coursemapLoading course
School of Computing · ANU College of Systems and Society
Software Security covers advanced techniques in software vulnerability assessment, discovery and mitigation. These include: common patterns in software vulnerabilities, such as stack-based buffer overflow, format string vulnerabilities, and heap-based vulnerabilities; exploitation techniques such as code injection, return-oriented-programming; techniques for vulnerability discovery, such as program binaries reverse engineering, fuzzing and symbolic execution; and mitigation techniques such as memory protection mechanisms, input sanitation, and control flow integrity protection. The course features hands-on lectures and labs to analyse software vulnerabilities, both in the source code and in program binaries, and design and implement appropriate mitigation techniques.
Assignments with practical hands-on components, and report writing with in-depth analysis of vulnerabilities and designs and implementations of mitigation techniques.
Learning outcomes 1, 2, 3, 4
Final computer-based exam in vulnerability discovery and exploit writing.
Learning outcomes 3, 4, 5
The workload will be approximately 130 hours, with a mixture of lectures, labs, assignments, independent reading and study.
none Preliminary Reading The following are indicative of reference material relevant to the course. Since software security (and cyber security in general) is a fast changing field, this list will be updated as necessary to take into account the latest development in the field. - Dennis Andriesse. Practical Binary Analysis - Build Your Own Linux Tools for Binary Instrumentation, Analysis and Disassembly. No starch press, 2019. - Wenliang Du. Computer Security: A Hands-on Approach. 2nd edition, 2019. - Andrew Honig and Michael Sikorski. Practical Malware Analysis. No starch press, 2012. - Chris Anley, Felix Lindner, and John Heasman. The Shellcoder’s Handbook. 2nd edition, Wiley, 2007 - Research papers and online references