- 主讲教师：张媛媛
- 学时：48小时，3学分
- 授课对象：本科
- 开课院系：上海交通大学 电院计算机系
- 先修课程：计算机组成原理、操作系统
- 助教：
- 潘达汉(博士生) dhpan98@sjtu
- 喻东徽(博士生) yudhui@sjtu
通知
- 实验课用虚拟机下载地址：https://jbox.sjtu.edu.cn/l/PFhn6j
- 答疑安排变更，3月15日之后在线答疑，周四13:30-16:00
课程安排
- 课程介绍【课件】
- 系统和软件基础 【课件】【视频】
- 计算机安全概念【课件】【视频】【配套实验】
- 缓冲区溢出【课件】【视频】【配套实验】
- 漏洞利用【课件】【配套实验】
- 软件漏洞【课件】
- 漏洞缓解机制【课件】
- 恶意软件【课件】
- 操作系统安全要素【课件】
- 条件竞争【课件】【配套实验】
- 虚拟机安全【课件】
- 物理攻击【课件】【配套实验】
- 可信计算【课件】
- 可信执行环境【课件】
- 程序分析【课件】
参考资料
- 《Introduction to Computer Security》更加基础的计算机安全知识读本
- 《Learning Linux Binary Analysis》Linux环境下二进制分析技术入门
- 《The Art of Debugging with GDB, DDD, and Eclipse》Linux环境下最强调试工具GDB的入门学习
- 《Practical Binary Analysis》实用二进制分析
- 《Practical Malware Analysis》实用恶意软件分析，这两本书介绍了大量实战实用的工具，难度适中，值得一看
论文列表
实用工具
善用工具是安全研究特别重要的能力，向大家推荐如下经过时间考验的优秀软件：
- 编辑器类
- 010Editor (Windows)
- 可执行文件结构查看器
- PEiD (Windows)
- readelf (Linux)
- 静态反编译
- 动态调试
- PWN工具集
- 古董开发环境
- VC++ 6.0 (编译Windows 32位程序) 下载
- WindowsXP SP2 (32位，无ASLR机制)
课程简介
《计算机系统安全》从计算机系统的基础理论（编译原理、操作系统和体系结构）出发，审视安全问题表现形态及其底层复杂交错的成因。课程渐进的展示系统各个层次（应用软件、系统软件、硬件架构等）中存在的安全研究热点，从基础理论推进到前沿科研问题及其具体实践。
计算机系统安全课程分为三个部分：程序安全、系统软件安全，以及安全架构设计。程序安全从程序结构出发，探寻可执行代码设计，带学生发掘程序安全的根源所在；系统软件安全面对的是操作系统、虚拟机等具有管理功能的系统级软件，除了软件安全中的经典问题，还具有管理、交互、竞争等操作系统独特的逻辑安全问题；安全架构设计主要讲述以安全为目标的新型计算机架构上的可信执行环境技术。该课程将三者融合穿插，做到前后呼应，从系统设计与实现的本源来分析安全问题本质，引导学生从攻防两面分析解决计算机系统安全问题。同时引导同学了解国家安全相关法律法规，学习计算机安全职业道德规范，介绍国内外网络空间安全形势，最新安全技术发展与走向等内容。
Course Description
Computer System Security examines the manifestations of security problems and their complex internal causes from the perspective of basic computer theory, including operating systems, compilation principles, and architecture. The course progressively demonstrates the security research hotspots that exist at all levels of the system (virtual machines, operating systems, applications, etc.), advancing from fundamental theory to cutting-edge research issues and their specific practices.
The computer systems security course is composed of three parts: (1) Program security, system software security, and security architecture design. Program security starts from the program structure, exploring the design of executable code, and taking students to discover the root cause of program security. (2) System software security is faced with operating systems, virtual machines, and other system-level software with management functions, in addition to the classical issues in software security, but also management, interaction, competition, and other unique logical security issues of the operating system. (3) Security architecture design is mainly about new hardware architecture based on the design of Trusted execution environment technology. The course integrates the three, analyzing the nature of security issues from the origin of system design and implementation and guiding students to analyze and solve computer system security problems from both offensive and defensive sides. Students are guided to understand national security-related laws and regulations, learn computer security professional code of ethics, introduce the domestic and international cyberspace security situation, the latest security technology development and direction, etc.
扩展实践
- 【VulnHub】https://www.vulnhub.com/
- 【Exploit Education】https://exploit.education/
- 【sploitfun】https://sploitfun.wordpress.com/2015/06/26/linux-x86-exploit-development-tutorial-series/
- 【面向高校的CTF比赛】Hack The Box For Academia: Gamified University Cybersecurity Training