Defense Against the Dark Arts

Staff

Syllabus

1. What this course is

You will learn to attack systems so that you can defend them. We work at the level where security actually breaks: the stack frame, the parser, the browser origin, the audit log, and the AI agent that has been handed your credentials. The course is organized in four modules:

Not covered: cryptography, privacy, cryptocurrency, hardware security. Take a CS 4501/6501 offering for those.

2. Prerequisites

CS 3710 is required. You must arrive able to:

• write and debug C
• read x86 assembly and reason about the stack
• navigate a Unix shell without help

If you cannot do these three things, this course will not be a productive use of your semester.

3. Learning objectives

By the end you should be able to:

1. Take an unfamiliar binary and determine, with a debugger, whether and how it can be made to do something it wasn't meant to do.
2. Write a working exploit for a memory-corruption bug and explain precisely which mitigation would have stopped it.
3. Find and exploit the standard web vulnerability classes, and patch them correctly.
4. Reason about an AI-integrated system's threat model — identify where untrusted input meets privilege, and say what an attacker gets.
5. Reconstruct what happened on a compromised machine from its artifacts.
6. Judge a security claim. Read a paper or a vendor blog that says "we reduced attack success to near zero" and know what question to ask next.

4. Grading

Every assignment A1–A5 is worth 10%, split evenly: 5% for the code you submit (AI-OK) and 5% for a short oral about it (NO-AI). The two halves are graded separately — a weak oral does not lower your code score, and a strong code submission does not lift your oral. A6 is a bonus — no oral, and it sits on top of the 100% rather than inside it.

The assignment measures what you can build with all available tools. The oral, in a later week, measures what you understand without them. Here’s the rhythm of one assignment:

A0 is a required pass/fail onboarding gate and carries no points. What it gates is access: every assignment after it assumes the signed pledge and the environment A0 sets up. Skipping it doesn’t cost you points directly — it costs you A1.Quizzes (20%). There are 5, each 15 minutes, on paper, closed-resource. A quiz runs at the start of class and the lecture follows it — plan to be there on time. Every quiz is announced in advance and marked on the calendar below; each badge lists the lectures it covers by number — Quiz 2 · Lec#7,8,9,10,11,12,13 is quizzed on the seven lectures labelled Lec#7 through Lec#13 in the calendar.

Your lowest quiz is dropped, so 4 count at 5% each. If you miss a quiz, that is the one you drop — there is nothing to arrange and nothing to document. Miss a second one and it scores zero, barring a documented emergency.

The final exam (30%) is cumulative over all four modules. It is an individual, closed-resource, AI-free assessment written on paper and completed in person: Friday, December 11, 9:00–11:00 AM.

The per-assignment code / oral breakdown is on the Assignments page.

5. Policies

Late work

Assignments may be submitted up to two days late. Each started day costs 10 percentage points off that assignment’s score: a 92 becomes an 82 one day late and a 72 two days late. A day means a started 24-hour period after that assignment’s deadline, so ten minutes late is one day late. After 48 hours we do not accept the work. A missed quiz is simply the one you drop — nothing to arrange. Oral evaluations and the final exam cannot be made up except for documented emergencies; if something stops you attending, tell us as soon as you reasonably can. Advance notice is expected when circumstances allow — we know they don’t always.

Ethics pledge

See the ethics pledge. You must sign it in A0 before you receive the course materials and VM access.

Collaboration

All assignments are individual. You may discuss concepts with anyone. You may not read, copy, or transcribe another student’s solution. Cite every source you use, including AI, in AI-USE.txt — what counts as adequate disclosure is spelled out in the AI policy.

Artificial intelligence

See the AI policy. The short version: AI is unrestricted on assignments provided you disclose it, and absent from oral evaluations, quizzes, and the final exam. Disclosure is never penalized. Non-disclosure is the violation.

Recording

Lectures are not recorded this semester.

6. Materials

No required textbook.

Calendar

Each assignment's out and due dates are in the calendar above. The oral follows in a later week; its calendar tag marks the last day that round can be taken.

MS marks a session presented by Muhammad Shoaib.