Collaborative Research: SaTC: EDU: Creating Windows Advanced Memory Corruption Attack and Defense Teaching Modules

Microsoft Windows operating systems have a large market share and are pervasively used. As such, they are also major targets for cyberattacks, such as malware. It is critical to teach software security topics on the latest Windows versions. However, there are currently no systematic advanced software security education modules for the latest Windows system. The goal of this project is to develop advanced teaching modules on software security, particularly memory corruption attack and defense for the latest systems. A memory corruption attack triggers memory errors through malicious and delicate inputs and is often part of an advanced cyberattack. The developed teaching modules will help students understand how various security features of Windows compilers and linkers are used to fight against miscellaneous memory corruption attacks and their limitations. This will help prepare students for real-world bug hunting and software security. This project will achieve six objectives. 1. Innovating Armitage, an open-source graphical user interface front end of Metasploit, which is a tool used to identify security vulnerabilities. Armitage is an ideal open-source tool to demonstrate attacks and raise security awareness given its ease of use. 2. Developing defense modules on Exploit Protection features of the latest Windows. 3. Incorporating a variety of memory corruption vulnerabilities into a vulnerable chat server (VChat), which will be developed as a Visual C++ project, and developing corresponding attack teaching materials in Python. 4. Developing Metasploit modules in Ruby for all memory corruption attacks, which can be used with Armitage. The purpose of Metasploit modules is to demonstrate those attacks easily and motivate students to learn the principles. 5. Integrating developed teaching modules into related courses at the two participating institutions, University of Massachusetts Lowell and University of Central Florida. 6. Disseminating developed teaching modules, software and systems through a faculty development workshop, project websites, GitHub repositories, video tutorials, CLARK (a cybersecurity curriculum hosting platform), academic publications, and field trips as outreach venues to K-12 students. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.