Looking to pursue a BS in Cyber Security at Dawood University? Check out our study notes to excel in your studies and prepare for a successful career in the field!The BS Cyber Security program at Dawood University is designed to equip students with the knowledge and skills needed to protect organizations from cyber threats. The curriculum covers a wide range of topics, including network security, ethical hacking, cryptography, risk management, and digital forensics. Students will also have the opportunity to gain hands-on experience through practical labs and real-world projects.

Study Notes BS Cyber Security At Dawood University.

Basic Electronics – Comprehensive Study Notes

These notes provide a complete framework for Basic Electronics, covering the fundamental principles of electricity, electronic components, circuit analysis, and basic semiconductor devices. The focus is on developing a solid understanding of how electronic circuits work and building practical skills for analyzing and constructing basic electronic systems .

Part 1: Foundations of Electricity

1.1 What is Electricity?

Electricity is the flow of electric charge. Understanding where electricity comes from starts with the atom . All matter is made of atoms, which contain:

• Protons: Positively charged particles in the nucleus

• Neutrons: Neutral particles in the nucleus

• Electrons: Negatively charged particles orbiting the nucleus

Key Principle: Electrons in the outermost shell (valence shell) can be freed to become “free electrons.” The movement of these free electrons is what we call electric current .

1.2 Conductors, Insulators, and Semiconductors

Materials are classified by how easily they allow electrons to flow :

1.3 Fundamental Electrical Quantities

Understanding the basic electrical quantities is essential before analyzing any circuit :

1.4 Direct Current vs. Alternating Current

There are two types of electric current :

The “War of Currents”: In the late 1800s, Thomas Edison championed DC while Nikola Tesla and George Westinghouse championed AC. AC won because it can be easily transformed to high voltage for long-distance transmission .

Part 2: Ohm’s Law and Basic Circuit Laws

2.1 Ohm’s Law

Ohm’s Law is the most important relationship in electronics. It shows how voltage, current, and resistance are related .

The Three Forms of Ohm’s Law:

Analogies to Understand Ohm’s Law :

1. Water Pipe Analogy: Voltage is like water pressure, current is like water flow rate, and resistance is like a faucet partially closed

2. Heat Flow Analogy: Temperature difference is like voltage, heat flow is like current, and thermal resistance is like electrical resistance

Example Problems :

1. There is 1 V across a resistor, and 5 mA is flowing. What is the resistance?

   • R = V / I = 1 V / 0.005 A = 200 Ω

2. There is 2 V across a 100 Ω resistor. How much current is flowing?

   • I = V / R = 2 V / 100 Ω = 0.02 A = 20 mA

3. What happens if you place a wire directly from the + terminal to the – terminal of a battery?

   • This is a short circuit. The wire has nearly zero resistance, so current becomes extremely high, potentially causing the battery to overheat or explode.

2.2 Electrical Power (Joule’s Law)

Power is the rate at which electrical energy is consumed or produced .

Power Formulas:

Example: There is 1 V across a resistor, and 5 mA is flowing. How much power is being dissipated?

• P = V × I = 1 V × 0.005 A = 0.005 W = 5 mW

2.3 Kirchhoff’s Laws

Kirchhoff’s Laws are essential for analyzing complex circuits with multiple components .

Kirchhoff’s Voltage Law (KVL) : The sum of all voltages around any closed loop in a circuit equals zero.

In other words: The total voltage supplied by sources equals the total voltage dropped across loads.

Kirchhoff’s Current Law (KCL) : The sum of currents entering a node equals the sum of currents leaving the node.

In other words: Current does not accumulate at a junction—what comes in must go out.

2.4 Energy and Power in Batteries

The energy stored in a battery can be calculated as :

Energy = Voltage × Current × Time

E = V × I × t

Example: If a battery has 1000 joules stored and powers a circuit drawing 0.09 A at 9 V, how long will it last?

• Power = V × I = 9 V × 0.09 A = 0.81 W

• Time = Energy / Power = 1000 J / 0.81 W ≈ 1235 seconds ≈ 20.6 minutes

Part 3: Circuit Analysis

3.1 Series Circuits

In a series circuit, components are connected end-to-end, forming a single path for current .

Voltage Divider Rule: The voltage across any resistor in a series circuit is proportional to its resistance :

• V_x = V_total × (R_x / R_total)

3.2 Parallel Circuits

In a parallel circuit, components are connected across the same voltage source, providing multiple paths for current .

Current Divider Rule: The current through any branch is proportional to the total resistance of the other branches:

• I_x = I_total × (R_total / R_x)

3.3 Series-Parallel (Compound) Circuits

Most practical circuits combine series and parallel connections . To analyze these:

1. Identify which parts are in series and which are in parallel

2. Simplify step by step, starting with the innermost combinations

3. Reduce the circuit to a single equivalent resistance

4. Work backwards to find individual voltages and currents

3.4 Circuit Theorems

Thevenin’s Theorem: Any linear circuit can be reduced to a single voltage source in series with a single resistor . This simplifies analysis of complex circuits.

Norton’s Theorem: Any linear circuit can be reduced to a single current source in parallel with a single resistor .

Part 4: Resistors

4.1 Fixed Resistors

Resistors limit current flow and divide voltages. They are the most common electronic component .

Factors Affecting Resistance :

4.2 Resistor Color Code

Resistors use colored bands to indicate their resistance value and tolerance :

Reading the Code :

• 4-band resistor: First digit, second digit, multiplier, tolerance

• 5-band resistor: First digit, second digit, third digit, multiplier, tolerance

• Tolerance: Gold = ±5%, Silver = ±10%, None = ±20%

Example: Red, Red, Brown, Gold = 2,2,×10,±5% = 220 Ω ±5%

4.3 Variable Resistors

Potentiometers are variable resistors that can adjust resistance continuously :

• Used for volume controls, dimmer switches, calibration adjustments

• Three terminals: two ends and a wiper (adjustable contact)

• Can be used as a rheostat (two-terminal variable resistor) or voltage divider

Part 5: Capacitors

5.1 Capacitor Fundamentals

A capacitor stores electrical energy in an electric field. It consists of two conductive plates separated by an insulator (dielectric) .

Key Properties:

How a Capacitor Works:

• When voltage is applied, opposite charges build up on the two plates

• The capacitor stores energy in the electric field between plates

• Capacitors block DC (after charging) and pass AC

5.2 Capacitors in Circuits

Series and Parallel Combinations :

Time Constant (τ) : The time required for a capacitor to charge to 63.2% of the applied voltage :

• τ = R × C (seconds)

5.3 Types of Capacitors

Warning: Electrolytic capacitors can explode if connected with reverse polarity .

Part 6: Inductors and Transformers

6.1 Inductors

An inductor stores energy in a magnetic field. It consists of a coil of wire .

Key Properties:

• Opposes changes in current (acts like an electrical “flywheel”)

• Passes DC easily (wire has low resistance)

• Impedes AC (higher frequency = higher opposition)

Inductors in Circuits :

6.2 Transformers

A transformer transfers electrical energy between two or more circuits through electromagnetic induction .

Transformer Equation:

• Vp / Vs = Np / Ns

• Where V = voltage, N = number of turns

Types :

Part 7: Switches and Relays

7.1 Switch Types

Switches control the flow of electricity by opening or closing a circuit .

7.2 Relays

A relay is an electromagnetic switch. A small current energizes a coil, creating a magnetic field that pulls a switch contact .

