A collection of important security related papers worth a read.
Papers involve topics ranging from web,privacy and systems security.
Reining in the Web with Content Security Policy
https://research.sidstamm.com/papers/csp-www2010.pdf
Online Tracking:A 1-million-site Measurement and Analysis
https://www.cs.princeton.edu/~arvindn/publications/OpenWPM_1_million_site_tracking_measurement.pdf
Most Websites Donât Need to Vibrate:A CostâBenefit Approach to Improving Browser Security
https://arxiv.org/pdf/1708.08510.pdf
Protecting Browser State from Web Privacy Attacks
https://crypto.stanford.edu/safecache/sameorigin.pdf
The Geometry of Innocent Flesh on the Bone:Return-into-libc without Function Calls (on the x86)
https://hovav.net/ucsd/dist/geometry.pdf
Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness
https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_akhawe.pdf
Cross-Origin JavaScript Capability Leaks:Detection, Exploitation, and Defense
https://www.adambarth.com/papers/2009/barth-weinberger-song.pdf
The Emperorâs New Security IndicatorsAn evaluation of website authenticationand the effect of role playing on usability studies
http://www.usablesecurity.org/emperor/emperor.pdf
An Evaluation of Extended Validation andPicture-in-Picture Phishing Attacks
http://www.usablesecurity.org/papers/jackson.pdf
âIf HTTPS Were Secure, I Wouldnât Need 2FAâ-End User and Administrator Mental Models of HTTPS"
https://publications.sba-research.org/publications/2019-Pfeffer-HTTPS_Mental_Models.pdf
The Webâs Identity Crisis:Understanding the Effectiveness of Website Identity Indicators
https://storage.googleapis.com/pub-tools-public-publication-data/pdf/400599205ab5a1c9efa03e2a7c127eb8200bf288.pdf
The End is Nigh: Generic Solving of Text-based CAPTCHAs
https://www.usenix.org/system/files/conference/woot14/woot14-bursztein.pdf
Recognizing Objects in Adversarial Clutter:Breaking a Visual CAPTCHA
https://www2.eecs.berkeley.edu/Research/Projects/CS/vision/shape/mori-gimpy.pdf
Fantastic Timers and Where to Find Them:High-Resolution MicroarchitecturalAttacks in JavaScript
https://gruss.cc/files/fantastictimers.pdf
Protecting Browsers from DNS Rebinding Attacks
https://crypto.stanford.edu/dns/dns-rebinding.pdf
Timeless Timing Attacks:Exploiting Concurrency to Leak Secrets over Remote Connection
https://tom.vg/papers/timeless-timing-attack_usenix2020.pdf
The Security Architecture of the Chromium Browser
https://seclab.stanford.edu/websec/chromium/chromium-security-architecture.pdf
Security vulnerabilities in modern web browser architecture
https://www.researchgate.net/publication/224163004_Security_vulnerabilities_in_modern_web_browser_architecture
CSP Is Dead, Long Live CSP! On the Insecurity ofWhitelists and the Future of Content Security Policy
https://storage.googleapis.com/pub-tools-public-publication-data/pdf/45542.pdf
Signing Me onto Your Accounts through Facebook and Google: a Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services
https://www.microsoft.com/en-us/research/wp-content/uploads/2012/05/websso-final.pdf
Re: CAPTCHAs â Understanding CAPTCHA-Solving Services in anEconomic Context
https://www.cs.uic.edu/pub/Kanich/Publications/re.captchas.pdf
A Real-World Analysis of Kerberos Password Security
http://www.gnu.org/software/shishi/wu99realworld.pdf
The science of guessing: analyzing an anonymized corpus of 70 million passwords
http://www.jbonneau.com/doc/B12-IEEESP-analyzing_70M_anonymized_passwords.pdf
The quest to replace passwords:a framework forcomparative evaluation ofWeb authentication schemes
https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-817.pdf
Microsoft Password Guidance
https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defenseagainst Out-of-Bounds Errors
https://css.csail.mit.edu/6.858/2020/readings/baggy.pdf
https://css.csail.mit.edu/6.858/2014/readings/brop.pdf
Heap Bounds Protection with Low Fat Pointersâ
https://www.comp.nus.edu.sg/~gregory/papers/cc16lowfatptrs.pdf
Building Secure High-Performance Web Services with OKWS
https://css.csail.mit.edu/6.858/2020/readings/okws.pdf
Komodo: Using verification to disentanglesecure-enclave hardware from software
https://css.csail.mit.edu/6.858/2020/readings/komodo.pdf
Innovative Instructions and Software Model for Isolated Execution
https://software.intel.com/sites/default/files/article/413936/hasp-2013-innovative-instructions-and-software-model-for-isolated-execution.pdf
Iago Attacks: Why the System CallAPI is a Bad Untrusted RPC Interface
https://hovav.net/ucsd/dist/iago.pdf
Rethinking the Library OS from the Top Down
https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/asplos2011-drawbridge.pdf
Software Grand Exposure: SGX Cache Attacks Are Practical
https://www.usenix.org/system/files/conference/woot17/woot17-paper-brasser.pdf
Controlled-Channel Attacks: Deterministic SideChannels for Untrusted Operating Systems
https://www.ieee-security.org/TC/SP2015/papers-archived/6949a640.pdf
https://eprint.iacr.org/2016/086.pdf
Practical Enclave Malware with Intel SGX
https://regmedia.co.uk/2019/02/12/sgxmalware.pdf
https://css.csail.mit.edu/6.858/2020/readings/ios-security-may19.pdf
The Android Platform Security Model
https://css.csail.mit.edu/6.858/2020/readings/android-platform.pdf
RIDL: Rogue In-Flight Data Load
https://mdsattacks.com/files/ridl.pdf
EXE: Automatically Generating Inputs of Death
https://css.csail.mit.edu/6.858/2020/readings/exe.pdf
A Look Back at Security Problems in the TCP/IP Protocol Suite
https://css.csail.mit.edu/6.858/2020/readings/lookback-tcpip.pdf
The first collision for full SHA-1
https://shattered.io/static/shattered.pdf
A Meaningful MD5 Hash Collision Attack
https://scholarworks.sjsu.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1020&context=etd_projects
International Journal of PoCâGTFOIssue 0x00, a CFP with PoC
https://www.alchemistowl.org/pocorgtfo/pocorgtfo00.pdf
Tales of FAVICONS and Caches:Persistent Tracking in Modern Browsers
https://www.cs.uic.edu/~polakis/papers/solomos-ndss21.pdf
SapFix: Automated End-to-End Repair at Scale
https://web.eecs.umich.edu/~weimerw/481/readings/SapFix-Automated-End-to-End-Repair-at-Scale-v2.pdf
NPEfix: Automatic Runtime Repair of Null Pointer Exceptions in Java
https://arxiv.org/pdf/1512.07423.pdf