RYAN KOVATCH
Web Application Security Specialist
Hi! I'm a cybersecurity specialist with a focus on web application and API security. I recently graduated with an MS in Computer Science from the University of Oregon, where I did cryptographic protocol design and research. My accomplishments in bug bounty helped pay for my education.
Google VRP
TOP 10%
Awards
$30K+
Critical Vulns
10+
VULNERABILITY RESEARCH
I’m proud to participate in the Google Bug Hunters Program, which has led the industry in supporting independent security researchers for many years.
Uploading a youtube video to anyone's channel
A logic bug in the YouTube Video Builder API allowed video uploads to any channel without owner authorization. Further investigation uncovered a bonus information leak. Read the writeup on Medium or the original report on Bug Hunters.
PROJECTS
The Teaching Security Operations Center (TSOC) at the University of Oregon immerses students in a real-world, fully operational SOC, where they rotate through critical roles and gain practical expertise in defending against today’s evolving cyber threats. Throughout grad school, I worked with the lead engineer to build out the TSOC’s internal infrastructure. They now enjoy a fully fleshed-out system of industry-standard security platforms and tools.
A new encryption scheme called registration-based encryption (RBE), developed within the last decade, allows for the binding of public keys to identities without certificates. This presents a new avenue for avoiding the traditional pitfalls of public-key infrastructure. My Master's thesis aimed to evaluate whether present RBE constructions could be applied to Internet protocols at scale. This included producing a proof-of-concept encrypted DNS protocol called ReDNS -- the first of its kind.
CONTACT
I'm always interested in new research opportunities, collaborations, or just talking shop. Looking forward to hearing from you.