1. CS457 – Introduction to Information Systems Security Projects Elias Athanasopoulos elathan@ics.forth.gr

2. Project 1 On the Security of RC4 in TLS Usenix Security 2013. Nadhem AlFardan, Royal Holloway, University of London; Daniel J. Bernstein, University of Illinois at Chicago and Technische Universiteit Eindhoven; Kenneth G. Paterson, Bertram Poettering, and Jacob C.N. Schuldt, Royal Holloway, University of London. CS-457Elias Athanasopoulos2

3. Project 2 When Good Instructions Go Bad: Generalizing Return- Oriented Programming to RISC ACM CCS 2008 E. Buchanan, R. Roemer, H. Shacham, and S. Savage. Suggested reading: The Geometry of Innocent Flesh on the Bone: Return-into- libc without Function Calls (on the x86) ACM CCS 2007 H. Shacham. CS-457Elias Athanasopoulos3

4. Project 3 Smashing the Gadgets: Hindering Return-Oriented Programming Using In-Place Code Randomization Security and Privacy 2012 Vasilis Pappas, Michalis Polychronakis, and Angelos D. Keromytis Binary stirring: self-randomizing instruction addresses of legacy x86 binary code ACM CCS 2012 Richard Wartell, Vishwath Mohan, Kevin W. Hamlen, Zhiqiang Lin CS-457Elias Athanasopoulos4

5. Project 4 Practical Control Flow Integrity & Randomization for Binary Executables Security and Privacy 2013 Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Stephen McCamant, László Szekeres, Dawn Song, and Wei Zou. Suggested reading: Control-Flow Integrity: Principles, Implementations, and Applications ACM CCS 2005 Abadi et al. CS-457Elias Athanasopoulos5

6. Project 5 Out Of Control: Overcoming Control-Flow Integrity Security and Privacy 2014 Enes Göktaş, Elias Athanasopoulos, Herbert Bos, and Georgios Portokalidis Suggested reading: Practical Control Flow Integrity & Randomization for Binary Executables Security and Privacy 2013 Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Stephen McCamant, László Szekeres, Dawn Song, and Wei Zou. CS-457Elias Athanasopoulos6

7. Project 6 Size Does Matter - Why Using Gadget-Chain Length to Prevent Code- reuse Attacks is Hard Usenix Security 2014 Enes Göktaş, Elias Athanasopoulos, Michalis Polychronakis, Herbert Bos, and Georgios Portokalidis Suggested reading: Transparent ROP Exploit Mitigation using Indirect Branch Tracing Usenix Security 2013 Vasilis Pappas, Michalis Polychronakis, and Angelos D. Keromytis CS-457Elias Athanasopoulos7

8. Project 7 Cling: A Memory Allocator to Mitigate Dangling Pointers Usenix Security 2010 Periklis Akritidis CS-457Elias Athanasopoulos8

9. Project 8 Improving Integer Security for Systems with KINT OSDI 2012 Xi Wang and Haogang Chen, MIT CSAIL; Zhihao Jia, Tsinghua University IIIS; Nickolai Zeldovich and M. Frans Kaashoek, MIT CSAIL CS-457Elias Athanasopoulos9

10. Project 9 Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense NDSS 2009 Yacin Nadji, Prateek Saxena, Dawn Song Robust Defenses for Cross-Site Request Forgery ACM CCS 2008 Adam Barth, Collin Jackson, and John C. Mitchell CS-457Elias Athanasopoulos10