When & Where

The final exam will be held in our regular classroom on Wednesday, December 18, 2024. It will start promptly at 8:00pm and you will have until 10:00pm to complete it.

Exam rules

Be sure to arrive on time. If you arrive after the exam starts, you will not be allowed to take it.

This will be a closed book, closed notes exam. Calculators, phones, augmented reality glasses, laptops, and tablets are neither needed nor permitted. If you have these devices, you must turn them off, put them out of sight, and not access them for the duration of the exam.

No other electronic devices are permitted except for hearing aids, pacemakers, electronic nerve stimulators, other implanted medical devices, or electronic watches that function only as timekeeping devices or chronographs.

Bring a couple of pens or pencils with you. Plan to use a pen only if you are supremely confident in not changing your mind about your answers. . Check here for information about pencils, sharpeners, and the craft of pencil sharpening.

Past exams

The exam will be similar in structure to mid-semester exams but will cover material for the entire course. You can use past exams as a guide to what this exam may look like.

I plan to add 2–3 high-level short-answer questions in addition to the usual set of multiple choice questions.

I do not refer to old exams when I come up with a new one, so it is likely that many of the topics that I considered important in past exams will show up on future exams. Some material may have changed, however, so do not worry about questions that appear to relate to topics we have not covered.

Get past 419 exams here.

Study guide

You are responsible for the material from the first four lectures and recitations.

The final exam study guide is a concatenation of the previous three study guides along with the last lecture and attempts to cover most of the material you should know. It is not a substitute for the lectures, lecture material, and other reading matter. My goal is to put most of the information you need to know in as concise a form as possible.

→ Get the study guide

Topics

Topics that you should know and may be on the exam include:

Introduction

• What is computer security? Know the terms
  • CIA Triad
  • Confidentiality
  • Understand how privacy relates to confidentiality
  • Integrity
    • Data integrity
    • origin/destination (endpoint) integrity
    • system integrity
  • Availability
• Security goals
  • Prevention
  • Detection
  • Recovery
• Policy vs. Mechanism
• Definitions
  • Vulnerability
  • Exploit
  • Attack, attack vector, attack surface
  • Threat categories (know but don’t memorize)
    • Disclosure
    • Deception
    • Disruption
    • Usurpation
  • Threat modeling
• Examples of threats
  • Snooping
  • Modification
  • Alteration
  • Repudiation of origin
  • Denial of receipt
  • Delay
  • Denial of service

• Types of attackers: opportunistic, targeted, advanced persistent threat
• What is a trusted computing base?

Cryptography: Symmetric

• Terms:
  • authentication, integrity, nonrepudiation, confidentiality
  • plaintext, encryption, ciphertext, decryption, cipher
  • secret algorithm, public key cipher, symmetric cipher, symmetric key, public key, private key
• Schneier’s Law
• Kerckhoffs’s principle
• Properties of a good cryptosystem
• What is Shannon entropy? (You don’t need to know the formula)
• Key length
• Classic cryptography
  • Monoalphabetic substitution cipher; shift cipher
  • Attacks: frequency analysis
  • Polyalphabetic substitution cipher: Vigenère cipher
    • Why is it better than a monoalphabetic substitution cipher?
  • One-time pad: why is it so secure?
• What is perfect secrecy and what is needed to achieve it?
• What is a stream cipher and a keystream? Seeded pseudorandom number generator.
  • What is a running key?
• What is a rotor machine? Just know it’s a symmetric polyalphabetic cipher.
• Transposition cipher: Have a basic idea of what it does
  • What’s a scytale?
  • Columnar transposition cipher
• What is a block cipher?
  • What is meant by an iterative cipher and multiple rounds?
  • What is a subkey?
  • What is meant by substitution-permutation?
  • What is meant by confusion and diffusion?
  • What is an s-box?
  • What is the general idea behind a Feistel cipher?
  • What is an SP-Network?
  • I will not ask you how DES works but know it’s a Feistel cipher
  • DES vs. 3DES
  • I will not ask you how AES works but know it’s an SP-Network
• Block cipher modes
  • Electronic Code Book mode (ECB) - problems with using it
  • Cipher Block Chaining mode (CBC)
  • Counter mode (CTR)