Advantages of Relays:

• Allow low-power circuits to control high-power circuits

• Provide electrical isolation between control and load

• Can switch multiple contacts simultaneously

Part 8: Semiconductor Basics

8.1 Semiconductor Theory

Semiconductors have conductivity between conductors and insulators. Silicon is the most common semiconductor material .

Doping: Adding impurities to silicon to change its electrical properties :

• N-type: Added atoms with extra electrons (negative charge carriers)

• P-type: Added atoms with fewer electrons (positive “holes” as charge carriers)

8.2 The P-N Junction

When N-type and P-type silicon are joined, they form a P-N junction—the fundamental building block of most semiconductor devices .

Properties of a P-N Junction:

• Forward bias (positive to P, negative to N): Current flows

• Reverse bias (positive to N, negative to P): No current flows (except tiny leakage)

This one-way behavior is called rectification.

Part 9: Diodes

9.1 Basic Diode

A diode is a semiconductor device that allows current to flow in only one direction .

Diode Symbols and Terms:

• Anode (P-side): Positive terminal

• Cathode (N-side): Negative terminal (marked with a band)

• Forward voltage drop: About 0.7 V for silicon diodes

• Peak Inverse Voltage (PIV) : Maximum reverse voltage before breakdown

9.2 Types of Diodes

9.3 Diode Applications

Rectification: Converting AC to DC :

Power Supply Filtering: Capacitors smooth the rectified output to produce DC.

Voltage Regulation: Zener diodes maintain constant output voltage regardless of input variations .

Part 10: Transistors

10.1 Bipolar Junction Transistors (BJT)

The Bipolar Junction Transistor (BJT) is a three-terminal semiconductor device that can amplify signals or act as a switch .

Transistor Basics:

• Three terminals: Emitter (E), Base (B), Collector (C)

• Two types: NPN and PNP

• Operation: A small current at the base controls a larger current between collector and emitter

Transistor Configurations :

10.2 Field Effect Transistors (FET)

FETs are voltage-controlled devices (vs. current-controlled for BJTs) .

10.3 Transistor Applications

As a Switch:

• Cutoff region: Transistor OFF (no current flow)

• Saturation region: Transistor ON (full current flow)

• Used in digital logic, motor control, LED drivers

As an Amplifier:

• Active region: Small input changes produce large output changes

• Classes: A, B, AB, C (differ in conduction angle and efficiency)

Part 11: Operational Amplifiers (Op-Amps)

11.1 Op-Amp Basics

An operational amplifier (op-amp) is a high-gain voltage amplifier with differential inputs .

Ideal Op-Amp Characteristics:

Op-Amp Pins:

• Inverting input (-)

• Non-inverting input (+)

• Output

• Positive and negative power supply

11.2 Basic Op-Amp Circuits

11.3 Practical Op-Amp Applications

• Summing Amplifier: Adds multiple input voltages

• Difference Amplifier: Amplifies the difference between two inputs

• Integrator: Output proportional to integral of input

• Differentiator: Output proportional to rate of change of input

• Active Filters: Low-pass, high-pass, band-pass

Part 12: Oscillators

12.1 Oscillator Fundamentals

An oscillator is a circuit that produces a repetitive output waveform without any external input .

Oscillator Types :

12.2 Key Oscillator Circuits

Wien Bridge Oscillator: Produces low-distortion sine waves using RC networks.

Phase-Shift Oscillator: Uses three RC sections to achieve 180° phase shift.

555 Timer Oscillator:

• Can produce square waves (astable mode) or single pulses (monostable mode)

• Frequency determined by external resistors and capacitors

• Very popular for timing applications

Part 13: Power Supplies

13.1 Power Supply Components

A basic DC power supply converts AC from the wall outlet to DC for electronic devices .

Block Diagram:

AC Input → Transformer → Rectifier → Filter → Regulator → DC Output

13.2 Voltage Regulators

Linear Regulators:

• Simple, low noise

• Inefficient for large voltage drops

• Examples: 78xx series (positive), 79xx series (negative)

Switching Regulators:

• More efficient

• Higher noise

• Can step up, step down, or invert voltage

Part 14: Practical Electronics

14.1 Test Equipment

14.2 Soldering and Construction

Essential Soldering Tools :

• Soldering iron (25-40 watts for electronics)

• Rosin-core solder (leaded or lead-free)

• Desoldering pump or wick

• Helping hands and magnifier

Good Soldering Practices :

• Clean the tip before each use

• Heat the joint, not the solder

• Use enough solder to create a fillet, not a blob

• Inspect for cold joints (dull, grainy appearance)

14.3 Reading Schematic Diagrams

Schematic symbols represent electronic components. Learning these symbols is essential for building and troubleshooting circuits .

Common Schematic Symbols:

• Resistor: Zigzag line (US) or rectangle (international)

• Capacitor: Two parallel lines (non-polarized) or one curved line (polarized)

• Diode: Triangle with line at tip

• Transistor: Circle with three leads (older) or simplified symbol (modern)

Part 15: Key Formulas Summary

Part 16: Study Tips for Basic Electronics

1. Master Ohm’s Law first – Everything else builds on this fundamental relationship. Practice solving for voltage, current, and resistance in different configurations .

2. Learn to read resistor color codes – This is a basic skill tested in most introductory courses. Practice until it becomes automatic .

3. Use analogies – The water pipe analogy (pressure = voltage, flow = current, restriction = resistance) helps build intuition .

4. Build circuits on a breadboard – Theory becomes concrete when you see LEDs light and measure voltages with a meter.

5. Understand the difference between series and parallel – Know how voltage, current, and resistance behave in each configuration.

6. Learn component symbols – Being able to read schematic diagrams is essential for understanding and building circuits .

7. Practice with a multimeter – Measure voltages in working circuits; practice measuring resistance (with power off!) .

8. Know the distinction between AC and DC – AC changes direction; DC flows one way. This affects how components behave .

9. Connect to other courses – Basic Electronics is the foundation for digital electronics, microcontrollers, and all advanced electronic systems .

10. Use the search results – The course syllabi provide detailed topics: passive components, Ohm’s law, Kirchhoff’s laws, diodes, transistors, operational amplifiers, and oscillators .

Part 17: Recommended Textbooks and Resources

BSCY-477: Cyber Security

Here are detailed study notes for BSCY-477: Cyber Security, written from a Computer Science/Cyber Security perspective. These notes cover the fundamental principles of cyber security—security concepts, cryptography, network security, application security, operating system security, cloud security, incident response, and legal/ethical issues. The emphasis is on understanding threats, vulnerabilities, and countermeasures to protect information systems in a comprehensive manner.

1. Introduction to Cyber Security

1.1. What is Cyber Security?

Cyber Security is the practice of protecting systems, networks, programs, and data from digital attacks, damage, or unauthorized access. It encompasses technologies, processes, and controls designed to safeguard the confidentiality, integrity, and availability of information.

The Core Question: How do we protect information systems from cyber threats while ensuring business continuity and regulatory compliance?

1.2. The CIA Triad (Foundational Model)

                    ┌─────────────────────────────────────┐
                    │            Cyber Security           │
                    │              (CIA Triad)            │
                    └───────────────┬─────────────────────┘
                                    │
        ┌───────────────────────────┼───────────────────────────┐
        │                           │                           │
   ┌────▼────┐                 ┌─────▼─────┐               ┌─────▼─────┐
   │Confiden-│                 │ Integrity │               │Availabi-  │
   │tiality  │                 │           │               │lity       │
   └─────────┘                 └───────────┘               └───────────┘
   (Data Privacy)              (Data Accuracy)             (Data Access)

1.3. Additional Security Goals

1.4. Key Security Concepts

1.5. Types of Threats

2. Cryptography

2.1. What is Cryptography?

Cryptography is the practice of secure communication in the presence of adversaries. It involves transforming information (plaintext) into an unreadable format (ciphertext) and back.

