Projects
Blockchain Security
Imagine if every application you looked at as an attacker was a bank where all functionality was exposed where everyone is anonymous. This is what blockchain security feels like. Every little thing turns into huge impact. The game behind trying to secure this is unlike anything we've every seen.
I'm tired of seeing the multi-million dollar hacks and people losing their money. So, it's time to do something about it. I'm working on my skillset for web3 to make it a more secure place. On top of this, the problems and technologies are fascinating to understand and play with.
Heap Exploitation Workshop and Content
Heap exploitation feels like dark art in the realm of binary exploitation. Because of the incredible complexity of this art, I have made it my mission to understand it and further other everyone elses understanding alongside it.
As a result, I created a workshop/training for GLibC Malloc heap exploitation. This was recently taught at DEFCON 29, ToorCon and CanSecWest with great success and we plan on teaching at other cons or companies as well. This blog has several articles on heap exploitation such as the House of Muney, GLibc 2.32 New Malloc Protections and many others (see more below). I've also posted many proof of concepts to the how2heap repository as well.
Wireless Hacking
Signals are all around us, yet no one notices. Garage doors, car key fobs... everywhere. Since consumer devices utilizing the radio spectrum are everywhere, I have dedicated time to getting my HAM radio devices and analyzing these devices. From garage door openers, to RC cars to scoreboards, it only gets more interesting from there!
CVE's (5) on Zyxel NAS 326
After purchasing the NAS as a senior in college and doing a fairly extensive security review, I found several major vulnerabilities on the device, including a very unique remote code execution bug. The research on this device was eventually presented at DEFCONs IoT Village in 2019 at DEFCON 27. For a full blog post discussing these vulnerabilities and a full methodology on how it was found, please refer to this link.
Web Application Miscellaneous
As a Security Engineer/consultant, my primary job is testing for the security of web applications. Over the years, I have published a fair amount of articles that are about particular web application hacking such as Password Reset Functionality or research into how they work. Below are some more of these articles about this:
Spokane Cyber Cup
As a senior in college, I created the Spokane Cyber Cup in order to aid in the learning of the local students in the Spokane, WA area. The originally event included over 60 students from 6 different colleges and 3 high schools, along with 15+ coaches that helped the students on challenges and 2 speakers. The event had 25 wargame challenges, as well as an attack/defense section as well. The second event has had 40 wargame, 6 colleges, 2 high schools and was a major success. We are hoping to make this an annual event in the Spokane area.
The whole purpose of the event was to allow the students to learn in a fun environment, while showing them potential paths for the future. Links to the event information including challenges, solutions, pictures and other things can be found below in the 'Read More' tab. Major Shoutout to all of the coaches and people who contributed to the event.
Probabilistic Syllabifier:
This project dedicated to transferring words into its corresponding syllables, across languages. The results were fantastic, reporting the 2nd best results on English at 98.5%, the best on Dutch (99.47%), Italian (99.99%), French (99.98%) and Basque(99.83). Our work has been published by ACM at the GECCO 2018 conference and ICMLA 2019.
Info:
If anybody has any questions about my projects here, please feel free to ask. I love discussing all of the projects, helping people out on there own projects and practically anything else! My email, twitter and Github are all below in the footer below.
