39:51This recording is not available yet.
Hacker-Powered Data: The Most Common Security Weaknesses and How to Avoid Them
Download resourcesCategories
About this session
Miju Han, a product management director at HackerOne, uses eight years of bug bounty data (2,000 programs, 180,000 valid vulnerabilities, 100 million dollars in bounties) to argue that security teams should prioritise by what hackers actually find and what companies actually pay for. She walks through the HackerOne Top 10, led by cross-site scripting at nearly thirty percent of payouts, and shows with two real Shopify reports that vulnerability type alone is a poor guide: a self-XSS earned 500 dollars while a stored XSS earned 3,000, because stored XSS is rarer, harder to find and higher impact. She reframes risk as likelihood times impact, using report counts as a proxy for discoverability and bounty size as a proxy for how much companies value a bug. Comparing her list to the OWASP Top 10, she finds heavy overlap but sharp differences (XSS is number one for her but number seven for OWASP; XXE ranks high for OWASP but is rare in real reports). She casts OWASP as an editorial list, like the Oscars, against HackerOne's box-office list, and warns that people use it as a security ceiling when it is a floor with declining coverage.
As software dependence grows and data volumes swell to new highs, security teams often see a deluge of incoming vulnerabilities from scanners, pen tests, and bug bounty programs. Using eight years of never before seen data from 1,800+ bug bounty programs and over 160,000 valid vulnerabilities found, this talk offers a focus for security teams based on analysis of what hackers actually exploit in the wild and what companies actually value. Attendees will discover common weaknesses such as Violation of Secure Design Principles, Information Disclosure, Denial of Service, VPN and Cryptographic Issues, and how attackers could exploit these prevalent vulnerabilities. Walk away with insights into the most common security weaknesses to better defend against them.
Key takeaways
- Prioritise vulnerabilities by risk as likelihood times impact, not by weakness type alone; a stored XSS and a self-XSS share a category but differ hugely in exploitability and payout.
- Use real-world signals to rank work: report counts approximate how discoverable a bug is to a human, and bounty sizes approximate how much companies value fixing it.
- Use the OWASP Top 10 for developer awareness and conversation, not as your security coverage target; it now covers under half of what hackers actually report and is shrinking.
- Do not write off cross-site scripting as noise; it pays both beginner and top hackers the most and stays high or critical when stored.
- Win developer buy-in by pairing each finding with concrete impact and context ('highly exploitable in production, gives full access to PII') rather than a bare 'patch this now'.
Speakers
Miju Han
Miju Han is the Director of Product Management at HackerOne, where she leads a team of product managers, data scientists, and engineers to build and launch practical and actionable tooling for security teams. With a background in both data and… Read moreRead less
Miju Han is the Director of Product Management at HackerOne, where she leads a team of product managers, data scientists, and engineers to build and launch practical and actionable tooling for security teams. With a background in both data and security, Miju has a keen eye for spotting increased efficiency and automation in modern security practices. Miju previously served as a Director of Product at GitHub, where she pitched and launched security alerts on top of the dependency graph, one of the first large-scale efforts to embed security best practices into core development tooling. GitHub’s security alerts won a 2018 technology of the year award from InfoWorld, and more importantly, have lead to the patching of almost ten million vulnerabilities. Miju began her career working on data science at content platforms such as YouTube, Beats Music/Apple, and TuneIn. Outside of work, she is an avid painter and competitive powerlifter. She has previously spoken at QCon and Looker JOIN. She keynoted GitHub Universe in 2017.
