Cryptography Vulnerabilities on HackerOne

Hazhirpasand, Mohammadreza; Ghafari, Mohammad (December 2021). Cryptography Vulnerabilities on HackerOne. In: 21st IEEE International Conference on Software Quality, Reliability, and Security (QRS). 10.1109/QRS54544.2021.00013

Text Hazh21f.pdf - Accepted Version Restricted to registered users only Available under License Publisher holds Copyright. Download (190kB)

Previous studies have shown that cryptography is hard for developers to use and misusing cryptography leads to severe security vulnerabilities. We studied relevant vulnerability reports on the HackerOne bug bounty platform to understand what types of cryptography vulnerabilities exist in the wild. We extracted eight themes of vulnerabilities from the vulnerability reports and discussed their real-world implications and mitigation strategies. We hope that our findings alert developers, familiarize them with the dire consequences of cryptography misuses, and support them in avoiding such mistakes.

Interest & Impact

Downloads

1 since deposited on 27 Apr 2022
0 in the past 12 months

Citations

5 Citations in Web of Science ®
6 Citations in Scopus

Search

in Google Scholar™

Services

Actions (login required)

Edit item

Actions (login required)

Edit item