Plaintext → [Encryption] → Ciphertext → [Decryption] → Plaintext
                ↑                            ↑
               Key                          Key

2.2. Cryptographic Terminology

2.3. Types of Cryptography

2.4. Symmetric Encryption

Characteristics:

• Same key for encryption and decryption

• Key must be shared securely

• Very fast (suitable for large data)

Common Symmetric Algorithms:

Modes of Operation:

2.5. Asymmetric Encryption (Public Key)

Characteristics:

• Two mathematically related keys: public and private

• Public key can be shared openly

• Much slower than symmetric encryption

Common Asymmetric Algorithms:

2.6. Hash Functions

Characteristics:

• One-way function (cannot reverse)

• Fixed output length

• Deterministic (same input = same output)

• Collision-resistant

Common Hash Algorithms:

2.7. Digital Signatures

Provides authentication, integrity, and non-repudiation.

Process:

1. Sender computes hash of message

2. Sender encrypts hash with private key (signing)

3. Receiver decrypts signature with sender’s public key

4. Receiver computes own hash and compares

2.8. Public Key Infrastructure (PKI)

2.9. Cryptographic Applications

3. Network Security

3.1. Network Security Threats

3.2. Firewalls

A firewall monitors and controls incoming/outgoing network traffic based on security rules.

3.3. Intrusion Detection and Prevention (IDS/IPS)

Detection Methods:

3.4. Virtual Private Networks (VPN)

VPN Protocols:

3.5. Network Security Protocols

4. Application Security

4.1. OWASP Top 10 (Common Web Vulnerabilities)

4.2. SQL Injection

Vulnerable Code:

-- Input: ' OR '1'='1
SELECT * FROM users WHERE username = 'input' AND password = 'pass'
-- Becomes:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'pass'

Prevention:

• Parameterized queries (prepared statements)

• Input validation and sanitization

• Least privilege database accounts

4.3. Cross-Site Scripting (XSS)

Prevention:

• Output encoding (HTML, JavaScript, URL)

• Content Security Policy (CSP)

• Input validation

4.4. Cross-Site Request Forgery (CSRF)

Attack: Malicious site tricks authenticated user into making unwanted request.

Prevention:

• Anti-CSRF tokens

• SameSite cookie attribute

• Referer/Origin header validation

• Re-authentication for sensitive actions

4.5. Secure Coding Practices

5. Operating System Security

5.1. OS Security Concepts

5.2. Linux Security Features

5.3. Windows Security Features

5.4. System Hardening Guidelines

6. Cloud Security

6.1. Shared Responsibility Model

┌─────────────────────────────────────────────────────────────────┐
│                      Customer Responsibility                    │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │  Data, Applications, Access Management, Identity        │   │
│  └─────────────────────────────────────────────────────────┘   │
│                      Shared Responsibility                      │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │  Operating System, Network Configuration, Firewalls     │   │
│  └─────────────────────────────────────────────────────────┘   │
│                      Provider Responsibility                    │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │  Physical Infrastructure, Hypervisor, Availability      │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘

6.2. Cloud Security Threats (CSA Top Threats)

6.3. Cloud Security Best Practices

7. Security Management and Governance

7.1. Security Frameworks

7.2. Risk Management Process

Risk Assessment (Identify, Analyze, Evaluate)
         ↓
Risk Treatment (Mitigate, Transfer, Accept, Avoid)
         ↓
Risk Monitoring & Review

Risk Treatment Options:

7.3. Business Continuity & Disaster Recovery

Key Metrics:

7.4. Incident Response

Incident Response Phases (NIST):

7.5. Security Awareness and Training

Key Topics:

• Password security

• Phishing identification

• Social engineering awareness

• Physical security

• Incident reporting

• Data handling (classification, disposal)

• Remote work security

8. Malware and Threats

8.1. Types of Malware

8.2. Attack Vectors

8.3. Advanced Persistent Threat (APT)

Characteristics:

• Long-term targeted attack

• Nation-state or well-funded actors

• Multiple phases (reconnaissance, intrusion, persistence, exfiltration)

• Low and slow (avoid detection)

APT Lifecycle:

Recon → Initial Compromise → Establish Foothold → Escalate Privileges → Internal Recon → Lateral Movement → Maintain Presence → Exfiltrate Data

8.4. Zero-Day Exploit

A zero-day exploit targets a vulnerability unknown to the vendor or public.

Defense Strategy:

• Defense in depth (layered security)

• Behavior-based detection

• Application whitelisting

• Least privilege

• Network segmentation

9. Identity and Access Management (IAM)

9.1. Authentication Factors

Multi-Factor Authentication (MFA/2FA): Requires at least two different factors.

9.2. Password Security

Password Attacks:

Password Storage Best Practices:

• Never store plaintext passwords

• Use strong hashing (bcrypt, Argon2, PBKDF2) with salt

• Use key stretching (multiple iterations)

9.3. Access Control Models

9.4. Principle of Least Privilege

Users and programs should have the minimum privileges necessary to perform their functions.

Implementation:

• Separate accounts for different roles

• Temporary privilege elevation (sudo)

• Regular access reviews

• Remove inactive accounts

9.5. Single Sign-On (SSO)

SSO allows users to authenticate once and access multiple applications.

Benefits:

• Improved user experience

• Reduced password fatigue

• Centralized authentication management

• Simplified access revocation

Protocols: SAML, OAuth 2.0, OpenID Connect

10. Legal and Ethical Issues

10.1. Major Regulations

10.2. Cyber Laws

10.3. Ethics in Cyber Security

10.4. Ethical Hacking

Types of Hackers:

Penetration Testing Phases:

1. Reconnaissance (information gathering)

2. Scanning (vulnerability identification)

3. Exploitation (gaining access)

4. Maintaining Access (persistence)

5. Reporting (documentation)

11. Summary Table: Security Controls by Layer

12. Key Equations Reference Sheet

13. Standard References

14. Final Study Checklist

Wireless and Mobile Security – Comprehensive Study Notes

These notes provide a complete framework for Wireless and Mobile Security, covering the fundamental principles, protocols, threats, and countermeasures for securing wireless communications and mobile devices. The focus is on understanding the unique vulnerabilities introduced by wireless technologies and the specific security mechanisms designed to address them in both enterprise and personal contexts .

Part 1: Fundamentals of Wireless Security

1.1 Why Wireless Security is Different

Wireless communication introduces unique security challenges not present in wired networks. Understanding these differences is essential for effective security design.

Wireless communication protocols, including Wi-Fi, Bluetooth, cellular, and IoT protocols like Zigbee, are integral components of modern operations. However, their inherent convenience also makes them ideal targets for malicious actors. Wireless signals can be intercepted remotely, even without physical access, allowing attackers to remain undetected while compromising networks .

1.2 Wireless Attack Surfaces

The attack surface for wireless systems spans all layers of the OSI model, with unique vulnerabilities at each layer .

