Only For computerscience

CSI5203 Software Development Processes

CSI5203 Assignment #2 Page 1 of 2 Mike Johnstone – 15/09/2014

MAJOR ASSIGNMENT – PAIR ASSESSMENT Assignment value: 35% Due: Monday, 20th of October at 11:59pm, WST. Students may work in pairs for this assessment. Background: With the majority of current systems development focussed on web and mobile applications, it is not surprising that security is a major concern for those applications. Security in this sense refers to considering security aspects as part of the development lifecycle (which most existing methods do not). The rationale for such security-oriented methods is that exploits or security “holes” would not exist if software was built correctly the first time. Task: You are required to create and deliver a presentation providing an analysis of an existing software exploit (therefore you are not required to craft a new, unknown exploit yourself). You should describe the history of the exploit, show clearly how it works, provide a small runnable code example that illustrates the problem and show how the exploit can be fixed. As a second example of the exploit, you must also include code from a reasonably-sized working application that exhibits the problem and provide a patch to fix the exploit in that application. Note: the code can be in any language running on any operating system as long as the exploit can be demonstrated safely in-class and assessed. Demonstrated safely means that you many not hack into any systems internal or external to the University, nor may you engage in any conduct that would violate the Student Charter. Choose from:

• Buffer overflows (heap-based only) • SQL injections (second-order only) • Shellcoding • Cross-site scripting (XSS) • Insecure protocols • Exploiting a device (hardware e.g., modem, printer, router etc.)

Put your team members and your choice on the unit discussion board. There are four deliverables for this assignment:

1. A PowerPoint presentation (60 slides, minimum) about your chosen exploit which you will both deliver to the class. Use the standard SCSS template. As part of the presentation you must demonstrate your exploit and fix it live. Allow 45 minutes for your presentation and 15 minutes for questions.

2. A user manual that describes how to install and configure a system to demonstrate your exploit, exactly as per your presentation.

3. Any software required to demonstrate your exploit. 4. Copies of any files used as references in digital format (e.g. pdf files for

journal articles or mht files for web pages).

CSI5203 Software Development Processes

CSI5203 Assignment #2 Page 2 of 2 Mike Johnstone – 15/09/2014

Note: All items must be submitted via BlackBoard (MyECU). If item#3 is too large to be submitted via BlackBoard, place the software on a CD/DVD and submit the MD5 hash codes of the files by the due date/time. You will also be required to provide the MD5 hash of item#1 as part of the BlackBoard submission process. Submissions without a hash code for item#1 will not be accepted. If you are not sure about any of the requirements for this assignment, please check with your lecturer. ASSIGNMENT SUBMISSION REQUIREMENTS This is an assessable item – failure to submit by the due date/time will result in loss of marks.

Important: By providing a submission, you are declaring that the submission is entirely your own work, except where reference is made to the work of others (using the ECU referencing standard, available at: http://www.ecu.edu.au/library/pdf/refguide.pdf). If this is found not to be correct you will be subject to penalties ranging from loss of marks to exclusion from the University.