Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, and Stefan Savage, Comprehensive Experimental Analyses of Automotive Attack Surfaces, IEEE Security and Privacy, 2010.

Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, Franziska Roesner, Tadayoshi Kohno, Comprehensive Experimental Analyses of Automotive Attack Surfaces , USENIX Security, 2011.

Beware of Finer-Grained Origins
Collin Jackson and Adam Barth
In Proc. W2SP 2008

Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense
Adam Barth, Joel Weinberger, and Dawn Song
In Proc. Usenix Security 2009

Abadi, Budiu, Erlingsson and Ligatti, Control-Flow Integrity, CCS 2005.
Ratanaworbhan, Livshits and Zorn, NOZZLE: A Defense Against Heap-spraying Code Injection Attacks", USENIX Security 2009.

Shacham, The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86), CCS 2007.
Daniel, Honoroff and Miller, Engineering Heap OVerflow Exploits with Javascript

You can join a class mailing list by registering here.

Rescorla, Is Finding Security Holes a Good Idea?, WEIS 2004.
Ozment and Schecter, Milk or Wine: Does Software Security Improve with Age?, USENIX Security 2008.

Avgerinos, Cha, Hao and Brumley, AEG: Automatic Exploit Generation, NDSS 2011.
Costa, Crowcroft, Castro, Rowstron, Zhou, Zhang and Barham, Vigilante: End-to-End Containment of Internet Worms, SOSP 2005.

Barth, Jackson, Reis, Google, The Security Architecture of the Chromium Browser, Technical report, 2008.

Whitten et al, Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0, USENIX Security 1999.

Dhamija et al, Why Phishing Works, CHI 2006.

Schecter et al, The Emperor's New Security Indicators, IEEE Security and Privacy (Oakland), 2007.

(optional) Finn and Jakobsson, Dsigning and Conducting Phishing Experiments, IEEE Technology and Society Magazine, 2007.

(optional) Anandpara et al, Phishing IQ Tests Measure Fear, Not Ability, Usability Security 2007.

Levchenko et al, Click Trajectories: End-to-end Analysis of the Spam Value Chain, IEEE Security and Privacy, 2011.

Stone-Gross et al. The Underground Economy of Fake Antivirus Software, WEIS 2011.

Halderman et al, Lest we Remember: Cold Boot Attacks on Encryption Keys, USENIX Security 2008.

Provos and Honeyman, Hide and Seek: An Introduction to Steganography, IEEE Security and Privacy magazine 2003.

Jang, Jhala, Lerner and Schacham, An Empirical Study of Privacy-Violating Information Flows in Javascript Web Applications, CCS 2010.

Strictly optional:
Mayer, Tracking the Trackers: Where Everyobody Knows Your Username, Stanford CIS blog, 2011. Enck et al. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, OSDI 2010. (only need to read section 6 for privacy findings)