Cryptography: Public

• Key distribution
  • Why is it a problem?
• What is meant by a trapdoor function?
• Public key cryptography
  • Understand how you use public & private keys
  • I will not ask you about how RSA works but know it’s based on the difficulty of factoring products of large primes.
  • I will not ask you about how ECC works but know it’s based on the difficulty of computing discrete logarithms
  • Some problems with using public key algorithms for general purpose communication
• Diffie-Hellman key exchange
  • You don’t have to know the algorithm
  • Know that it’s for key exchange and not encryption
  • Know that it is based on (a^b)mod c and its strength is based on our inability to find the inverse - do discrete logarithms
  • Understand how public & private keys are exchanged (you don’t need to know the formula)
  • Advantage over using RSA for key exchange (speed and speed in generating keys)
• What is a hybrid cryptosystem? What’s the advantage?
• What is meant by forward secrecy?
• What are ephemeral keys vs. long-term keys?
• What are session keys?
• Understand what algorithms are most affected by quantum computing

Data Integrity

• What is meant by a one-way function?
• What is a cryptographic hash function?
  • What are the properties of a cryptographic hash function?
  • What is pre-image resistance?
  • What does it mean to be collision resistant?
  • How do the birthday paradox and the pigeonhole principle tell us about hash functions?
  • I will not ask you about the difference between strong and weak collision resistance
• I will not ask you how SHA-1 or SHA-2 work (or any hash functions)

• Message Authentication Codes
  • What is a Message Authentication Code (MAC, or keyed hash)?
  • I will not ask you the formula for HMAC but understand it’s based on hashing the message and a secret key
  • Understand what a CBC-MAC is
• Digital signatures
  • What is a digital signature? How do you create one?
  • What are the properties of a digital signature?
  • What are the three basic operations you need to create and use digital signatures?
• What is a session key?
• How can a public key serve as an anonymous identity?
• Certificates
  • How do certificates serve as non-anonymous identities?
  • Understand that a certificate contains identifying information, a public key, the CA’s identification, and CA’s signature
  • What is a CA (Certification Authority)?
  • What is certificate revocation?
• Signed software
  • Understand the principle
  • Advantage of per-page signatures

Combined authentication and key exchange

• Security protocol notation
• How is a trusted third party play a role in combined authentication and key exchange
• Public key authentication
• Diffie-Hellman key exchange (see earlier notes)
• Needham-Schroeder: understand the value of adding a nonce
• Understand the value of adding a timestamp (you don’t have to remember the names Denning-Sacco)
• Understand the value of using session IDs (you don’t have to remember the names Otway-Rees)
• Kerberos
  • Understand it uses a trusted third party
  • You don’t have to know the protocol in detail but understand the phases and data you get
  • Understand that you get an encrypted session key and a ticket
  • Understand what a ticket is (basically, the same session key encrypted for the service)
  • Understand what a Ticket Granting Server does (provides tickets for all services other than giving the user a ticket for the TGS)

Authentication

• Distinction between identification, authentication, & authorization

• What are the three factors of authentication?

• What is multi-factor authentication (MFA)?

• Password Authentication Protocol

  • How does it work?
  • What are the security problems?
  • Hashed passwords
  • Dictionary vs. brute force attacks
  • Precomputed hashes
  • Salt
  • Credential stuffing & password spraying attacks
  • Password recovery options

• One-time Passwords

  • Sequence-based
    • S/key: understand how one-way functions can be used to create a list of one-time passwords
  • Challenge-based
    • Know the basic steps of CHAP
    • What makes it secure over a network?
    • Passkey authentication
  • Time-based and hash-based
    • Have a basic understanding of how time-based one-time passwords (TOTP) work: f(time, key)
    • I will not ask about Yubikey or SecurID (we didn’t cover those)
    • The difference between TOTP and HOTP

• Second factor

  • Push authentications
  • MFA fatigue (Push authentication fatigue)
  • Number matching authentication (NMA)

• What is a man-in-the-middle (MitM) attack?

