Secure Software Development (WS 2026/27)
Table of Content
Content
Slides are available after each lecture. The practicals, an explanation about the lecture, exam hacklets, and old exams can be found here: Material| Date | Type | Topic | Lecturer | Material |
|---|---|---|---|---|
| 2026-10-02 12:00 | lecture | Intro + Low Level / C++ Objects | Daniel | slides |
| 2026-10-07 10:15 | practical | Warmup + Organization | Carina + Simone + Tutors | slides |
| 2026-10-09 12:00 | lecture | Memory Corruption 1 | Carina | slides |
| 2026-10-14 10:15 | practical | Tools 1 + Hacklets 1 | Ernesto + Tutors | |
| 2026-10-14 23:59 | deadline | Warmup Hacklet Deadline | - | - |
| 2026-10-16 12:00 | lecture | Memory Corruption 2 | Carina | slides |
| 2026-10-23 12:00 | lecture | Exploits and Countermeasures 1 | Ernesto | slides |
| 2026-10-30 12:00 | lecture | Exploits and Countermeasures 2 | Ernesto | slides |
| 2026-11-06 12:00 | lecture | Exploits and Countermeasures 3 | Sebastian | slides |
| 2026-11-13 12:00 | lecture | Defensive Programming | Simone | slides |
| 2026-11-15 23:59 | deadline | Hacklets 1 Deadline | - | - |
| 2026-11-18 10:15 | practical | Tools 2 + Hacklets 2 | Ernesto + Tutors | |
| 2026-11-27 12:00 | lecture | Finding Bugs 1 | Lorenz | |
| 2026-12-04 12:00 | lecture | Finding Bugs 2 | Lorenz | |
| 2026-12-16 10:15 | practical | Defensive Programming | Simone + Tutors | |
| 2026-12-27 23:59 | deadline | Hacklets 2 Deadline | - | - |
| 2027-01-24 23:59 | deadline | Defensive Programming Deadline | - | - |
Material
This course deals with the design and implementation of secure software. Especially memory corruption vulnerabilities such as buffer overflows, integer overflows or use-after-free bugs can be exploited by an attacker to bypass the intended program behavior and execute arbitrary payload in the worst case. We will look at various runtime mitigation techniques such as ASLR, stack canaries and data execution prevention exist. However, they can often be bypassed by more advanced exploitation techniques. Rather than preventing certain attacks, the ultimate goal is to eliminate memory corruption vulnerabilities and achieve "memory safety". We will discuss methods for debugging and bug discovery as well. Slides are available after each lecture. The practicals, an explanation about the lecture, exam hacklets, and old exams can be found here: MaterialAdministrative Information
Previous Knowledge
* x86 assembler basics * Solid knowledge of C/C++ * Some familiarity with the POSIX interface Attention! This is an advanced course building on previous courses from the Bachelor programme, namely: * Information Security course (INP.33504UF and INP.33503UF) * System Level Programming course (705.101) * Operating Systems course (INP.32512UF) If you are an international student, please consider taking the "System Level Programming" course first, which should prepare you well for enjoying this course.Prerequisites Curriculum
No formal course-specific prerequisites. Recommended: solid C/C++ programming skills, x86 assembly basics, familiarity with POSIX, and the background covered in Information Security, System Level Programming, and Operating Systems.Objective
After this course you understand the concept of "memory safety" and the various memory corruption vulnerabilities (buffer overflow, integer overflows, use-after-free, double free, uninitialized data, type confusion, etc.) violating it. You know how to detect, exploit and mitigate such vulnerabilities in practice. Furthermore, you know about various runtime mitigation techniques and are able to assess their (in)effectiveness in practice. You know the principles of defensive programming and are able to apply them by writing memory-safe code.Language
EnglishTeaching Method
Lectures and practical programming assignments, supported by tutorial sessions. The practical work covers exploitation, bug finding, and defensive programming.How to get a grade
See Material in the course content above for the current lecture-exam and practical-assignment requirements.Registration
https://online.tugraz.at/ee/rest/pages/slc.tm.cp/course-registration/631082Lecture Dates
| Date | Begin | End | Location | Event | Type | Comment |
|---|---|---|---|---|---|---|
| 2026/11/13 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/11/18 | 10:15 | 11:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/11/27 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/12/04 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/12/11 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/12/16 | 10:15 | 11:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2026/12/17 | 17:15 | 21:00 | ICK1120H | CLASS | VU | CLASS/ |
| 2026/12/18 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/08 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/13 | 10:15 | 11:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/15 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/20 | 10:15 | 11:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/22 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/27 | 10:15 | 11:00 | ICK1130H | CLASS | VU | CLASS/ |
| 2027/01/29 | 12:00 | 14:00 | ICK1130H | CLASS | VU | CLASS/ |
