CY(S)-5770 Software Vulnerabilities and Security (SoftVulnSec)

echo "Software Security" | sed s/\ /\ Vulnerabilities\ and\ /g

Instructor(s)

Engin Kirda

Florian Hantke

For correspondence, send a mail to ek@ccs.neu.edu or to f.hantke@northeastern.edu

Office hours: TBD

Teaching Assistants

News

1. 09.01.2026 The course website has been updated.

Abstract

Internet security has become part of everyday life where security problems impact practical aspects of our lives. Even though there is a considerable corpus of knowledge about tools and techniques to protect systems, information about what the actual vulnerabilities are and how they are exploited is not generally available. This situation hampers the effectiveness of security research and practice. Understanding the details of attacks is a prerequisite for the design and implementation of secure systems.

This course deals with common programming, configuration, and design mistakes and ways to detect and avoid them. Examples are used to highlight general error classes, such as memory corruption vulnerabilities, injection attacks, and logic flaws. The rise of AI introduces new attack surfaces, including prompt injection and adversarial inputs, as well as new offensive capabilities: AI-assisted exploit development, automated fuzzing, and LLM-aided social engineering have fundamentally changed the threat landscape. Possible protection and detection techniques are examined across both classical and AI-driven attack classes. The course includes a number of practical lab assignments where participants are required to apply their knowledge, as well as a discussion of current research in the field. Students will learn how the security of systems can be violated, and how such attacks can be detected and prevented.

The course aims to make students "security aware" and give them an in-depth understanding of security issues in the age of AI-powered threats.

Some Topics

Operating system security and vulnerabilities

- (UNIX, Windows, stack and heap overflows)

Windows Security

Memory corruption

- (Buffer overflows, Heap overflows, Format string issues, etc.))

Testing

Reverse engineering and binary analysis

Malicious code

- (Viruses, Worms, Botnets, APTs, etc.)

Supply chain security

AI/Agent security

- (e.g., prompt injection, LLM-assisted attacks)

Language security

Web security

Prerequisites

Significant Programming experience

- (This course is not for you if you are a beginner)

Knowledge of C/C++ useful

Basic SQL knowledge

Basic web programming knowledge

Dates and Times

Mondays, 6-9pm, Behrakis Health Sciences Cntr 320

Slides, Material, and Schedule

All course materials will be available on Canvas.

• TBD // Final
• 12.07.2026 // Class 11
• 11.30.2026 // Class 10 // Quiz 3
• 11.23.2026 // Class 9
• 11.16.2026 // Class 8 // Quiz 2
• 11.09.2026 // Class 7
• 11.02.2026 // Midterm
• 10.26.2026 // Class 6
• 10.19.2026 // Class 5
• 10.12.2026 // Indigenous Peoples Day, no class
• 10.05.2026 // Class 4 // Quiz 1
• 09.28.2026 // Class 3
• 09.21.2026 // Class 2
• 09.14.2026 // Class 1

Practical Challenges (Assignments)

Students will "need" to solve a set of practical challenges (assignments) in the lab part of the course. For more information on the challenges and the grading, check this page.

Grading

10%: 3 Quizzes

25%: Midterm exam

25%: Final exam

5%: Participation

35%: 8 practical security challenges

Registration

Registration details will be announced via e-mail to the registered participants.

Last Modified: Tue Sep 1 11:46:11 2026 EDT