┌─────────────────────────────────────────────────────────────────────┐
│                    OSI LAYER ATTACK SURFACES                         │
├─────────────────────────────────────────────────────────────────────┤
│  Application Layer    │  Malicious apps, phishing, data leaks       │
│  Presentation Layer   │  Certificate spoofing, format exploitation  │
│  Session Layer        │  Session hijacking, replay attacks          │
│  Transport Layer      │  Port scanning, TCP hijacking              │
│  Network Layer        │  IP spoofing, routing attacks              │
│  Data Link Layer      │  MAC spoofing, evil twin, deauth attacks   │
│  Physical Layer       │  Jamming, signal interception, spoofing    │
└─────────────────────────────────────────────────────────────────────┘

1.3 Wireless Security Requirements

The core security requirements for wireless systems extend traditional security goals to address wireless-specific concerns:

Part 2: Wi-Fi Security Protocols

Wi-Fi security has evolved through several generations of protocols, each building on lessons from previous standards to address emerging vulnerabilities .

2.1 Evolution of Wi-Fi Security Standards

1997 ─── WEP (Wired Equivalent Privacy)
         ↓ Broken by 2001
2003 ─── WPA (Wi-Fi Protected Access) - TKIP
         ↓ Deprecated 2012
2004 ─── WPA2 (802.11i) - AES-CCMP
         ↓ KRACK vulnerability (2017)
2018 ─── WPA3 - SAE, GCMP-256

2.2 WEP (Wired Equivalent Privacy)

Introduced: 1997
Status: Obsolete/Deprecated

WEP was the original 802.11 security mechanism, attempting to provide confidentiality comparable to wired networks. It uses the RC4 stream cipher for encryption and a 24-bit Initialization Vector (IV) combined with a pre-shared key .

Critical Weaknesses:

• IV is too short (24 bits) and sent in plaintext, leading to frequent IV reuse

• RC4 cipher has known statistical weaknesses

• CRC-32 integrity check is not cryptographically secure

• Static keys are used across all devices

Attack Impact: Researchers demonstrated that WEP could be cracked within minutes using tools like AirSnort. The 2007 TJ Maxx breach was traced to WEP weaknesses. WEP was formally deprecated in 2003 and is no longer considered secure for any use .

2.3 WPA (Wi-Fi Protected Access)

Introduced: 2003
Status: Legacy (deprecated)

WPA was rushed out as an interim replacement for WEP, designed to be deployable via firmware updates on existing hardware. It still relied on the RC4 cipher but introduced significant improvements .

Key Improvements:

• TKIP (Temporal Key Integrity Protocol) : Dynamically generates per-packet keys

• MIC (Message Integrity Code) : 64-bit “Michael” code replaces weak CRC

• Two modes: Personal (PSK) for home/SMB, Enterprise (802.1X with RADIUS) for organizations

Limitations:

• Still based on RC4 (constrained by backward compatibility)

• TKIP was found to have vulnerabilities by 2008-2009

• Officially deprecated in 2012

2.4 WPA2 (Wi-Fi Protected Access 2)

Introduced: 2004
Status: Still widely used, but being superseded by WPA3

WPA2 represented a complete overhaul based on the IEEE 802.11i amendment. It replaced RC4/TKIP with the Advanced Encryption Standard (AES) cipher paired with CCMP (Counter Mode with CBC-MAC Protocol) .

Key Features:

• AES-CCMP encryption: 128-bit keys, vastly stronger than RC4

• 4-way handshake: Establishes unique session keys per client

• Perfect forward secrecy for each session

• Two modes: Personal (PSK) and Enterprise (802.1X)

Known Vulnerabilities:

KRACK Details: The KRACK attack exploited a flaw in the WPA2 handshake implementation. By manipulating handshake messages, an attacker could trick a device into reinstalling an already-used key, resetting packet counters and enabling decryption of traffic. Importantly, this attack was not due to a weak cipher but a protocol logic issue .

2.5 WPA3 (Wi-Fi Protected Access 3)

Introduced: 2018
Status: Current standard

WPA3 is the latest Wi-Fi Alliance security certification, designed to address WPA2’s weaknesses and secure wireless networks against modern threats .

WPA3-Personal: SAE Authentication

WPA3-Personal replaces PSK-based authentication with SAE (Simultaneous Authentication of Equals) , a variant of the Dragonfly key exchange .

Security Improvements:

• Prevents offline dictionary attacks: SAE ensures the passphrase is never transmitted or derived in a form that eavesdroppers can reuse

• Active authentication required: Attackers must interact with the network for each guess

• Limited authentication attempts: Multiple failures block further attempts

This effectively locks out Wi-Fi password cracking tools that made WPA/WPA2 vulnerable when weak passwords were used .

WPA3-Enterprise: Enhanced Security

WPA3-Enterprise continues to use 802.1X with external authentication servers but adds enhancements for high-security environments:

• 192-bit cryptographic suite: Optional mode aligned with CNSA (Commercial National Security Algorithm) requirements for government/defense use

• AES-256 in GCM mode and SHA-384 for top-secret level security

• Mandatory certificate validation: Servers must present valid certificates

WPA3 Features for Specific Use Cases

WPA3 Security Properties

Part 3: Wireless Attack Vectors

3.1 Physical Layer Attacks

The Physical Layer (Layer 1) addresses hardware interactions, transmission, and signaling mechanisms. In wireless systems, this layer is particularly vulnerable .

Example Attack: In a Wi-Fi network, an attacker could inject forged preambles that precede actual data frames, forcing devices to wait for expiration of an announced data frame duration, effectively silencing the channel .

3.2 Data Link Layer Attacks

The Data Link Layer (Layer 2) manages physical addressing and access control. Common attacks at this layer include :

Evil Twin (Fake Access Point) :

• Attacker establishes malicious AP with same SSID as legitimate AP

• User devices connect to fake network

• Attacker executes man-in-the-middle attacks to capture traffic

MAC Spoofing:

• Attacker changes device’s MAC address to impersonate legitimate device

• Bypasses MAC address filtering

• Enables other network attacks

Deauthentication Attack:

• Attacker sends deauth frames to disconnect clients

• Forces clients to reconnect, enabling handshake capture

• Particularly effective when PMF is disabled

KRACK (Key Reinstallation Attack) :

• Manipulates 4-way handshake to reinstall already-used keys

• Resets packet counters, enabling decryption

• Affects all WPA2 implementations (patched)

3.3 Network Layer Attacks

The Network Layer (Layer 3) handles routing and packet forwarding .

3.4 Advanced Attack Techniques

Nearest Neighbor Attack:
A sophisticated example where a Russian APT group compromised a victim organization by leveraging the wireless network of another organization across the street, without ever setting foot in the country. The APT group remained undetected on the victim network for two years before discovery .

Evil Twin with Captive Portal:
Attackers create fake access points mimicking legitimate public Wi-Fi, complete with login portals that capture credentials.

KARMA Attack:
Attacker creates access points with SSIDs that client devices have previously connected to, exploiting preferred network lists.

Part 4: Mobile Device Security

4.1 The Mobile Threat Landscape

Mobile devices have become primary interfaces to personal and enterprise systems, storing authentication credentials, financial data, location histories, and access tokens .

Attack Statistics (2024-2025):

• 33.3 million mobile malware attacks globally in 2024 (~2.8 million per month)

• Android-specific attacks rose 29% year-over-year (first half of 2025)

• Mobile banking trojans more than tripled (from 420,000 to 1.24 million incidents)

• Disclosed vulnerabilities increased by 16% in early 2025

• AI-supported phishing accounts for more than 80% of observed social engineering activity

• More than 1 million enterprise employees exposed to mobile phishing campaigns in Q1 2025

4.2 Mobile Malware Types

4.3 Advanced Evasion Techniques

Modern mobile malware incorporates sophisticated evasion techniques to avoid detection .

