Computer Systems Security

This introductory lecture establishes the foundational concepts of computer systems security, outlining course organization and the critical framework of threat models for analyzing system vulnerabilities and attacker capabilities.

This lecture continues the discussion on buffer overflows, detailing various methods for control hijacking attacks, including stack smashing and return-to-libc attacks, and introduces defenses like non-executable stacks and ASLR.

This lecture from MIT's advanced computer security course details classic buffer overflow vulnerabilities, examining techniques such as baggy bounds handling and advanced return-oriented programming (ROP) for exploit construction and mitigation.

This lecture introduces the architectural principles and practical implementations of privilege separation, examining how operating systems and applications can isolate components to mitigate security vulnerabilities and enforce the principle of least privilege.

This lecture continues the discussion of privilege separation in computer systems, focusing on the architectural implications and security benefits of capability-based models for controlling access rights and managing system resources.

This lecture introduces the Native Client system, detailing its architectural approach to software fault isolation and secure execution of native code within a browser environment.

This lecture from MIT's advanced Computer Systems Security course introduces the foundational principles of the web security model, focusing on client-side application vulnerabilities and the architectural security mechanisms within web browsers.

This lecture, part of MIT's advanced computer systems security course, delves into the principles and common vulnerabilities encountered when designing and implementing secure web applications. Topics include protection against prevalent attack vectors such as injection flaws and cross-site scripting.

This lecture delves into the foundational concept of symbolic execution, a powerful program analysis technique for automatically exploring execution paths to find vulnerabilities.

This session introduces Ur/Web, a functional programming language designed to build secure, full-stack web applications with robust static guarantees.

This lecture explores the fundamentals of network security, tracing the historical evolution of TCP/IP and its implications for secure communication protocols.

This session focuses on the Kerberos authentication service, dissecting its architecture and mechanisms for secure network authentication across untrusted networks.

This lecture details the cryptographic protection of network communications using SSL/TLS and HTTPS, integrating these mechanisms into the broader web security model.

Kevin Fu delivers a guest lecture on the unique security challenges and critical vulnerabilities inherent in medical software and embedded medical devices.

This lecture focuses on side-channel attacks, with a particular emphasis on timing attacks and their exploitation of physical implementation characteristics of cryptographic algorithms.

This session examines various user authentication schemes, discussing their underlying principles, practical implementations, and inherent security trade-offs.

This lecture discusses the multifaceted challenges of privacy within the context of web browsers and the broader web security landscape, including tracking mechanisms.

Nick Mathewson provides a guest lecture on anonymous communication systems, detailing the design principles and operational mechanics of Tor.

This lecture analyzes the security architecture of the Android platform, dissecting its core design principles and mechanisms for mobile phone security.

This session explores taint tracking as a method for information flow analysis, specifically examining its application within the Android platform to monitor data propagation.

Mark Silis and David LaPorte from MIT IS&T deliver a guest lecture outlining practical information security practices and institutional roles within a large university environment.

This lecture applies economic principles to cybersecurity, specifically analyzing the economic incentives and structures underpinning the spam ecosystem.