Biometric Authentication

• Text: Chapter 15: pages 457–482 (from homework)
• How does pattern recognition apply to biometrics?
• How do _thresholds apply to biometrics?
• False accept rate (FAR) vs. false reject rate (FRR)
• Receiver Operator Characteristic (ROC) plot
• Behavioral factors
• Fingerprint minutiae
• Robustness vs. distinctiveness
• Authentication process: enrollment, sensing, feature extraction, pattern matching, decision
• Challenges:
  • trusted devices and data path
  • human liveness
  • tamper-proof devices and secure communications
  • thresholds
  • compartmentalization
  • theft of biometric
• Cooperative vs. non-cooperative systems

Hash Pointers, Bitcoin, and Blockchain

• Hash pointers: tamper-proof data

  • How do they differ from normal pointers?
  • What is a tamper-evident log, or blockchain?
  • What is a Merkle tree?

• Distributed ledger: roles of blocks and blockchains

• User identification (“addresses”)

  • Addresses (you don’t need to know the steps for deriving one but know what they are)
  • Addresses vs. public keys

• Transaction components: inputs, outputs, change, fee

• Double spending problem

• Role of Merkle trees in a bitcoin blockchain

• Role of mining and proof of work

• What is a target hash?

• What is the purpose Difficulty Adjustment Algorithm (just know what it does)

• Handling competing chains

• What is a 51% attack?

Access control

• What is protection?
• What is access control?
• Basic OS and hardware mechanisms for protection
  • Hardware timer
  • Process scheduler
  • Memory management unit (MMU)
  • user vs. kernel mode execution
  • You do not need to know about rings of privilege levels or call gates
  • Purpose of authentication
  • Subjects vs. objects
• Unix access control model
  • root user
  • User, group, other
  • Read, write, execute permissions
  • You don’t need to know the order of checking
  • You don’t need to know windows domains
  • You don’t need to know what permissions mean for directories (e.g., execute?)?
  • You don’t need to remember /etc/passwd and /etc/group but know that there’s a file that stores a user' login, user ID, and a user’s default group … and another that stores a list of groups and user names that belong to each group
  • You don’t need to remember syntax but know:
    • chmod - change permissions of a file
    • chown - change ownership of a file
    • chgrp - change group of a file
    • umask - initial (default) permissions of a file
    • possible race condition with using umask
  • setuid - what does it do? What are the risks?
• Access control lists (ACLs)
  • Know the purpose of ACLs
  • You don’t need to know any syntax for setting them
• Principle of least privilege
• Privilege separation
• Access control matrix
  • What’s a row annd what’s a column?
  • I will not ask about access transitions
  • I will not ask about domain transfers
  • Implementation problems of ACLs
  • Implementation problems of capability lists
• Mandatory Access Control (MAC)
  • DAC vs. MAC
  • Bell-LaPadula Model
    • Simple Security Property
    • *-Property
    • Discretionary Security Property
    • I will not ask about Bell-LaPadula tranquility principles
  • Biba Integrity Model
    • Difference from Bell-LaPadula
    • Simple Integrity Property
    • *-Property
  • Type Enforcement (TE) Model
    • Just the concept
  • Role-Based Access Control (RBAC) Model
    • Just the concept
• Multilateral security (lattice model)
  • What is the concept?
  • What is a compartment?
  • What does a lattice model represent?
• Chinese Wall model
  • What is the goal?
  • What is a conflict class?
  • I will not ask you about the Simple security property and *-property but understand when a subject will or will not be granted access to an object.
  • I will not ask you about unsanitized data

Code injection attacks and memory vulnerabilities

• What is a buffer overflow?

• Why are setuid programs attractive targets?

• Stack overflow

  • Role of stack pointer
  • Return address overwrite
  • NOP slide = landing zone

• Off-by-one stack overflow

  • What is a frame pointer?
  • Taking control

• Heap overflow

  • What is the risk?