Dynamic Evasion:
Malware detects analysis environments (emulators, debuggers) and alters behavior when suspicious characteristics are identified. Common evasion responses include suppressing malicious behavior, entering dormant states, or exhibiting only benign functionality .

Examples of Dynamic Evasion:

Statistics from real-world malware (analysis of 20,556 malicious apps):

• 44.1% check system properties to evade emulated environments

• 26.2% inspect /proc file system’s maps file to detect hooking tools

Additional Modern Evasion Techniques:

• Kernel-level manipulation: Intercept and falsify application security checks

• Encrypted C2 communication: Using certificate pinning to prevent traditional network monitoring

• Zero-click exploitation: Requires no user interaction (malformed image files, messages)

• NFC relay attacks: Capture contactless card data and transmit to attacker systems

4.4 Mobile Device Hardening

Device hardening is not a one-time task but a continuous process. It is crucial for ensuring resilience against threat actors. By bolstering security, we make it significantly more difficult for hackers to breach defenses .

Essential Hardening Measures:

4.5 CISA Mobile Security Guidelines

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Mobile Communications Best Practice Guidance in November 2025 due to increased espionage activity and growing cyber attacks .

Key Android-Specific Recommendations:

1. Choose devices with strong security updates: Prefer Android Enterprise Recommended devices with hardware-level security features (secure enclaves, HSM) and manufacturers guaranteeing five+ years of security patches

2. Set trusted Private DNS provider: Use DNS-over-TLS providers like Cloudflare (1dot1dot1dot1.cloudflare-dns.com), Google (dns.google), or Quad9 (dns.quad9.net)

3. Enable Chrome’s always-secure connections: Force HTTPS connections to encrypt all web requests

4. Review and restrict app permissions: Disable permissions not matching app’s core functionality

5. Keep Google Play Protect active: Scan apps for vulnerabilities, enable both scanning toggles

6. Use encrypted RCS messaging: Enable Rich Communication Services for end-to-end encrypted one-on-one conversations

7. Enable Safe Browsing on Chrome: Use Enhanced Protection mode to block malicious websites and phishing attempts

Authentication Recommendations:

• Enable passwordless FIDO authentication (phishing-proof)

• Avoid SMS-based multi-factor authentication (easier to intercept)

Part 5: Cellular Network Security

5.1 Evolution of Cellular Security

5.2 Key Cellular Threats

IMSI Catchers (Stingrays) :

• Fake cell towers that trick devices into connecting

• Capture IMSI (International Mobile Subscriber Identity) numbers

• Can intercept calls, messages, and data

• 4G/5G improvements include encrypted SUPI (Subscription Permanent Identifier)

SS7 Protocol Vulnerabilities:

• Signaling System 7 vulnerabilities enable location tracking

• Call/SMS interception and redirect

• Two-factor authentication bypass

False Base Station Attacks:

• Downgrade attacks forcing devices to use weaker encryption

• Man-in-the-middle between device and legitimate network

5.3 RCS (Rich Communication Services) Security

RCS is the successor to SMS, offering modern messaging features over mobile data or Wi-Fi .

Security Features:

• End-to-end encryption (E2EE) for one-on-one conversations (when both parties have RCS enabled)

• Key verification for secure chat verification

• Works directly with phone number (no separate account needed)

Benefits beyond security:

• High-quality media sharing without compression

• Larger attachments and faster delivery

• Typing indicators, read receipts, message reactions

• Edit sent messages, emoji replies, link previews

Part 6: Bluetooth Security

6.1 Bluetooth Security Overview

6.2 Common Bluetooth Attacks

6.3 Bluetooth Security Best Practices

1. Disable Bluetooth when not in use – Reduces attack surface

2. Use “non-discoverable” mode – Prevents unwanted scanning

3. Accept pairing requests only from trusted devices – Avoids malicious pairings

4. Keep device firmware updated – Patches known vulnerabilities

5. Use secure pairing methods – Numeric comparison over “Just Works” when possible

Part 7: Wireless Intrusion Detection and Prevention

7.1 Wireless Intrusion Detection Systems (WIDS)

WIDS offers continuous monitoring of the RF environment, promptly identifying unauthorized devices, suspicious transmissions, and other anomalies. By proactively alerting security teams to potential intrusions, these systems enable rapid response to emerging threats .

WIDS Capabilities:

• Rogue AP detection

• Evil twin identification

• Ad-hoc network detection

• MAC spoofing detection

• Channel scanning and monitoring

• Signature-based and anomaly-based detection

7.2 Wireless Intrusion Prevention Systems (WIPS)

WIPS extends WIDS by actively blocking detected threats.

Active Response Capabilities:

• Deauthentication of rogue devices

• Containment of unauthorized APs

• Automatic blocking of malicious MAC addresses

• Integration with wired network security (e.g., switch port shutdown)

7.3 Integrating Wireless Security into Zero Trust

Zero Trust principles (“never trust, always verify”) require continuous validation of all devices, connections, and users. Extending this concept to wireless environments ensures these inherently vulnerable communications channels receive equal scrutiny as wired counterparts .

Zero Trust for Wireless:

• Continuous device authentication and authorization

• Micro-segmentation for wireless traffic

• Encrypted communications (WPA3, VPN)

• Real-time visibility into RF environment

• Behavioral analytics for anomaly detection

Part 8: Mobile Malware Analysis

8.1 Analysis Approaches

8.2 Detection Challenges

Modern mobile malware presents significant detection challenges :

Challenges:

• Encrypted communications: >87% of blocked threats delivered over encrypted channels (2024)

• Certificate pinning: Prevents traditional network interception

• AI-powered evasion: Adaptive behavior based on environment detection

• Zero-click exploits: No user interaction required

• Rapid weaponization: Attackers exploit newly published flaws within days

Research Challenges (per academic survey) :

• Absence of comprehensive ground-truth datasets with standardized evasion behavior annotations

• Native code blind spots in analysis

• Systemic over-reliance on subjective human intuition

• Analysis-monitoring contradictions (malware detecting analysis environments)

Part 9: Best Practices Summary

9.1 For Individuals

9.2 For Organizations

9.3 Emerging Best Practices

• Comprehensive RF Monitoring: Deploy specialized sensors to monitor all wireless communication protocols operating within critical areas continuously

• Routine Wireless Audits: Conduct regular assessments to identify, catalog, and authorize wireless devices

• Robust Incident Response Planning: Regularly update and test incident response plans for wireless-specific security breaches

Part 10: Key Terms Summary

Part 11: Study Tips for Wireless and Mobile Security

1. Master the protocol evolution – Understand why WEP→WPA→WPA2→WPA3 each addressed specific vulnerabilities. Know the key improvements at each stage .

2. Learn the attack techniques – Be able to explain how evil twin, deauthentication, KRACK, and other attacks work at the protocol level.

3. Understand SAE vs. PSK – The move from PSK (WPA2) to SAE (WPA3) eliminates offline dictionary attacks. This is a critical differentiator.

4. Know the OSI layers for wireless – Different attacks target different layers. Map attacks to the appropriate OSI layer .

5. Connect to other security courses – Wireless security builds on cryptographic foundations (encryption, hashing, PKI).

6. Stay current – The threat landscape evolves rapidly. Follow CISA guidance and industry reporting for emerging threats .

7. Practice with tools – Familiarity with Wireshark, Aircrack-ng, and mobile analysis tools is valuable for hands-on understanding.

