, February 15

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. Whitten and Tygar. USENIX Security 1999.
A Usability Study and Critique of Two Password Managers. Chiasson, van Oorschot, and Biddle. USENIX Security 2006.

Secrecy, Flagging, and Paranoia: Adoption Criteria in Encrypted Email. Gaw, Felten, and Fernandez-Kelly. CHI 2006.
In Search of Usable Security: Five Lessons from the Field. Balfanz, Durfee, Grinter, and Smetters. IEEE Security and Privacy, September/October 2004.

Thursday, February 17

reCAPTCHA: Human-Based Character Recognition via Web Security Measures. von Ahn, Maurer, McMillen, Abraham, and Blum. Science, September 2008.
Why Information Security is Hard – An Economic Perspective. Ross Anderson. ACSAC 2001.

Games with a Purpose. Luis von Ahn. CACM, August 2008.
So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users. Cormac Herley. NSPW 2009.

Web Security II

Tuesday, February 22

Crying Wolf: An Empirical Study of SSL Warning Eectiveness. Sunshine, Egelman, Almuhimedi, Atri, and Cranor. USENIX Security 2009.
ForceHTTPS Cookies: A Defense Against Eavesdropping and Pharming. Jackson and Barth. WWW 2008.

Thursday, February 24

Protecting Browsers from DNS Rebinding Attacks. Jackson, Barth, Bortz, Shao, And Boneh. CCS 2007.
The Security Architecture of the Chromium Browser. Barth, Jackson, Reis, and The Google Chrome Team. 2008.

Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense. Barth, Weinberger, and Song. USENIX Security 2009.

Network Security I

Tuesday, March 8

Black Ops 2008: It's the End of the Cache as We Know It. Kaminsky. Toorcon 2008 (slides).
Increased DNS Forgery Resistance Through 0x20-Bit Encoding. Dagon, Antonakakis, Vixie, Jinmei, and Lee. CCS 2008.

Inside the Slammer Worm. Moore, Paxson, Savage, Shannon, Staniford, and Weaver. IEEE Security and Privacy, July/August 2003.
A Survey of BGP Security Issues and Solutions. Butler, Farley, McDaniel, and Rexford. 2008.

Thursday, March 10

Bro: A System for Detecting Network Intruders in Real-Time. Paxson. Computer Networks 31(23-24), 1999.
Remote Physical Device Fingerprinting. Kohno, Broido, and Claffy. Oakland 2005.

Peeping Tom in the Neighborhood: Keystroke Eavesdropping on Multi-User Systems. Zhang and Wang. Usenix Security 2009.

Network Security II

Tuesday, March 15

Spamalytics: An Empirical Analysis of Spam Marketing Conversion. Kanich, Kreibich, Levchenko, Enright, Voelker, Paxson, and Savage. CCS 2008.
Your Botnet is My Botnet: Analysis of a Botnet Takeover. Stone-Gross, Cova, Cavallaro, Gilbert, Szydlowski, Kemmerer, Kruegel, and Vigna. CCS 2009.

A Multifaceted Approach to Understanding the Botnet Phenomenon. Rajab, Zarfoss, Monrose, and Terzis. ISC 2006.

Thursday, March 17

Smart-Phone Attacks and Defenses. Guo, Wang, and Zhu. HotNets 2004.
RFID Security and Privacy: A Research Survey. Juels. Journal of Selected Areas in Communication 2006.

Amigo: Proximity-Based Authentication of Mobile Devices. Varshavsky, Scannell, LaMarca, and de Lara. UbiComp 2007.

Advanced Topics

Tuesday, March 22

Shredding Your Garbage: Reducing Data Lifetime Through Secure Deallocation. Chow, Pfaff, Garfinkel, and Rosenblum. USENIX Security 2005.
Lest We Remember: Cold Boot Attacks on Encryption Keys. Halderman, Schoen, Heninger, Clarkson, Paul, Calandrino, Feldman, Appelbaum, and Felten. USENIX Security 2008.

BootJacker: Compromising Computers Using Forced Restarts. Chan, Carlyle, David, Farivar, and Campbell. CCS 2008.
Reconstructing RSA Private Keys from Random Key Bits. Heninger and Shacham. Crypto 2009.

Thursday, March 24

The ten-page Introduction to Trusted Computing. Martin. 2008.
Designing and Implementing Malicious Hardware. King, Tucek, Cozzie, Grier, Jiang, and Zhou. LEET 2008.

Building the IBM 4758 Secure Coprocessor. Dyer, Lnidermann, Perez, Sailer, van Doorn, Smith, and Weingart. IEEE Computer, Oct. 2001.
Reverse-Engineering a Cryptographic RFID Tag. Nohl, Evans, Starbug, and Plotz. USENIX Security 2008.
Cloaker: Hardware Supported Rootkit Concealment. David, Chan, Carlyle, and Campbell. Oakland 2008.

Privacy and Anonymity

Tuesday, March 29

Tor: The Second-Generation Onion Router. Dingledine, Mattewson, and Syverson. Usenix Security, 2004.
Off-the-Record Communication, or, Why Not to Use PGP. Borisov, Goldberg, and Brewer. WPES 2004.

Shining Light in Dark Places: Understanding the Tor Network. McCoy, Bauer, Grunwald, Kohno, and Sicker. Privacy Enhancing Technology Symposium, 2008.

Thursday, March 31 Readings will be announced after break.

Security and Society

Tuesday, April 5

Security Analysis of the Diebold AccuVote-TS Voting Machine. Feldman, Halderman, and Felten. EVT 2007.
Machine-Assisted Election Auditing. Calandrino, Halderman, and Felten. EVT 2007.

Analysis of an Electronic Voting System. Kohno, Stubblefield, Rubin, and Wallach. IEEE Security and Privacy 2004.
Security Analysis of India's Electronic Voting Machines. Wolchok, Wustrow, Halderman, Prasad, Kankipati, Sakhamuri, Yagati, and Gonggrijp. CCS 2010.
Helios: Web-based Open-Audit Voting. Ben Adida. USENIX Security 2008.

Thursday, April 7

The Generative Internet. Zittrain. Harvard Law Review, 2006.

Internet Clean-Slate Design: What and Why? Feldmann. 2007.

Project Presentations

There is no assigned reading for Tuesday, April 12 or Thursday, April 14.

Physical Security

Tuesday, April 19 No written response required for today.

Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks. Blaze. IEEE Security and Privacy, March/April 2003.
Keep it Secret, Stupid! Blaze. 2003.

Reconsidering Physical Key Secrecy: Teleduplication via Optical Decoding. Laxton, Wang, and Savage. CCS 2008.
Notes on Picking Pin Tumbler Locks. Blaze. 2003.
Safecracking for the Computer Scientist. Blaze. 2004.

Computer and Network Security

EECS 588 — Winter 2011

Paper Responses

Reading List