Course Schedule, Reading List, and Slides

Fall 2026

L Lecture given by the instructor D Paper discussion led by student presenters

Week 1: Bootstrap

Aug 24Mon

L Course Logistics

Readings: Please fill this anonymous course-preparation survey after the first class and before Aug 28 (Fri). You need to sign into your UTMail account.

Materials: Slides

Aug 26Wed

L Topic Overview and Project Ideas

Materials: Slides

Week 2: Microarchitectural Side Channels

Aug 31Mon

L Cache-Based Side Channels (w/ Demo!)

Pre-lecture: Please watch this conference presentation Link

Post-lecture: Choose one to review:

  • Last-Level Cache Side-Channel Attacks are Practical (SP '15) Link
  • Theory and Practice of Finding Eviction Sets (SP '19) Link

Materials: Slides, PoC

Sep 2Wed

L Side Channels in Public Clouds (w/ Demo!)

Pre-lecture: Please read this short article on serverless computing Link

Optional:

  • Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds (CCS '09) Link
  • Everywhere All at Once: Co-Location Attacks on Public Cloud FaaS (ASPLOS '24) Link

Materials: Slides

Week 3: Transient Execution Attacks

Sep 7Mon

Labor Day

Sep 9Wed

L Spectre and Meltdown (w/ Demo!)

Pre-lecture: Conference presentation of Spectre Attacks Link

Post-lecture: Choose one to review:

  • An Analysis of Speculative Type Confusion Vulnerabilities in the Wild (USENIX Sec '21) Link
  • A Systematic Evaluation of Transient Execution Attacks and Defenses Link

Materials: Slides, PoC

Week 4: Side-Channel Defenses

Sep 14Mon

L Data-Oblivious Computation

Pre-lecture: Guidelines for Mitigating Timing Side Channels Against Cryptographic Implementations by Intel Link

Optional:

  • Oblivious RAM by Elaine Shi Link
  • Cryptocoding by Jean-Philippe Aumasson Link

Materials: Slides

Sep 16Wed

L Spectre Defenses

Pre-lecture: How Linux patches Spectre v1 gadgets (please read Links 1–3 in order) Link 1, Link 2, Link 3

Post-lecture: Choose one to review:

  • Efficient Invisible Speculative Execution through Selective Delay and Value Prediction (ISCA '19) Link
  • Speculative Taint Tracking (STT): A Comprehensive Protection for Speculatively Accessed Data (MICRO '19) Link

Materials: Slides

Week 5: Trusted Computing

Sep 21Mon

L Hardware Root of Trust and Secure Coprocessors

No pre-lecture readings

Optional:

  • Cryptographic processors – a survey Link
  • The Secure Enclave – Apple Platform Security Link
  • Titanium hardware security architecture at Google Link

Materials: Slides

Sep 23Wed

L Trusted Execution Environments (TEEs)

No pre-lecture readings

Post-lecture: Choose one to review:

  • Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (SP '15) Link
  • MicroScope: Enabling Microarchitectural Replay Attacks (ISCA '19) Link

Optional: Intel SGX Explained Link

Materials: Slides

Week 6: Memory Security

Sep 28Mon

L Memory Encryption and Integrity Protection

No pre-lecture readings

Optional:

  • Efficient Memory Integrity Verification and Encryption for Secure Processors Link
  • Using Address Independent Seed Encryption and Bonsai Merkle Trees to Make Secure Processors OS- and Performance-Friendly Link

Materials: Slides

Sep 30Wed

L Memory Safety–Attacks

Pre-lecture: Running a Buffer Overflow Attack - Computerphile Link

Post-lecture: The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) (SP '07) Link

Optional: Return-Oriented Programming without Returns (CCS '10) Link

Materials: Slides

Week 7: Memory Safety and Physical Attacks

Oct 5Mon

L Memory Safety–Defense

Optional: SoK: Eternal War in Memory (SP '13) Link

Materials: Slides

Oct 7Wed

L Physical-ish Attacks

Materials: Slides

Week 8: Paper Discussion

Oct 12Mon

D Cache Attacks

Papers to discuss: Choose one to review:

  • Attack Directories, Not Caches: Side Channel Attacks in a Non-Inclusive World (SP '19) Link
  • Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX (USENIX Sec '17) Link
Oct 14Wed

D Cache Defenses

Papers to discuss: Choose one to review:

  • CATalyst: Defeating Last-Level Cache Side Channel Attacks in Cloud Computing (HPCA '16) Link
  • MIRAGE: Mitigating Conflict-Based Cache Attacks with a Practical Fully-Associative Design (USENIX Sec '21) Link

Week 9: Paper Discussion

Oct 19Mon

D Pixel Stealing

Papers to discuss: Choose one to review:

  • On Subnormal Floating Point and Abnormal Timing (SP '15) Link
  • Pixnapping: Bringing Pixel Stealing out of the Stone Age (CCS '25) Link
Oct 21Wed

D Spectre v2

Papers to discuss: Choose one to review:

  • Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks (USENIX Sec '22) Link
  • Indirector: High-Precision Branch Target Injection Attacks Exploiting the Indirect Branch Predictor (USENIX Sec '24) Link

Week 10: Paper Discussion

Oct 26Mon

D Spectre Defense

Papers to discuss: Choose one to review:

  • Speculative Data-Oblivious Execution: Mobilizing Safe Prediction for Safe and Efficient Speculative Execution (ISCA '20) Link
  • Speculative Privacy Tracking (SPT): Leaking Information From Speculative Execution Without Compromising Privacy (MICRO '21) Link
Oct 28Wed

D Memory Safety + Transient Attacks

Papers to discuss: Choose one to review:

  • Speculative Probing: Hacking Blind in the Spectre Era (CCS '20) Link
  • PACMAN: Attacking ARM Pointer Authentication with Speculative Execution (ISCA '22) Link

Week 11: Paper Discussion

Nov 2Mon

D Trusted Execution

Papers to discuss: Choose one to review:

  • Graviton: Trusted Execution Environments on GPUs (OSDI '18) Link
  • Sequestered Encryption: A Hardware Technique for Comprehensive Data Privacy (SEED '22) Link
Nov 4Wed

D In-Process Isolation

Papers to discuss: Choose one to review:

  • Donky: Domain Keys – Efficient In-Process Isolation for RISC-V and x86 (USENIX Sec '20) Link
  • Going beyond the Limits of SFI: Flexible and Secure Hardware-Assisted In-Process Isolation with HFI (ASPLOS '23) Link

Week 12: Paper Discussion

Nov 9Mon

D Overcoming Coarse Timer

Papers to discuss: Choose one to review:

  • Hacky Racers: Exploiting Instruction-Level Parallelism to Generate Stealthy Fine-Grained Timers (ASPLOS '23) Link
  • The Gates of Time: Improving Cache Attacks with Transient Execution (USENIX Sec '23) Link
Nov 11Wed

D Power Side Channels

Papers to discuss: Choose one to review:

  • PLATYPUS: Software-based Power Side-Channel Attacks on x86 (SP '21) Link
  • Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86 (USENIX Sec '22) Link

Week 13: Paper Discussion

Nov 16Mon

D Attacks on FPGA

Papers to discuss: Choose one to review:

  • FPGA-Based Remote Power Side-Channel Attacks (SP '18) Link
  • Pentimento: Data Remanence in Cloud FPGAs (ASPLOS '24) Link
Nov 18Wed

D Hardware and Software Fuzzing

Papers to discuss: Choose one to review:

  • SpecFuzz: Bringing Spectre-Type Vulnerabilities to the Surface (USENIX Sec '20) Link
  • Cascade: CPU Fuzzing via Intricate Program Generation (USENIX Sec '24) Link

Week 14: Fall Break

Nov 23-Nov 27

Fall Break

Optional: Watch “WarGames (1983)”

Week 15: Summary and Project Presentations

Nov 30Mon

Reflect and Chat (with free food!)

Dec 2Wed

Final Presentation (1)

Week 16: Project Presentations

Dec 7Mon

Final Presentation (2)