Part 12: Recommended Resources

Hardware Security

Here are detailed study notes on Hardware Security, written from a Computer Science/Cyber Security perspective. These notes cover the fundamental principles of hardware security—trusted execution environments, physical attacks, side-channel analysis, hardware Trojans, secure boot, and hardware-based cryptographic primitives. The emphasis is on understanding how hardware-level vulnerabilities can undermine even the strongest software security measures and how to design resilient systems.

1. Introduction to Hardware Security

1.1. What is Hardware Security?

Hardware Security refers to the protection of physical devices, integrated circuits, and embedded systems from unauthorized access, tampering, reverse engineering, and malicious modification. It encompasses the design, verification, and deployment of hardware-based countermeasures to ensure the confidentiality, integrity, and availability of information at the lowest level of computing.

The Core Question: How do we protect computing systems at the silicon level when software security alone is insufficient to defend against physical or low-level attacks?

1.2. Why Hardware Security Matters

1.3. Hardware vs. Software Security

2. Hardware Security Primitives

2.1. Root of Trust (RoT)

The Root of Trust is a set of hardware-protected functions that are inherently trusted by the system. It serves as the foundation for all subsequent security operations.

Key Functions:

• Secure Boot: Verifies the integrity of the first stage bootloader before execution

• Cryptographic Key Storage: Stores keys in tamper-resistant memory

• Attestation: Provides proof of system state to remote parties

• Random Number Generation: Supplies high-quality entropy for cryptographic operations

2.2. Secure Boot and Trusted Boot

┌─────────────────────────────────────────────────────────────────┐
│                     Secure Boot Chain                           │
│                                                                 │
│  ┌─────────┐    ┌─────────┐    ┌─────────┐    ┌─────────┐     │
│  │  RoT    │───►│ Boot    │───►│  OS     │───►│Applications│    │
│  │ (ROM)   │    │ Loader  │    │ Kernel  │    │           │    │
│  └─────────┘    └─────────┘    └─────────┘    └─────────┘     │
│       │              │              │              │           │
│       ▼              ▼              ▼              ▼           │
│   Verifies       Verifies        Verifies       Measures      │
│   Bootloader     OS Kernel       Drivers        State         │
└─────────────────────────────────────────────────────────────────┘

2.3. Trusted Platform Module (TPM)

The TPM is a dedicated microcontroller designed to secure hardware through integrated cryptographic keys.

TPM Functions:

• Random number generation for cryptographic operations

• Secure key generation and storage (keys never leave TPM in plaintext)

• Platform integrity measurement (PCR – Platform Configuration Registers)

• Remote attestation (proving system state to external verifiers)

• Sealed storage (keys bound to specific system configurations)

2.4. Hardware Security Module (HSM)

An HSM is a dedicated physical device that manages digital keys and performs cryptographic operations in a tamper-resistant environment.

Typical Applications:

• Payment processing (PCI DSS compliance)

• PKI and certificate authority operations

• Code signing (software/firmware)

• Cloud key management services

Market Projection: HSM market projected to reach $3.28 billion by 2030 (CAGR 14.5%)

2.5. Trusted Execution Environments (TEE)

A TEE is a secure area within a processor that ensures code and data loaded inside are protected from the main operating system.

Examples:

• Intel SGX (Software Guard Extensions): Hardware enclaves for application isolation

• ARM TrustZone: Hardware isolation between “secure world” and “normal world”

• AMD SEV (Secure Encrypted Virtualization): Encrypted VM memory

Confidential Computing: Protecting data in use via hardware-based TEEs (CAGR 62.1% through 2028)

2.6. Physical Unclonable Functions (PUF)

A PUF is a physical structure that exploits manufacturing variations to generate a unique, unclonable “fingerprint” for each chip.

┌─────────────────────────────────────────────────────────────────┐
│                     PUF Operation                               │
│                                                                 │
│   Challenge ──► [PUF Circuit] ──► Response (unique bit string) │
│                                                                 │
│   Characteristics:                                             │
│   • Easy to evaluate                                           │
│   • Virtually impossible to clone                              │
│   • Same manufacturing process produces different results      │
│   • Inherent randomness from process variations                │
└─────────────────────────────────────────────────────────────────┘

Applications:

• Secure key storage (keys derived from PUF, never stored)

• Device authentication

• Anti-counterfeiting

• IP protection

3. Hardware Attack Vectors

3.1. Side-Channel Attacks (SCA)

Side-channel attacks exploit physical emissions from a device during operation rather than directly attacking cryptographic algorithms.

Power Trace Example (Conceptual):

Power
  ↑
  │      ████      ████      ████
  │     █    █    █    █    █    █
  │    █      █  █      █  █      █
  │   █        ██        ██        ██
  └────────────────────────────────────→ Time
       0         1         0         1    (Key bits)

3.2. Fault Injection Attacks

Fault injection attacks intentionally disrupt normal device operation to cause errors that can be exploited.

Laser Fault Injection offers very high accuracy in both time and location, giving attackers more control and enabling a wider range of attacks.

3.3. Rowhammer Attack

Rowhammer exploits a physical vulnerability in DRAM where repeated access (hammering) to a row of memory cells causes electrical charge leakage that flips bits in adjacent rows.

┌─────────────────────────────────────────────────────────────────┐
│                     Rowhammer Phenomenon                         │
│                                                                 │
│   Row N-1 (Aggressor)  ←── Repeated Access (Hammering)         │
│   Row N    (Victim)    ←── Bit Flip! (0→1 or 1→0)              │
│   Row N+1 (Aggressor)  ←── Repeated Access (Hammering)         │
└─────────────────────────────────────────────────────────────────┘

Impact: Untrusted applications can gain full system privileges and bypass security sandboxes.

3.4. Hardware Trojans (HT)

A Hardware Trojan is a malicious modification of an integrated circuit that alters its functionality, performance, or reliability.

Supply Chain Risks:

• Third-party IP integration

• Untrusted fabrication facilities

• Malicious design tools

• Counterfeit components

3.5. Hardware Reverse Engineering

Attackers can reverse engineer chips to extract intellectual property or discover vulnerabilities.

Techniques:

• Delaying: Removing packaging layer by layer

• Imaging: SEM, TEM to capture layout

• Netlist Extraction: Reconstructing gate-level design

• FIB (Focused Ion Beam): Circuit modification

3.6. Physical Tampering

4. Hardware Security Countermeasures

4.1. Physical Protection

4.2. Side-Channel Countermeasures

4.3. Fault Injection Countermeasures

4.4. Secure Boot and Firmware Protection

4.5. Supply Chain Security

5. Hardware Security in Practice

5.1. Secure Elements (SE)

A Secure Element is a tamper-resistant chip embedded in devices like smartphones or smart cards that stores payment information and cryptographic keys.

Applications:

• Mobile payments (Apple Secure Enclave, Google Titan)

• Smart cards (credit cards, SIM cards)

• Identity verification

5.2. Cryptographic Instruction Set Architectures

Modern CPUs incorporate cryptographic instructions to accelerate secure operations and reduce side-channel risks.

Examples:

• AES-NI: Hardware-accelerated AES on Intel/AMD processors

• ARMv8 Crypto Extensions: AES, SHA, and PMULL instructions

• RISC-V Cryptographic Extensions: Scalar and vector crypto instructions

5.3. Memory Encryption

Protecting data in memory from physical attacks (cold boot, DMA attacks).

5.4. FPGA Security

Field-Programmable Gate Arrays (FPGAs) present unique security challenges.