• Format string attacks

  • What creates the vulnerability?
  • Understand how you can read the stack
  • Understand how you can write to memory via printf

• Defenses

  • Safe vs. dangerous functions (e.g., strncpy vs. strcpy)
  • What does fuzzing do?
  • What’s the problem with languages like C or C++?
  • Data Execution Prevention (DEP)
    • What does it do?
    • What is a return-to-libc attack?
    • What is Return Oriented Programming (ROP)?
  • Address Space Layout Randomization (ASLR)
    • What is it?
  • Stack canaries
    • What are they?
    • When are they checked?
    • Why would a compiler re-order how variables are allocated on the stack?
  • Shadow stacks

• Other memory vulnerabilities

  • Concepts and effects of integer overflow and underflow
  • Use-after-free vulnerability

Input bugs, command injection attacks

• Command injection attacks
  • What are they?
  • Difference from code injection
• SQL injection attack
  • I do not expect you to know SQL but recognize how the attack works and how interpreted languages and command interpreters in general are vulnerable
  • Prevention
    • Escaping
    • Parameterized queries
• Importance of input sanitization (input validation)
• What does shlex.quote() do in Python?
• Path traversal vulnerabilities
• Shell and execution environment attacks
  • system() and popen() risks
    • Understand that the attacks are essentially the same as for SQL injection
  • PATH: what is the risk?
  • LD_PRELOAD/LD_LIBRARY_PATH: what is the risk?
  • Assumptions about stdin, stdout, stderr: how might you attack a program via a file descriptor?
• Function interposition
• Non-injection attacks
  • Understand what is meant by comprehension errors
  • Understand why parsing a filename can be tricky
  • Understand why unicode can make parsing even trickier
  • What is a TOCTTOU (Time Of Check To Time Of Use) attack?
  • mktemp() problem

App Confinement

• Why is access control not sufficient?

• chroot

  • What does it do?
  • Why must it only be run as root?
  • What is the purpose of a jailkit?
  • How can you escape a chroot jail if you get root privileges?

• FreeBSD Jails

  • Understand the goal and how they wanted to improve chroot
  • Ability to restrict what root can do inside a jail

• Linux app isolation

  • Namespaces
    • Recognize the different namespaces: IPC, network, mount (file system), process IDs, user/group IDs, network name
  • Capabilities
    • Note that these have no relation to capability lists for files
    • Know that they restrict what privileges a process can have, whether it’s running as root or not
    • You don’t have to know the capabilities but it might be good to recognize a few of them to understand what kind of things they control
  • Control groups (cgroups)
    • Just know that they allow you to limit the amount of resources used by a proces (CPU, memory, file I/O, network I/O)

• Containers

  • Security components: namespaces, cgroups, capabilities
    • Remember what these do
  • What are containers and what are the benefits?
    • Separate policy from enforcement
    • Helps avoid comprehension errors
    • How does a container differ from a virtual machine?
    • Main components: control groups, namespaces, capabilities, copy-on-write file system
    • Understand some possible security problems with containers
  • You don’t need to know Docker Hub and Docker swarm, any Docker commands, Kubernetes, or container orchestration

• Virtual Machines

  • Process virtual machine: what is it? How does it differ from a VM?
  • What’s a hypervisor (virtual machine manager)
  • Handling of privileged instructions with VMM in place
  • Native vs. hosted VM
  • You don’t need to know covert channels (side channel attacks)

App Confinement: Application Sandboxing

• Kernel hooks with user-level validation (e.g., Janus)
  • Hooks
  • Per-process policies
  • User-level validation (e.g., Janus) problems: TOCTTOU, state synchronization
• Native OS sandboxing
  • Linux Seccomp-BPF (just what it does and that it’s implemented in the kernel)
  • system call filters
  • pattern matching
  • You don’t need to know anything about the Apple Sandbox
• Java sandbox roles of bytecode verifier, class loader, security manager
• You don’t need to know anything about web sandboxes or the Chromium Native Client

