A working list of the systems-security papers I keep coming back to — the ones that named a problem, shipped a defense, or changed how I look at a threat. Grouped by theme rather than by course order, with a line on why each earns its place. Read them in the original; the summaries elsewhere lose what matters.
Akritidis, Costa, Castro, Hand · 2009 · USENIX Security
A bounds-checking scheme fast and compatible enough to actually ship — the practical answer to out-of-bounds errors in C, and the backdrop for my own buffer-overflow notes.
Bittau, Belay, Mashtizadeh, Mazières, Boneh · 2014 · IEEE S&P
Builds a working stack-overflow exploit against a service with no binary and no source, defeating ASLR by crashing and observing. The paper that made me respect blind ROP.
Krohn · 2004 · USENIX ATC
Splits a web server into least-privilege processes that each hold only what they need — the cleanest illustration of privilege separation done for real throughput.
Hardy · 1988 · ACM SIGOPS OSR
Three pages that name a whole class of bug: an authorized program tricked into misusing its authority. Once you see it you find it everywhere.
Watson, Anderson, Laurie, Kennaway · 2010 · USENIX Security
Retrofits capability security onto UNIX without throwing UNIX away — the compromise design that shipped into FreeBSD.
Yee, Sehr, Dardyk, et al. · 2009 · IEEE S&P
Runs untrusted native x86 in the browser safely by validating the instruction stream — audacious, and it worked.
Zalewski · 2011 · No Starch Press
The browser security model as it actually behaves, not as the specs pretend. Same-origin, cookies, content sniffing — the messy truth.
OWASP · 2013
Not research, but the shared vocabulary for what goes wrong in web apps. Worth re-reading to keep the failure modes fresh.
Django project
How a mature framework bakes in escaping, CSRF tokens, and secure defaults — the pragmatic counterpart to the attack papers.
Cadar, Dunbar, Engler · 2008 · OSDI
Symbolic execution that finds deep bugs by treating inputs as unknowns and solving for the paths. Changed how I think about test coverage.
Chlipala · 2015 · POPL
A language where whole categories of web bugs can't be expressed. The type-system-as-security argument, taken seriously.
Bellovin · 2004 · ACSAC
The author revisits his own 1989 catalogue of protocol flaws fifteen years later — a lesson in which weaknesses persist and why.
Steiner, Neuman, Schiller · 1988 · USENIX
The ticket-based authentication design still under every enterprise you'll audit. Read the original, not the wiki summary.
Jackson, Barth · 2008 · WWW
The idea that became HSTS: let a site refuse to be downgraded out of HTTPS. Small mechanism, large payoff.
Brumley, Boneh · 2003 · USENIX Security
Recovers an RSA private key over a network just by timing responses. The paper that retired 'the network hides the timing.'
Fu · 2011 · IOM
Security when the failure mode is a patient, not a data breach. Reframes the whole risk conversation.
Bonneau, Herley, van Oorschot, Stajano · 2012 · IEEE S&P
A ruthless comparative framework scoring every password alternative on usability, deployability, and security. Explains why passwords won't die.
Aggarwal, Bursztein, Jackson, Boneh · 2010 · USENIX Security
Measures what 'incognito' actually protects against — usually less than users assume, and against a different adversary than they think.
Dingledine, Mathewson, Syverson · 2004 · USENIX Security
The design of the anonymity network everyone cites and few have read. Threat model, tradeoffs, and why low-latency anonymity is hard.
Enck, Ongtang, McDaniel · 2009 · IEEE S&P
The permission-and-intent model that defines the Android attack surface. Foundation for everything mobile that follows.
Enck, Gilbert, Chun, et al. · 2010 · OSDI
Follows tagged sensitive data as it flows through apps and out to the network — dynamic taint tracking made to run on a phone.
Levchenko, Pitsillidis, et al. · 2011 · IEEE S&P
Follows the money end-to-end through the spam economy and finds the payment bottleneck. Security as economics, brilliantly.