1. Herbert Bos Erik van der Kouwe Remco Vermeulen Andrei Bacs cns-l@few.vu.nl

2. Computer and Network Security Little crypto Much hacking No book Very intensive

3. Who should pick this course? You, if you would like to be a “security expert” You, if you are technical in the Systems sense – C and Linux should not be a problem for you – If you have never written a C program… then this might not be for you – At the very least, you will have to catch up You, if you are interested in solving technical problems You, if you are not afraid to invest “private” time…

4. Set up 70% challenges and 30% exam – all grades must be >= 5 Theory in lectures Four challenges – Throughout the course duration – Solve in your own time Final exam – Exam material: all material covered in the lectures – Papers and material provided during the lectures

5. Challenges Start simple, end tough You will not know in advance what the challenges are Speed matters – top 3: 1pt bonus – below that: it still matters! Top achievers will be announced and applauded Choose nicks – compete, have fun!

6. If you work hard… this will be an extremely rewarding course.

7. 2010

8. 2011

9. VU-Bar we run a regular CTF team excellent way to learn more and have fun

10. Hack in the Box 2010 (Amsterdam) – Capture the Flag competition – 6 VU students participated – When the dust settled… we ranked 1-6!

11. 2011

13. Contacts guest lecture(s) internships – KPMG – Atos – NFI – Smaller security firms – …

14. Alert: new course Binary and malware analysis (first term next year)

15. Course information Everything will be made available via blackboard There is a discussion board, use it! – All questions should first be posted on the discussion board – Help each other, but do not give full solutions

16. Case Study: Operation Aurora A massive cyber attack first disclosed by Google on January, 2010 – The attack targeted many different organizations (Google, Adobe, Yahoo, Symantec,... ) – Originated in China Goal: to compromise the source code repositories of several high tech companies

17. How did it work?

18. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... )

19. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... ) 2.A victim opens an infected web page

20. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... ) 2.A victim opens an infected web page 3.Some JavaScript code exploits a 0-day vulnerability in IE

21. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... ) 2.A victim opens an infected web page 3.Some JavaScript code exploits a 0-day vulnerability in IE 4.The payload of the exploit downloads & installs multiple malware samples

22. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... ) 2.A victim opens an infected web page 3.Some JavaScript code exploits a 0-day vulnerability in IE 4.The payload of the exploit downloads & installs multiple malware samples 5.The malware scan the LAN, looking for source code repositories

23. Case study: operation Aurora 1.The attackers spam infected URLs (e-mail, IM,... ) 2.A victim opens an infected web page 3.Some JavaScript code exploits a 0-day vulnerability in IE 4.The payload of the exploit downloads & installs multiple malware samples 5.The malware scan the LAN, looking for source code repositories 6.The malware contact a remote server and ask for commands from the attackers “attack www.cs.vu.nl”

25. Case study: operation Aurora Lessons learned 1.Most security threats start from the web 2.A malicious web page leverages a defect in a program to gain arbitrary code execution 3.The exploit downloads and installs a malware sample, infecting the victim 4.Victim turns into a bot Steals sensitive information Performs scan, DDoS, SPAM, and other malicious activities April 5, 16.17 (Network Security) May 4, 7, 10 April 20, 23, 27 May 14 What about today, and May 25 th ?  History, hacking, and (a crash course on) cryptography May 21

26. Course outline (tentative) Mon 2 April : Introduction Announce assignment 1  due on Mon 9 Apr @ 23:59 CET (1 week) Thu 5 Apr 9:00?!: Network security Announce assignment 2  due on Mon 23 Apr @ 23:59 CET (2+ weeks) Mon 16 Apr : Network security (CONT'd) Tue 17 : Network security (CONT'd) Fri 20 Apr : Application security Mon 23 Apr : Application security (CONT'd) Deadline assignment 2 Announce assignment 3  due 14 May Apr @ 23:59 CET (3+ weeks) Fri 27 Apr : Application security (CONT'd)

27. Course outline (tentative) Fri 4 May: Web App security Mon 7 May: Web App security (CONT'd) Fri 10 May: Web App security (CONT'd) Mon 14 May : Web App security (CONT'd) Deadline assignment 3 Announce assignment 4  due 31 May @ 23:59 CET (2 weeks) Mon 21 May : Botnets Fri 25 May : Cryptography Thu 31 May : EXAM Deadline assignment 3

28. Grading 70% assignments, 30% exam Every grade should be at least a 5.0 Speed matters

29. Assignment grade

30. Assignment grade breakdown

34. Instructors Herbert Bos herbertb@cs.vu.nl herbertb@cs.vu.nl Erik van der Kouwe vdkouwe@cs.vu.nl vdkouwe@cs.vu.nl Remco Vemeulen r.vermeulen@few.vu.nl r.vermeulen@few.vu.nl Andrei Bacs a.bacs@vu.nl a.bacs@vu.nl cns-l@few.vu.nl but send all your email to

35. Questions?