Malware

• Be familiar with terms: adware, exfiltration, spyware, ransomware, DoS, DDoS

• Zero-Day vulnerabilities & exploits

• Zero-Click exploits

• Honeypot

• Worm vs. virus

• Virus components: infection mechanism, packer, dropper, payload, trigger (logic bomb)

• Infiltration mechanisms

  • Code vulnerabilities, modified compilers, modified USB firmware, …
  • Social engineering
  • Credential stuffing, stolen credentials
  • Supply chain attacks

• Where malware lives

  • File infector virus
  • Bootloader (or boot sector) virus, bootkits
  • Infected flash drives: AutoRun, hacked firmware (UEFI), and data leakage
  • Macro viruses
  • Trojans (and remote access trojans)
  • Backdoors
  • I will not ask about JavaScript, source repositories
  • Rootkits: user & kernel mode rootkits
    • Hypervisor rootkit: what makes it more dangerous than other rootkits?
  • File-less malware
  • I will not ask you about the Blue Pill or Red Pill (SIDT instruction)
  • I will not ask about Stuxnet

• Social Engineering

  • Phishing, spear phishing
  • Smishing
  • Deceptive pop-ups
  • Deceptive websites
  • Typosquatting
  • Masquerading links
  • Malicious QR codes

• Gathering information via malware

  • Keyloggers
  • Side-channel attacks

• Bots, botnets, command & control servers

• Defenses

  • file protection (including MAC)
  • warning users
  • I will not ask you about SPF, DKIM, DMARC for email authentication
  • Anti-malware software
    • Signature scanning
    • Static heuristic analysis
    • Behavioral analysis
    • Sandboxing
  • Other defenses
    • Removing admin rights from users
    • Containers (but know there are problems)
  • Malware detection countermeasures: packers (techniques), polymorphism, triggers.
  • Understand the lessons of Reflections on Trusting Trust
  • Covert communication using DNS (see assignment)

Network security

• Basic concepts: packet switching local area network (LAN), IP, transport layer, TCP, UDP
• Internet: end-to-end principle
• Link layer
  • CAM overflow
    • What does a CAM overflow attack do?
    • Switch (MAC address) table, self-learning property
    • Content addressable memory (CAM)
    • Port security
  • VLAN hopping
    • What does a switch spoofing attack (VLAN hopping) do?
    • What is VLAN trunking?
  • ARP cache poisoning?
    • What is ARP cache poisoning?
    • What is the purpose of ARP? Know the purpose of an ARP response and a gratuitous ARP.
    • MAC address vs. IP address
    • ARP table
    • ARP broadcast
    • How can a system try to defend against ARP cache poisoning?
• Network layer
  • What is DHCP server spoofing?
  • How does DHCP snooping work?
  • Understand lack of authentication in IP datagrams, source address spoofing
  • Router attacks
• Transport layer
  • Simplicity of forging UDP packets
  • Understand the need for random TCP starting sequence numbers
  • What is a SYN flooding attack and how can you guard against it?
  • SYN cookies
• Routing
  • You don’t need to know External BGP vs. Internal BGP or OSPF (that’s background 352 info)
  • What is the purpose of BGP?
  • What is the security problem with BGP?
  • What is a prefix
  • Path forgery, prefix forgery
  • Purpose of RPKI
  • Purpose of BGPsec
• DNS
  • Security problem with DNS
  • You don’t need to know about the domain registry, registar, root servers (that’s background 352 info)
  • How does DNS (spoofing) cache poisoning differ from pharming?
  • Use of Query ID
  • Possible defenses against DNS spoofing
  • What is a DNS rebinding attack?
  • DNS pinning
  • Purpose of DNSSEC
  • Use of DNS for malware (homework)

VPNs

• Virtual Private Networks

  • What is a tunnel?
  • Tunnel mode vs. transport mode
  • IPsec Authentication Heander (AH) protocol
    • Just understand what it authenticates and encrypts
  • IPsec Encapsulating Security Payload (ESP) protocol
    • Just understand what it authenticates and encrypts
  • You don’t need to know the ciphers used by IPsec but know that it uses symmetric cryptography and HMACs. Know that Diffie-Hellman is most commonly used for key exchange
  • You don’t have to know wireguard

