Software Security and Secure Programming

Course staff

• Laurent Mounier

• Marie-Laure Potet

Attendees

• CyberSecurity Master students [mandatory course]

Schedule

Part 1 (first 6 weeks)
    classes on Tuesday (11.15 am to 12.45 am) and Wednesday (2 pm to 3.30 pm)

Part 2 (next 6 weeks)
    classes on Tuesday (8.15 am to 11.15 am)

The official timetable is available here:
    https://edt.grenoble-inp.fr/2019-2020

Past Exams

• Final Exam of January 2020 and Some correction indications

• Final Exam of January 2018 and Some correction indications

• Written assignment of November 2019 and Some correction indications

• Written assignment of November 2018

Some general references

web sites

• CERT coding standarts

• Securimag - The IMAG ethical hacking / security association 

• PCarre - proposals for M2R research interships

• A short overview of the C language (but sufficient for the purpose of this course)

books and papers

• "Writing Secure Codes" (M. Howard and D. LeBlanc, MicroSoft) [also available online]

 
On-going tentative schedule ...

Part 1 [CySec + Mosig students]

week 1 - 28/09

29/09 : course introduction [slides]
30/09 : how (in)-secure is a programming language ? [slides]

reading suggestions:

•     slides from E. Poll introduction course

•     Mind your Language(s)

•     A comprehensive description of C undefined behaviors

•     MicroSoft banned function calls

•     "The Emperor's Old Clothes" (The 1980 ACM Turing Award Lecture, by C.A.R Hoare)


week 2 - 05/10

06/10: understanding (and avoiding !) code vulnerabilities  ...   [slides]
07/10: some  exercises about programming languages (in)-security and some correction indications [Rooms D207 (group 1) and D208 (group 2)]

reading suggestions:

• Common Weakness Enumeration: buffer overflows, integer overflows, use-after-free, etc.

• Smashing the stack for fun and profit (Aleph One)

• What happened to my Code ? (about undefined behaviors in C)

• CERT secure coding standarts

week 3 - 12/10

13/10:  protections and counter-measures  [slides]
1410:  language-level vulnerabilities [lab session - Rooms D200 and D201] : the subject and the source files.

reading suggestions:



• about StackProtector
• about clang code hardening options (on Quarkslab blog)
  
• a mini-tutorial for retrieving the stack frame layout of a C function
  

week 4 - 19/10

20/10:   disassembling and x86 assembly language [slides and E. Fleury slides]
21/10: Buffer overflows  [lab session - Rooms E200, E201 and  D213 (with your own machine)] : the subject

reading suggestions:



• The Chris Eagle tutorial on IDA Pro
• A (complete !) course on x86 assembly language
• A web site for playing with compilers ...

vacations from 26/10 to 01/11

week 5 - 02/11

03/11: information-flow analysis   (slides from E. Poll)
04/11: some training exercises

reading suggestions:



• Lecture notes from  E. Poll Language-Based Security (chapter 4 and 5)

10/11: A summary about information-flow analysis" and some elements on sandboxing (slides from E. Poll)

reading suggestions:

• Lecture notes from  E. Poll Language-Based Security (chapter 4 and 5)
• A bit of Rust (slides)
• About Language-based Security

Part 2 [CySec students only]

week 7 -

17/11:  outline of part2  [slides] + an outline on fuzzing and Symbolic Execution [slides] [+ slides from D.Song] [+ Slides from Martin Vechev]

reading suggestions:

• Fuzzing: Hack, Art and Science, by P. Godefroid [paper and video]
• A survey about fuzzing
  

• Playing with AFL

week 8 -

24/11:  Lab session on Fuzzing and Symbolic Execution ( with AFL and with PathCrawler)