Later archive addition

The Most Dangerous Code in the World

Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh and Vitaly Shmatikov

Black-box fuzzing with self-signed and mismatched-name certificates, plus source and decompiler review, showed SSL certificate validation is broken across non-browser software: Amazon and PayPal merchant SDKs, EC2 and Rackspace cloud clients, Chase mobile banking, Apache Axis and XFire middleware, and shopping carts.

Record

Researcher

Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh and Vitaly Shmatikov

Format

Whitepaper

In the archive

• Added to the 2012 archive after the original list was published

Tags

• tls
• https
• java
• php
• python
• android
• measurement-study
• fuzzing
• mitigation
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh and Vitaly Shmatikov, first published at the original source. Preserved copies are kept so the citation survives its host.