We are delighted to announce a first on Lawfare: A live online class on hacking and cybersecurity.
The live-course will be open to Lawfare’s material supporters, and we will edit and post each recorded class session onto YouTube as videos that will amount to a public course on computer hacking.
Whether one joins live or watches the videos later, students will learn to use virtual machines to “hack” other virtual machines using standard attacks such as packet sniffing, buffer overflow, IP spoofing, certification forgery, Person-in-the-middle, SQL injection and Cross site scripting.
The course, which Scott will teach with Sean O’Brien, will train students to understand cybersecurity and networking concepts, not only to help them protect themselves, but also so that they may better engage issues at the policy and regulatory level.
No prior computer programming experience is necessary.
We will be holding each class live Tuesday evenings between 7:00 pm and 8:00 pm ET throughout the fall semester. The edited videos from each class session will be posted on Lawfare. Students in the live class may submit their hacks for an end of the semester competition, and we will devote a few classes to examining the best hacks.
The live classes will take place on a platform called Crowdcast, which will be familiar to viewers of Lawfare Live and the In Lieu of Fun show—which we co-host with two other friends. Live participants will be able to engage with the instruction directly and in real time, ask questions, and get their work evaluated in the context of the competition. The ultimate product will be free instructional videos available to anyone.
If you want to take the course live, please sign up for it here.
Among other things, this course will be an experiment in Lawfare’s ability to make online courses, using both live formats and edited video. If it works, we may do more of it in a fashion designed to provide both an interactive live experience for Lawfare Material Supporters and a public resource for everyone.
Below is a brief syllabus for the course.
As we create the individual videos, we will embed them on this page.
Course Websites: Various resources for the class will be made available on this Github site. These will include lecture slides, project source code, and student hacks.
Technical Requirements: The class will make use of Virtual Machines (VMs) and VirtualBox to run them. Please see here for instructions and required files.
The following is a week-by-week overview of the course:
Week 1, September 20, 2022: Practical Cybersecurity
- Our Approach
- Information Security
- Confidentiality Integrity
- Availability
- Introduction: Virtualization
- Command Line Interface (CLI)
- The File-system Tree
Week 2, September 27, 2022: Get to Know Your Operating System
- Admin / Root Access
- The Kernel
- User space
- Processes
- Rootkits
Week 3, October 4, 2022: Identity & Access Control
- Permissions as a Structural Design for Security
- Creating Users & Groups
- Authentication
- Principle of Least Privilege
- Sandboxing & Isolation
- Privilege Escalation Attacks
- ACLs
- Breaking etc/shadow
- Credentials & cracking
Week 4, October 11, 2022: Computers & Operating Systems
- Which ones exist?
- Unix
- Linux
- macOS
- DOS
- Windows
- Android
- iOS
- Compare & contrast
- Other computers
- Mainframes
- IoT
- Industrial Control Systems
- Cars, Planes & Ships, …
- Person-in-the-Middle Attacks
Week 5, October 18: Networking I
- Networking History
- Client/Server Model
- Networking Models (OSI & TCP/IP)
- Physical & Internet Infrastructure
- TCP/IP & UDP
- Changing Your Network Identification
Week 6, October 25: Networking II
- Request/Response via the Web
- State
- Ports, Sockets & Session Management
- Network Address Translation (NAT) & Network Devices
- Virtual Private Networks
- Distributed Denial-of-Service (DDoS)
Week 7, November 1: Encryption
- Obfuscation & Hashes
- Public/Private Key
- RSA algorithm
- HTTP Encryption (SSL/TLS)
- Email Encryption (PGP/GPG)
- Certificates
- Weaknesses
- Back-doors
Week 8, November 8: Networking III
- Identifiers: Domain Names & the DNS
- DNS, IP addresses & Policy
- Firewalls
- Proxies & Reverse Proxies
- Network-based Intrusion Detection & Prevention Systems
- Content Delivery Networks & Anycast
Week 9, November 15: Penetration Testing
- Delivering Payloads
- SQL Injection Attacks
- Metasploit Framework
- Using Metasploit
Week 10, November 22: Anonymity & The Dark Web
- Onion Routing (Tor)
- Censorship Circumvention
- Configuring Tor
- Sharing Files Anonymously
Week 11, November 29: Chains of Trust
- Trusted Software Distribution
- Software Verification
- Hardware Assurance
- Certification: TCSEC, ITSEC, CTCPEC, and Common Criteria
- Free & Open-Source Software
- Open-Source Hardware
Week 12, December 5: Cybercrime
- Types of Cybercrimes
- Varieties of Malware
- Fraud & Phishing
- Data Breaches
- Crime as a Service
- Cryptocurrencies & Transactions
- Challenges for Attack Attribution
- Social Engineering
Week 13, December 12: Review of Hacks I
Week 14, December 20: Review of Hacks II
