Software Security Lecture 11 Fang Yu Dept. of MIS, National Chengchi University Spring 2011

Announcement  Next week, we will have an invited speaker Michael from Atonmix for the special lecture on iOS development.  For your projects:  “WebGoat Handbook”: Anthony Cimo, Alexis Kirat, Kuan-Ming Chen and I-Yang Dong  “Power Password Craking”:Juilette Maxime Lessing, Hsing Huang and Chen-Yi Yang  “Nmap Port Scan”: Jorina van Malsen, Eric Huang and Ruei-Chen Dai  “Static Analysis via Stranger”: Adam Fremd, Vincent Liou and Ruei-Jiun Liang

Announcement  Project presentation/tool demonstration  Prepare an hour presentation to summarize your project  6/1 : WebGoat, PCL  6/8: Namp, Stranger  Final report (~10 pages) and system/code is due on 6/15

Outline  I will present my paper “Patching Vulnerabilities with Sanitization Synthesis”  I will also introduce to you our tool “Stranger”  We will also have three paper discussions  Toward Automated Detection of Logic Vulnerabilities in Web Applications (by Eric),  Static Detection of Security Vulnerabilities in Scripting Languages (by Alex), and  Static Detection of Cross-site Scripting Vulnerabilities (by Juliette Lessing)