CS 3C03 / SE 4C03
Computer Networks & Security — Winter 2013
#mcmnet2013

• Instructor: Michael Soltys, email: soltys@mcmaster.ca
• TA:
  • Jason Jaskolka <jason.jaskolka@gmail.com>
  • Yinghui Wang <wang382@mcmaster.ca>
• Course Information (Updated on Jan 9; see announcement below.)
• Lectures: Mo, We, Th 13:30-14:20, in PC/155
• Labs Schedule: All the labs will take place in ITB-235:
  1. Jan 21: 10:00-11:20; Jan 22: 10:00-11:20 and 14:30-16:00
  2. Jan 28: 8:30-11:20; Jan 29: 8:30-11:20 and 14:30-17:20
  3. Feb 11: 10:00-11:20; Feb 12: 10:00-11:20 and 14:30-16:00
  4. Feb 25: 10:00-11:20; Feb 26: 10:00-11:20 and 14:30-16:00
  5. Mar 4: 8:30-11:20; Mar 5: 8:30-11:20 and 14:30-17:20
  6. Mar 18: 10:00-11:20; Mar 19: 10:00-11:20 and 14:30-16:00
  Wireshark for the labs.
  OLE labs: every week in ITB-237:
  • Jason Jaskolka, Wednesdays 3:30-4:30
  • Yinghui Wang, Wednesdays 4:30-5:30
• Office Hours: We and Th 14:30-15:30.
• Course outline: Computer networks and the Internet. The 5 layer network stack: application layer (e.g., HTTP), transport layer (e.g., TCP), network layer (e.g., IP), link layer (e.g., ethernet), physical layer (e.g., fiber-optic cable). Wireless and mobile networks. Multimedia networking and network managment. A large portion of the course will be dedicated to network security. We will finish with an overview of search engines and social media. A mixture of theory and programming assignments in Python.
• Recommended textbooks:

  Jim Kurose and Keith Ross Computer Networking: A top-down approach. 6th edition 2013 Published by Pearson

  Charlie Kaufman, Radia Perlman and Mike Speciner Network Security: Private Communication in a Public World. 2nd edition 2002 Published by Prentice Hall

• Reading List
• This course was taught last year, 2012, and the year before that, 2011.
• Finally, please read: McMaster Academic Integrity Statement.

Announcements:

• Apr 16: Since the course is now over, here is the solution to the second hash challenge. The hash:

  netsec2013:$apr1$LJgyupye$GZQc9jyvrdP50vW77sYvz1
  

  has been generated with:

  htpasswd -bnm netsec2013 8yhb34e1
  

  As you can see, the password 8yhb34e1 is not a dictionary word, and that, combined with the strength of MD5, makes it very difficult to break — unlike the first challenge:

  perl -e 'print crypt("hotshots","3zNwtz.q23MAA")'
  

  One weakness of the 2nd challenge (8yhb34e1) is that this password is only 8 characters long; this is too short for real security. A few hundred dollars worth of computing power (say, from Amazon), can break this in a couple of days. You really need 11 characters at least to have security for valuable content.
• Apr 14: Exam posted below.
• Apr 11: Here is the exam from 2012.
• Apr 5: For the security material on the exam, just like for everything thing else, please follow your lecture notes. If you want a "second opinion", you can read the following chapters in the Network Security book: chapters 2-6 on crypto; chapters 9-11,13 for the protocols.
• Mar 29: Latest batch of security slides has been posted in the reading list.
• Mar 22: Very relevant for us: But RC4, the researchers found, isn't sufficiently random, and with enough time and effort, an attacker could recover some plaintext from a communication secured using TLS and RC4. "We have found a new attack against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used," they said. "The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions." Read more here.
• Mar 22: Second batch of the security slides has been posted in the Reading List section.
• Mar 15: Midterm 2, together with the solutions, has been posted below.
• Mar 15: Jason Jaskolka won the MSU Teaching Assistant Merit Award.
• Mar 8: Midterm 1 is on Thursday Mar 14. It will be written in the usual lecture room, at the usual time; the midterm is 50 minutes long. Please come on time. In terms of the material, the content of the midterm will closely reflect the content of the lectures (up to and including the lecture on Thursday March 7). The following sections of the textbook will be covered: chapter 3 (sections 3.6 and 3.7), chapter 4 (sections 1,4,5,6) and the material covered during the first week of security. You are responsible for only one article: Michael Kende, The Digital Handshake: Connecting Internet Backbones — check the Reading List to see exactly what part of the article you need to know.
• Mar 8: The slides are posted in the Reading List.
• Mar 8: Garrett Patriquin has pointed out a couple of interesting articles regarding Pirate Bay and how they manipulate routing to create the impression of being hosted in North Korea; note that the articles mention the tool traceroute that we discussed in class:
  • Pirate Bay in North Korea a Prank
  • Pirate Bay hosted in North Korea its Fake
• Mar 7: The MD5 challenge:

  netsec2013:$apr1$LJgyupye$GZQc9jyvrdP50vW77sYvz1
  

  The crypt() challenge:

  3zNwtz.q23MAA
  

  was solved by Andrew Dunham in about 15 minutes, by using the following software:

  http://openwall.com/john/
  

  By the way, you can confirm that the related password is hotshots with:

  perl -e 'print crypt("hotshots","3z")'
  

• Feb 15: The first assignment has been graded; notes from the TA:
  1. In the directory of the student who submitted the assignment on behalf of the group, there is a file called A1MarkAndComments.txt. It would be the responsibility of this group member to relay the grade and comments to the other group members.
  2. If there are issues/concerns with the grading of Assignment #1, please see the TA in the labs the week of February 25. You may be asked to demonstrate your program on your own machine.
• Feb 8: Lab 2 has been posted below.
• Feb 7: Midterm 1 with solutions has been posted below.
• Feb 7: Slides from Jason's lecture on February 6 regarding packet structure.
• Feb 1: Midterm 1 is on Thursday Feb 7. It will be written in the usual lecture room, at the usual time; the midterm is 50 minutes long. Please come on time. In terms of the material, the content of the midterm will closely reflect the content of the lectures (up to and including Monday's lecture). The following sections of the textbook will be covered: chapter 1 (all eight sections), chapter 2 (sections 1,2,5,7,8) and chapter 3 (sections 1,2,4,5). See past year midterms to get a rough idea of what to expect.
• Feb 1: From an article in the Economist:
  
• Jan 29: The cold that I had yesterday is refusing to relent; I am planning on teaching tomorrow, but just in case I get very sick, please check this website for updates. Incidentally, I invite anyone who has Twitter to follow me at: @MichaelMSoltys, to get quicker updates (those related to the course will have the hashtag #mcmnet2013); in general, I also tweet material related to computer science, especially material related to networks & security. Of course, this website will contain all the relevant information — it is the primary source for the course.
• Jan 26: Here are the slides from the two special lectures:
  • Jan 23: Wireshark by Jason Jaskolka
  • Jan 24: Subversion by Yinghui Wang
• Jan 23: Note that Yinghui's OLE labs have moved to Wednesdays (same time).
• Jan 21: Here is the SVN repository:

  https://websvn.mcmaster.ca/cs3c03-se4c03/yourmacid
  

• Jan 19: Assignment 1 has been reposted below with further instructions.
• Jan 16: Small wording change in Question 3(d) of Wireshark Lab 1.
• Jan 15: For Python assignment one, please limit yourself to the following librarires:

  import socket
  import sys
  import time
  import string
  

• Jan 14: Please familiarize yourself with the Lab Safety Guidelines before you start attending the labs.
• Jan 11: Assignment 1 has been posted below. We'll talk about it in class this week.
• Jan 10: There will be two sepcial lectures, both during the usual time slot, and in the usual lecture room:
  1. Jan 23: Jason will give tutorial on Wireshark
  2. Jan 24: Yinghui will give a tutorial on Subversion.
• Jan 9: The schedule for the labs has been posted above. Note that there are 6 weeks of labs; sets 2 and 5 (in boldface) correspond to the weeks when Wireshark labs will be graded by the TAs. You should be working with the same team that you work for the assignments. The other weeks (1,3,4,6) are meant to serve as office hours; the TAs can help you with the assignments, with the preparation of the labs, etc.
• Jan 9: The marking scheme has been changed: there will also be two labs, worth 5% each, and the programming assignments will be worth 10% each.

Labs, Assignments and midterm :

Item	Due Date	PDF file	Comments
Lab 1	Week of January 28	l1.pdf	Jan 16: Small change to the wording of question 3(d); thanks Kartikay Dani for pointing out the mistake.
Midterm 1	February 7	midterm1.pdf
Assignment 1	February 14	a1.pdf	Jan 19: reposted with further instructions
Lab 2	Week of March 4	l2.pdf
Midterm 2	March 14	midterm2.pdf
Assignment 2	March 21	a2.pdf
Exam	April 14