• Transport Layer Security (TLS)

  • Goal of TLS
  • Mutual vs. uni-directional authentication
  • Remember that SSL (Secure Socket Layer) evolved into TLS (just so you’re not confused between the acronyms)
  • Basic concepts: authentication, key exchange, message integrity, communication.
  • You don’t need to know the ciphers used by TLS but know that authentication is done with public keys and X.509 certificates, key exchange is be done with Diffie-Hellman keys; know that data is encrypted with a symmetric algorithm (usually AES), and data integrity is provided with an HMAC.
    • Know there are handshake and communication phases
  • You don’t need to know how the protocol changed in TLS 1.3
    • You don’t need to know TLS 1.3 key derivation (HKDF) or AEAD
  • You don’t need to know attacks on TLS
  • Know that client authentication is almost never used. Why?

• Difference between using VPNs and TLS

Firewalls

• Now does Network Address Translation (NAT) help with security?
• High-level goal of a firewall
• Approaches: Packet filters (screening routers), application proxies, IDS/IPS
• Packet filters
  • What does a screening router do?
  • You don’t have to know filter chains but know that packet filters go through a list of conditions (rules) to find one that matche the date in the IP packet header.
  • You don’t have to know the syntax of rules but should recognize allow/reject rules
  • You don’t have to know any of differences between Windows, OpenBSD, and Linux implementations
  • What is the principle of firewalling?
  • Why is a default deny model good?
  • How do you guard against spoofed internal traffic?
  • First-generation vs. second-generation vs. third-generation packet filters
  • What does stateful inspecion add to a packet filter?
  • What is a DMZ (demilitarized zone)?
  • What is microsegmentation?
  • What is deep packet inspection (DPI) and deep content inspection (DCI)?
• Intrusion Detection/Prevention Systems (IDS/IPS)
  • Understand the three types of systems: protocol-, signature-, and anomaly-based
  • Anomaly vs. misuse detection
  • Problem of false positives
  • Signatures in the context of IDS/IPS
  • Why is anomaly detection difficult?
• Application proxies
  • What are they?
  • What is a dual-homed host?
  • What is a bastion host?
• What is deperimiterization and how does the zero-trust model address it?
• Host-based vs. network firewalls

DDoS Attacks

• Distributed Denial of Service attack
• Volumetric vs packet-per-second attack
• Reflection amplification

Web browser security

• Understand the increase in browser complexity (don’t memorize the list but understand the issues)
  • JavaScript, DOM allows modification of pages, more communication models, multimedia support
  • Components come from multiple sources
• Role of iFrames
• Same-origin policy
  • When are frames considered to have the same origin?
  • What unique resources can an origin access? Cookies, JavaScript namespace, DOM storage, DOM tree
  • I won’t ask you about the MIME sniffing attack
  • Cross-Origin Resource Sharing (CORS)
  • What does CORS enable?
• Cookies
  • When are they sent to the server?
  • Purpose of HttpOnly
  • Purpose of Secure flag
• Cross-Site Request Forgery (CSRF)
  • How does it work and when is it a problem?
  • How can you defend against it?
• What is Clickjacking? How can you defend against it?
• I will not ask you about screen sharing
• Input sanitization issues
• What is an SQL injection attack?
• Cross-Site Scripting (XSS)
  • What is XSS?
  • Whet causes it?
  • Reflected vs. Persistent XSS
  • How do you defend against it?
• Homograph/homoglyph attacks, typosquatting, combosquatting
• Using images on the web to track access: tracking (spy) pixels

Steganography

• What is steganography?
• How does it differ from watermarking?
• What is a null cipher?
• What is chaffing and Winnowing?
• Some techniques to add data to images that users will not detect
• Text shifting

CAPTCHA

• What is the purpose if it?
• What does No CAPTCHA reCAPTCHA do?