Projects
Blockchain Security
Blockchain applications hold real money in publicly visible code. Every vulnerability is a potential heist, and attackers are watching 24/7. I work in this space to find these bugs before they do. Below are some vulnerabilities and articles that I've written about:
Spokane Cyber Cup
As a senior in college, I created the Spokane Cyber Cup in order to aid in the learning of the local students in the Spokane, WA area. The original event included over 60 students from 6 different colleges and 3 high schools, along with 15+ coaches that helped the students on challenges and 2 speakers. We have now run the event multiple times and it continues to grow each year.
The whole purpose of the event is to allow students to learn in a fun environment, while showing them potential paths for the future. Links to the event information including challenges, solutions, pictures and other things can be found below in the 'Read More' tab. Major shoutout to all of the coaches and people who contributed to the event.
Wireless Hacking
Signals are all around us, yet no one notices. Garage doors, car key fobs... everywhere. Since consumer devices utilizing the radio spectrum are everywhere, I have dedicated time to getting my HAM radio devices and analyzing these devices. From garage door openers, to RC cars to scoreboards, it only gets more interesting from there!
Heap Exploitation Workshop and Content
Heap exploitation feels like a dark art in the realm of binary exploitation. Because of the incredible complexity of this art, I made it my mission to understand it and further everyone else's understanding alongside it.
I created a workshop/training for GLibC Malloc heap exploitation that was taught at DEFCON 29, ToorCon, CanSecWest, and Hackfest. The full training is available as a video series on YouTube. This blog has several articles on heap exploitation such as the House of Muney, GLibc 2.32 New Malloc Protections and many others (see more below). I've also posted many proof of concepts to the how2heap repository as well.
CVE's (5) on Zyxel NAS 326
After purchasing the NAS as a senior in college and doing a fairly extensive security review, I found several vulnerabilities on the device, including a very unique remote code execution bug. The research on this device was eventually presented at DEFCONs IoT Village in 2019 at DEFCON 27. For a full blog post discussing these vulnerabilities and a full methodology on how it was found, please refer to this link.
Web Application Miscellaneous
As a Security Engineer/consultant, my primary job is testing for the security of web applications. Over the years, I have published a fair amount of articles that are about particular web application hacking such as Password Reset Functionality or research into how they work. Below are some more of these articles about this:
Probabilistic Syllabifier
This project is dedicated to transferring words into their corresponding syllables, across languages. The results were fantastic, reporting the 2nd best results on English at 98.5%, the best on Dutch (99.47%), Italian (99.99%), French (99.98%) and Basque (99.83%). Our work has been published by ACM at the GECCO 2018 conference and ICMLA 2019.
