CS527 Software Security

Mathias Payer -- Spring semester 2018, 3 credit course.


Course overview

This course focuses on software security fundamentals, secure coding guidelines and principles, and advanced software security concepts. Students will learn to assess and understand threats, learn how to design and implement secure software systems, and get hands-on experience with common security pitfalls.

The course consists of two lectures per week (50 minutes each) and a 2-hour lab.

Course objectives

Software running on current systems is exploited by attackers despite many deployed defence mechanisms and best practices for developing new software. In this course students will learn about current security threats, attack vectors, and defence mechanisms on current systems. The students will work with real world problems and technical challenges of security mechanisms (both in the design and implementation of programming languages, compilers, and runtime systems).

Learning outcomes

Students who complete the course will have demonstrated the ability to do the following:


CS 52600, Introduction to Information Security or equivalent course with the consent of the instructor. Significant programming experience and skills are required to complete the labs and homework.


  1. Course introduction (01/08/18, 01/10/18)
  2. Secure software lifecycle (01/10/18)
  3. Basic principles (01/10/18) [1] [7]
  4. Reverse engineering (01/22/18, 01/24/18)
  5. Security policies: Memory and Type safety (01/29/18, 01/31/18, 02/05/18, 02/07/18) [2], [3], [4] [5] [6]
  6. Software bugs (02/12/18, 02/14/18)
  7. Attack vectors (02/26/18, 03/05/18)
  8. Mitigations (03/07/18, 03/19/18)
  9. Advanced mitigations (03/26/18, 04/02/18, 04/04/18) [11]
  10. Software testing (04/09/18, 4/11/18, 4/16/18)
  11. Web security (04/18/18)
  12. Mobile security (04/23/18)
  13. Summary (04/25/18) [13] [14]


Please refer to Piazza for the course project.


  1. For academic honesty refer to the Purdue integrity/code of conduct;
  2. Except as by prior arrangement or notification by the professor of an extension before the deadline, missing or late work will be counted as a zero/fail.

Course policies

This course will be run under the "reasonable adults" policy wherein it is assumed that all students are reasonable adults that want to benefit the most of the course by attending the course regularly, completing the homework assignments and projects on time, asking questions during the course and if they run into problems, and checking back with the instructor and the TA regularly to ensure good progress.

A more verbose version of the policy is available on Spaf's page. CS-527 follows the policies listed on that page. If you have any question about the course policy, don't hesitate to ask the instructor or the TA.

As a short summary: (i) you are expected to attend all classes (modulo good reasons), (ii) you are supposed to hand in all work before the deadlines (there's a 10% point reduction per day for late hand-ins), (iii) if you need special treatment or have special circumstances, talk to the instructor or TA.

References and Reading Assignments

[1]Butler W. Lampson. Protection. ACM Operating Systems'74
[2]Laszlo Szekeres, Mathias Payer, Tao Wei, Dawn Song. SoK: The Eternal War in Memory. IEEE S&P'13
[3]Santosh Nagarakatte, Milo M. K. Martin, and Steve Zdancewic. Everything You Want to Know About Pointer-Based Checking. SNAPL'15
[4]Michael Hicks. What is memory safety? Blogpost'14.
[5]Trevor Jim, Greg Morrisett, Dan Grossman, Michael Hicks, James Cheney, and Yanling Wang. Cyclone: A Safe Dialect of C. ATC'02
[6]Yuseok Jeon, Priyam Biswas, Scott A. Carr, Byoungyoung Lee, and Mathias Payer. HexType: Efficient Detection of Type Confusion Errors for C++. CCS'17
[7]Mathias Paper. Triggering Deep Vulnerabilities Using Symbolic Execution. 30C3'13, video of the talk.
[8]Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. Making information flow explicit in HiStar. OSDI'06
[9]Daniel J. Bernstein. Some thoughts on security after ten years of qmail 1.0. Technical Report'07
[10]Mathias Payer. HexPADS: a platform to detect "stealth" attacks. ESSoS'16
[11]Nathan Burow, Scott A. Carr, Joseph Nash, Per Larsen, Michael Franz, Stefan Brunthaler, and Mathias Payer. Control-Flow Integrity: Protection, Security, and Performance. ACM CSUR '18, (slides)
[12]Charles Reis, Adam Barth, and Carlos Pizano. Browser Security: Lessens from Google Chrome. ACM Queue '09
[13]Oshri Sela and Shlomi Levin. Breaking CFI: Exploiting CVE-2015-5122 using COOP.
[14]Metasploit CVE-2015-5122 exploit.