10 papers
FuzzingDriver: the Missing Dictionary to Increase Code Coverage in Fuzzers
Arash Ale Ebrahim, Mohammadreza Hazhirpasand, Oscar Nierstrasz +1
We propose a tool, called FuzzingDriver, to generate dictionary tokens for coverage-based greybox fuzzers (CGF) from the codebase of any target program. FuzzingDriver does not add…
Cryptography Vulnerabilities on HackerOne
Mohammadreza Hazhirpasand, Mohammad Ghafari
Previous studies have shown that cryptography is hard for developers to use and misusing cryptography leads to severe security vulnerabilities. We studied relevant vulnerability re…
Dazed and Confused: What's Wrong with Crypto Libraries?
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into…
Crypto Experts Advise What They Adopt
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
Previous studies have shown that developers regularly seek advice on online forums to resolve their cryptography issues. We investigated whether users who are active in cryptograph…
Worrisome Patterns in Developers: A Survey in Cryptography
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
We surveyed 97 developers who had used cryptography in open-source projects, in the hope of identifying developer security and cryptography practices. We asked them about individua…
Hurdles for Developers in Cryptography
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammadhossein Shabani +1
Prior research has shown that cryptography is hard to use for developers. We aim to understand what cryptography issues developers face in practice. We clustered 91954 cryptography…
Java Cryptography Uses in the Wild
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
[Background] Previous research has shown that developers commonly misuse cryptography APIs. [Aim] We have conducted an exploratory study to find out how crypto APIs are used in ope…
Tricking Johnny into Granting Web Permissions
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
We studied the web permission API dialog box in popular mobile and desktop browsers, and found that it typically lacks measures to protect users from unwittingly granting web permi…
CryptoExplorer: An Interactive Web Platform Supporting Secure Use of Cryptography APIs
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
Research has shown that cryptographic APIs are hard to use. Consequently, developers resort to using code examples available in online information sources that are often not secure…
The Impact of Developer Experience in Using Java Cryptography
Mohammadreza Hazhirpasand, Mohammad Ghafari, Stefan Krüger +2
Previous research has shown that crypto APIs are hard for developers to understand and difficult for them to use. They consequently rely on unvalidated boilerplate code from online…