Concerns:

• Bitstream interception/modification

• Malicious IP cores

• Side-channel leakage from reconfigurable logic

Countermeasures:

• Bitstream encryption and authentication

• Physically Unclonable Functions (PUFs) on FPGAs

• Secure configuration protocols

5.5. RISC-V Security

The open-source RISC-V architecture has unique security challenges and opportunities.

Research Areas:

• Security extensions (IOPMP, WorldGuard)

• Formal verification of implementations

• Trusted Execution Environments (TEEs) for RISC-V

6. Emerging Hardware Security Topics

6.1. Post-Quantum Cryptography (PQC) Migration

NIST has finalized PQC standards (FIPS 203/204/205).

Hardware Challenges:

• Lattice-based algorithms have larger key sizes and more computation

• Hardware accelerators needed for acceptable performance

• Crypto-agility required (ability to swap algorithms)

6.2. Confidential Computing

Protecting data in use through hardware-based TEEs.

Key Initiatives:

• AMD SEV

• Intel TDX

• ARM CCA (Confidential Compute Architecture)

Market Growth: Confidential computing expected to grow at CAGR 62.1% through 2028

6.3. Chiplet Security

As chips move from monolithic to multi-die (chiplet) architectures, new security challenges emerge.

Concerns:

• Die-to-die interconnect security (UCIe)

• Multi-vendor supply chain risks

• Side-channel leakage across chiplets

Solutions:

• UCIe with encryption and attestation

• Partition isolation and address fencing

• Die-level attestation for system-in-package (SiP) designs

6.4. Hardware-First Zero Trust

Zero Trust Architecture (ZTA) is increasingly supported by hardware security features.

Hardware Enablers:

• TPM for device identity and attestation

• Secure Enclaves for workload isolation

• Measured Boot for integrity verification

7. Summary Table: Attack Vectors and Countermeasures

8. Key Terminology Reference Sheet

9. Standard References

10. Final Study Checklist

Malware Analysis – Detailed Study Notes

These study notes are designed for cybersecurity students, incident responders, and malware analysts. The notes cover the fundamental principles of malware analysis, types of malware, static and dynamic analysis techniques, reverse engineering, and detection methods.

1. Introduction to Malware Analysis

1.1 What is Malware Analysis?

1.2 Why Perform Malware Analysis?

1.3 Types of Malware

1.4 Malware Analysis Approaches

1.5 Analysis Environments

2. Static Analysis Techniques

2.1 Basic Static Analysis

2.2 PE (Portable Executable) Structure

┌─────────────────────────────────────────────┐
│              DOS Header (MZ)                 │
├─────────────────────────────────────────────┤
│           DOS Stub Program                   │
├─────────────────────────────────────────────┤
│              PE Header                       │
│  - Signature (PE\0\0)                        │
│  - File Header (Machine, #Sections)          │
│  - Optional Header (Entry Point, Image Base) │
├─────────────────────────────────────────────┤
│           Section Table                      │
├─────────────────────────────────────────────┤
│  .text  │  .data  │  .rdata │  .rsrc       │
│ (code)  │ (global)│  (read- │  (resources) │
│         │  data   │  only)  │              │
├─────────────────────────────────────────────┤
│           Overlay (optional)                 │
└─────────────────────────────────────────────┘

Important PE Headers Fields:

2.3 Common PE Sections

2.4 Import Address Table (IAT)

Common Suspicious APIs:

2.5 Packing and Obfuscation

Detecting Packed Files:

• High entropy (random-looking data)

• Few or no meaningful strings

• Small number of imports (only LoadLibrary, GetProcAddress)

• Suspicious section names (.UPX, .aspack, .themida)

• Entry point in unusual section

Unpacking Approaches:

3. Dynamic Analysis Techniques

3.1 Setting Up a Safe Environment

3.2 System Monitoring Tools

3.3 Basic Dynamic Analysis Steps

1. Take clean VM snapshot
2. Start monitoring tools (ProcMon, Wireshark, Regshot)
3. Execute malware
4. Observe initial behavior (process creation, file/registry changes, network connections)
5. Interact with malware (click buttons, enter test credentials if UI present)
6. Monitor for additional behavior (time-based, trigger-based)
7. Stop monitoring
8. Analyze captured artifacts
9. Revert to snapshot

3.4 Automated Analysis (Sandboxes)

3.5 Limitations of Dynamic Analysis

4. Code Analysis and Reverse Engineering

4.1 Disassembly and Decompilation

4.2 Common Assembly Instructions

4.3 Calling Conventions

4.4 Key Sections in Reverse Engineering

4.5 Anti-Reverse Engineering Techniques

5. Malware Persistence Mechanisms

5.1 Registry Auto-Start Locations

5.2 Other Persistence Methods

6. Network Indicators and C2 Communication

6.1 Network Artifacts

6.2 Common C2 Protocols

6.3 Domain Generation Algorithms (DGA)

6.4 Fast Flux

7. Malware Detection and Signature Development

7.1 YARA Rules

Basic YARA Rule Example:

rule Suspicious_Strings
{
    meta:
        description = "Detects malware with suspicious strings"
        author = "Analyst"
        date = "2024-01-15"
    strings:
        $s1 = "CreateRemoteThread" wide ascii
        $s2 = "VirtualAllocEx" wide ascii
        $s3 = "cmd.exe" wide ascii
        $url1 = "http://" wide ascii
        $url2 = "https://" wide ascii
    condition:
        (2 of ($s*)) and (1 of ($url*))
}

7.2 Snort/Suricata Signatures

Basic IDS Signature Example:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"Malware C2 Beacon"; flow:to_server,established;
 content:"POST"; http_method;
 content:"/c2/beacon"; http_uri;
 pcre:"/User-Agent\x3a[^\n]+Mozilla\/5\.0 \(Windows NT 10\.0/";
 sid:1000001; rev:1;)

7.3 Indicators of Compromise (IOCs)

8. Sample Exam Questions

Short Answer (5 marks each)

1. Distinguish between static analysis and dynamic analysis. Give one advantage of each.

2. What is a packer? Why do malware authors use packers?

3. List five registry keys commonly used for malware persistence.

4. What is a YARA rule? Write a simple rule to detect a file containing the string “malware.exe”.

5. Distinguish between a virus and a worm.

Practical/Scenario Questions (10-15 marks)

1. PE Analysis:
You have a suspicious PE file. What information would you gather during static analysis? List at least 10 items.

2. Dynamic Analysis:
A malware sample appears to delete itself after execution. How would you still capture its behavior?

Solution:

1. Use Process Monitor to capture file operations before deletion
2. Use API Monitor to hook DeleteFile, MoveFileEx, NtSetInformationFile
3. Set breakpoints on deletion APIs in debugger
4. Copy file to new location before deletion (procdump, process hollowing)
5. Use kernel driver to prevent file deletion

3. YARA Rule Writing:
Write a YARA rule to detect a PE file with the section name .UPX and containing the string “This program cannot be run in DOS mode”.

Solution:

rule UPX_Packed
{
    meta:
        description = "Detects UPX packed files"
    strings:
        $upx_section = ".UPX" wide ascii
        $dos_stub = "This program cannot be run in DOS mode" wide ascii
    condition:
        uint16(0) == 0x5A4D and $upx_section and $dos_stub
}

Quick Revision Table – Malware Analysis Tools

Quick Revision Table – Malware Classification

Advance Digital Logic Design – Comprehensive Study Notes

These notes provide a complete framework for Advance Digital Logic Design, covering the fundamental principles of digital systems, hardware description languages (Verilog/VHDL), synthesis techniques, design of arithmetic circuits, and programmable logic devices. The focus is on developing the skills to design, simulate, and implement complex digital systems using modern design methodologies and EDA tools .

