UMBC Center for Cybersecurity

Permanent URI for this collection

http://hdl.handle.net/11603/12235

Browse

Recent Submissions

Now showing 1 - 4 of 4
  • Thumbnail Image
    Item
    What is Volt Typhoon? A cybersecurity expert explains the Chinese hackers targeting US critical infrastructure
    (The Conversation, 2024-03-29) Forno, Richard
    Chinese state-sponsored hackers are targeting critical infrastructure. Here’s what they’re doing, how the US government is responding and how you can help.
  • Thumbnail Image
    Item
  • No Thumbnail Available
    Item
    No Silver Bullet: Fighting Russian Disinformation Requires Multiple Actions
    (National Cryptologic Museum Foundation, 2020-08) Thompson, Terry L.
  • No Thumbnail Available
    Item
    The SFS Summer Research Study at UMBC: Project-Based Learning Inspires Cybersecurity Students
    (2018-11-12) Sherman, Alan; Golaszewski, Enis; LaFemina, Edward; Goldschen, Ethan; Khan, Mohammed; Mundy, Lauren; Rather, Mykah; Solis, Bryan; Tete, Wubnyonga; Valdez, Edwin; Weber, Brian; Doyle, Damian; O’Brien, Casey; Oliva, Linda; Roundy, Joseph; Suess, Jack
    May 30-June 2, 2017, Scholarship for Service (SFS) scholars at the University of Maryland, Baltimore County (UMBC) analyzed the security of a targeted aspect of the UMBC computer systems. During this hands-on study, with complete access to source code, students identified vulnerabilities, devised and implemented exploits, and suggested mitigations. As part of a pioneering program at UMBC to extend SFS scholarships to community colleges, the study helped initiate six students from two nearby community colleges, who transferred to UMBC in fall 2017 to complete their four-year degrees in computer science and information systems. The study examined the security of a set of "NetAdmin" custom scripts that enable UMBC faculty and staff to open the UMBC firewall to allow external access to machines they control for research purposes. Students discovered vulnerabilities stemming from weak architectural design, record overflow, and failure to sanitize inputs properly. For example, they implemented a record-overflow and code-injection exploit that exfiltrated the vital API key of the UMBC firewall. This report summarizes student activities and findings, and reflects on lessons learned for students, educators, and system administrators. Our students found the collaborative experience inspirational, students and educators appreciated the authentic case study, and IT administrators gained access to future employees and received free recommendations for improving the security of their systems. We hope that other universities can benefit from our motivational and educational strategy of teaming educators and system administrators to engage students in active project-based learning centering on focused questions about their university computer systems.