PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking Crypto Part IV: Web and mobile applications

bugcrowd.com | blog | #ai-security | #web-security | #cryptography | #mobile-security | #jwt | #padding-oracle | #iv | #hardcoded-keys
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The final Hacking Cryptography installment covers JWT signature flaws, weak token and key generation, hardcoded keys, padding oracles, and improper IV use in web and mobile apps.
Published
Collected

Related coverage

blog · vercel.com
The three types of AI bot traffic and how to handle them
Bots account for over 20% of all web traffic. A quarter of that is AI crawlers alone. But not all bots are bad. Some are key to how your site gets discovered. Learn how AI bots shape visibility and what happens if you block them.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
blog · bugcrowd.com
Hacking crypto Part III: Hardware
Nerdwell's hardware guide covers five high-impact attack vectors: side-channel analysis, hardcoded keys, unprotected debug interfaces, missing cryptographic authentication, and fault injection.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · blog.trailofbits.com
Friends don’t let friends reuse IVs
Trail of Bits recounts a subtle crypto bug: parties in a threshold signature scheme never reused nonces, but identical nonce sequences across senders collided, enabling tampering and framing attacks.
Back