Part 1: Course Overview and Prerequisites

1.1 What is Advanced Digital Logic Design?

Advanced Digital Logic Design builds upon foundational digital logic concepts to explore sophisticated design methodologies, hardware description languages, synthesis techniques, and implementation technologies. Unlike introductory courses that focus on basic gates and simple circuits, advanced courses emphasize the design of complex digital systems such as processors, arithmetic units, and controllers using modern design flows .

Course Objectives :

• Understand internal structure of PLDs (Programmable Logic Devices) and FPGAs (Field Programmable Gate Arrays)

• Apply digital design techniques using VHDL or Verilog

• Design and implement datapath controllers and arithmetic processors

• Perform post-synthesis design validation and timing verification

1.2 Prerequisites

Before taking an advanced digital logic design course, students should have mastered :

1.3 Required Tools and Software

Advanced digital design courses typically utilize industry-standard EDA (Electronic Design Automation) tools :

Part 2: Review of Combinational Logic Design

2.1 Fundamental Concepts

A quick review of combinational logic is essential before advancing to more complex topics .

Combinational Logic Characteristics:

• Output depends only on current inputs (no memory)

• No feedback paths

• Can be described by truth tables or Boolean expressions

Basic Building Blocks :

2.2 Two-Level Logic Minimization

Two-level logic refers to circuits implemented as AND-OR or NAND-NAND (SOP form) and OR-AND or NOR-NOR (POS form). Optimization of these forms is a core topic in advanced courses .

Minimization Methods :

The Quine-McCluskey Method (Tabulation Method) :

1. Write minterms in binary grouped by number of 1’s

2. Compare adjacent groups; combine terms differing by one bit

3. Create prime implicant chart

4. Select essential prime implicants

5. Cover remaining minterms

ESPRESSO Algorithm :

• Iterative heuristic for two-level minimization

• Operations: EXPAND, IRREDUNDANT, REDUCE, LAST-GASP

• Can handle functions with many inputs (practical for real designs)

2.3 Multilevel Logic Synthesis

While two-level logic is conceptually simple, most practical circuits are implemented in multilevel form (fewer gates, lower area, better performance) .

Multilevel Logic Operations :

Technology Mapping :

• Transforms a technology-independent network into a network using gates from a target library (ASIC standard cells, FPGA LUTs)

• Goal: minimize area, delay, or power

• Techniques: tree covering, dynamic programming, Boolean matching

2.4 Hazards and Glitches

Hazards are unwanted switching events at circuit outputs caused by different propagation delays along different paths .

Types of Hazards :

Hazard Elimination:

• Add redundant gates (cover adjacent minterms in K-map)

• Use hazard-free design techniques

• Ensure all logic paths have balanced delays

Part 3: Sequential Logic Design

3.1 Storage Elements

Sequential circuits incorporate memory elements that store state information .

Latches (Level-Sensitive) :

Flip-Flops (Edge-Triggered) :

Timing Parameters :

3.2 Finite State Machines (FSM)

FSM Types :

FSM Design Process :

1. Understand the problem and define states

2. Create state diagram

3. Create state transition table

4. State assignment (assign binary codes to states)

5. Derive next-state and output logic

6. Implement using flip-flops and gates

State Minimization :

The Implication Chart Method is used to minimize the number of states in an FSM:

1. Create a table of all state pairs

2. Mark pairs as “distinguished” if outputs differ

3. For remaining pairs, determine if next-state pairs are equivalent

4. Propagate implications until no changes occur

5. Equivalent states can be merged

State Encoding Techniques :

3.3 Registers and Counters

Registers :

Counters :

3.4 Asynchronous Sequential Logic

Asynchronous sequential circuits change state immediately when inputs change, without a clock signal .

Key Concepts :

• Fundamental mode: Only one input changes at a time

• Flow table: State transition table for asynchronous circuits

• Race conditions: Multiple state variables changing simultaneously

• Hazards: Unwanted output transitions

Design Steps:

1. Create primitive flow table

2. Reduce flow table by merging compatible states

3. Assign state variables (avoid critical races)

4. Derive excitation equations

5. Implement with feedback loops

Part 4: Hardware Description Languages (Verilog/VHDL)

4.1 Introduction to HDLs

Hardware Description Languages are used to model digital systems at various levels of abstraction. The two primary HDLs are Verilog and VHDL .

Modeling Levels :

4.2 VHDL Basics

VHDL (VHSIC Hardware Description Language) :

-- Entity declaration (interface)
entity and_gate is
    port(
        a : in std_logic;
        b : in std_logic;
        y : out std_logic
    );
end and_gate;

-- Architecture body (implementation)
architecture behavioral of and_gate is
begin
    y <= a and b;  -- concurrent signal assignment
end behavioral;

VHDL Modeling Styles :

VHDL Data Types :

4.3 Verilog Basics

Verilog HDL :

// Module declaration
module and_gate (
    input a,
    input b,
    output y
);
    assign y = a & b;  // continuous assignment
endmodule

Verilog Modeling Styles :

Verilog Data Types :

4.4 Behavioral Modeling

Processes and Always Blocks :

VHDL:

process(a, b)  -- sensitivity list
begin
    if a = '1' then
        y <= b;
    else
        y <= '0';
    end if;
end process;

Verilog:

always @(*)  // sensitivity to all inputs
begin
    if (a)
        y = b;
    else
        y = 0;
end

4.5 Testbenches

Testbenches are used to verify HDL designs through simulation :

module testbench;
    reg a, b;
    wire y;
    
    // Instantiate design under test
    and_gate uut (.a(a), .b(b), .y(y));
    
    // Apply test vectors
    initial begin
        a = 0; b = 0; #10;
        a = 0; b = 1; #10;
        a = 1; b = 0; #10;
        a = 1; b = 1; #10;
        $finish;
    end
    
    // Monitor outputs
    initial
        $monitor("Time=%0t: a=%b b=%b y=%b", $time, a, b, y);
endmodule

Part 5: Design of Datapath Controllers

5.1 Partitioned Sequential Machines

Complex digital systems are typically partitioned into a datapath (where operations are performed) and a controller (which sequences operations) .

                    ┌─────────────────────────────────────┐
                    │              Controller              │
                    │  (State Machine / Microprogram)      │
                    └───────────────┬─────────────────────┘
                                    │
                    ┌───────────────┼───────────────┐
                    │Control Signals│               │Status Signals
                    ▼               ▼               ▼
              ┌─────────────────────────────────────────┐
              │              Datapath                    │
              │  (Registers, ALU, MUXes, Buses)         │
              └─────────────────────────────────────────┘

5.2 Datapath Components

Basic Datapath Elements :

5.3 Controller Design

Types of Controllers :

RISC Processor Example :

A simple RISC processor typically includes:

• Instruction Fetch: Program Counter (PC), Instruction Memory

• Instruction Decode: Decoder, Register File access

• Execute: ALU for arithmetic/logic

• Memory Access: Data Memory

• Write Back: Result storage

5.4 UART Design Example

UART (Universal Asynchronous Receiver/Transmitter) :

UART is a classic example of a datapath controller design.

Transmitter Components:

• Baud rate generator (clock divider)

• Shift register (parallel-to-serial conversion)

• Start/stop bit insertion

• Parity generator (optional)

Receiver Components:

• Baud rate generator

• Shift register (serial-to-parallel conversion)

• Start bit detection

• Parity checking

Part 6: Programmable Logic Devices (PLDs)