A List of Interesting Computer Security Papers
Maintained by Daoyuan Wu, since 10 Nov 2014.
This page records a list of interesting computer security papers.
I built it for guiding my own research. Of course, I will be happy if you also feel it is helpful.
They are selected according to my personal tastes, and biased towards what I have read and my interested topics.
It is worth noting that the listed papers have no particular orders. Please email me if you have any questions or suggestions (e.g., recommend a good paper to be listed here).
Security analysis
- UsenixSec05:Non-Control-Data Attacks Are Realistic Threats.
- CCS07:An Analysis of Browser Domain-Isolation Bugs and A Light-Weight Transparent Defense Mechanism.
- UsenixSec08:An Empirical Security Study of the Native Code in the JDK.
- MobiSys09:Attacks on Public WLAN-based Positioning Systems.
- EuroSys10:Residue Objects: A Challenge to Web Browser Security.
- Oakland11:How to Shop for Free Online: Security Analysis of Cashier-as-a-Service Based Web Stores.
- UsenixSec11:A Study of Android Application Security.
- MobiSys11:Analyzing Inter-Application Communication in Android.
- Oakland12:Signing Me onto Your Accounts through Facebook and Google: a Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services.
- Oakland12:Abusing File Processing in Malware Detectors for Fun and Profit.
- NDSS13:The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites.
- NDSS13:Comparing Mobile Privacy Protection through Cross-Platform Applications.
- CCS13:Unauthorized Origin Crossing on Mobile Platforms: Threats and Mitigation.
- NDSS14:Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks.
- NDSS14:From Very Weak to Very Strong: Analyzing Password-Strength Meters.
- Oakland14:Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating.
- Oakland14:The Peril of Fragmentation: Security Hazards in Android Device Driver Customizations.
- UsenixSec14:Password Managers: Attacks and Defenses.
- CCS14:Mayhem in the Push Clouds: Understanding and Mitigating Security Hazards in Mobile Push-Messaging Services.
- CCS14:A11y Attacks: Exploiting Accessibility in Operating Systems.
New attacks
- CCS07:The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86).
- UsenixSec08:Lest We Remember: Cold Boot Attacks on Encryption Keys.
- UsenixSec13:Jekyll on iOS: When Benign Apps Become Evil.
- Oakland14:Hacking Blind.
- Oakland14:All Your Screens are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API.
- UsenixSec14:Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks.
- CCS14:Be Aware, Your Hands Reveal Your Secrets.
- NDSS14:Gaining Control of Cellular Traffic Accounting by Spurious TCP Retransmission.
Side channels
- CCS00:Timing Attacks on Web Privacy.
- CCS09:Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds.
- Oakland12:Memento: Learning Secrets from Process Footprints.
- CCS14:Information Leaks Without Memory Disclosures: Remote Side Channel Attacks on Diversified Code.
Breaking protection
- Oakland13:The Parrot is Dead: Observing Unobservable Network Communications.
- UsenixSec13:Steal This Movie - Automatically Bypassing DRM Protection in Streaming Media Services.
- Oakland14:From Zygote to Morula: Fortifying Weakened ASLR on Android.
Security measurement
- UsenixSec12:Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices.
- IMC12:Detecting Prefix Hijackings in the Internet with Argus.
Perspective thoughts
- Oakland12:User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems.
- Oakland13:A Scanner Darkly: Protecting User Privacy From Perceptual Applications.
- Oakland13:PrivExec: Private Execution as an Operating System Service.
- CCS13:Content-Based Isolation: Rethinking Isolation Policy Design on Client Systems.
- UsenixSec14:Mimesis Aegis: A Mimicry Privacy Shield–A System’s Approach to Data Privacy on Public Cloud.
- CCS14:World-Driven Access Control for Continuous Sensing.
Great detection
- OSDI08:KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs.
- Oakland10:TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection.
- OSDI12:Improving Integer Security for Systems with KINT.
- CCS12:CHEX: Statically Vetting Android Apps for Component Hijacking Vulnerabilities.
- UsenixSec13:Effective Inter-Component Communication Mapping in Android with Epicc: An Essential Step Towards Holistic Security Analysis.
- CCS13:FPDetective: Dusting the Web for Fingerprinters.
- NDSS14:AppSealer: Automatic Generation of Vulnerability-Specific Patches for Preventing Component Hijacking Attacks in Android Applications.
Powerful systems
- OSDI10:TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones.
- ATC12:AddressSanitizer: A Fast Address Sanity Checker.
- UsenixSec12:DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis.
- NDSS13:Security Enhanced (SE) Android: Bringing Flexible MAC to Android.
- UsenixSec13:ZMap: Fast Internet-wide Scanning and Its Security Applications.
- OSDI14:Protecting Users by Confining JavaScript with COWL.
Knowledgeable papers
- DSN05:Defeating Memory Corruption Attacks via Pointer Taintedness Detection.
- APSys11:Linux kernel vulnerabilities: State-of-the-art defenses and open problems.
- Oakland12:Dissecting Android Malware: Characterization and Evolution.
- APSys13:Security bugs in embedded interpreters.
Security ideas
- MobiCom13:Secure Unlocking of Mobile Touch Screen Devices by Simple Gestures – You can see it but you can not do it.