Antonios Atlasis (PhD) is a Senior Cyber Security Professional and Researcher currently working for the European Space Agency (ESA). Dr. Atlasis, with over 18 years of hands-on experience in the field and frequent presenter at security conferences, has a special interest in the security analysis of modern network protocols in particular and new security technologies in general.
Rodrigo Rubira Branco (BSDaemon) works as Principal Security Researcher at Intel Corporation in the Security Center of Excellence where he leads the Core Client, BIOS and IoT SoC Teams. Rodrigo released dozens of vulnerabilities in many important software in the past. In 2011 he was honored as one of the top contributors of Adobe. He is a member of the RISE Security Group and is the organizer of Hackers to Hackers Conference (H2HC), the oldest security research conference in Latin America. He is an active contributor to open-source projects (like ebizzy, linux kernel, others). Accepted speaker in lots of security and open-source related events as Black Hat, Hack in The Box, XCon, OLS, Defcon, Hackito, Zero Nights, Troopers and many others.
John Carroll (@n0x00) is an independent Information Security advisor and 'anti-stupid' gun-for-hire operating out of ctus.io, usually residing in financial, fin-tech and fashion spaces. A former penetration tester and security researcher, his interests span operational risk, attack simulations, the 'hacker MO', bug-hunting and all-things-tech. John is a prolific community contributor, having run workshops for: B-Sides, Steelcon and a range of industry groups.
Katriel Cohn-Gordon is a PhD student in information security and applied cryptography at the University of Oxford. His research aims to formalize and prove the security of some of the protocols underlying today's Internet; recent work includes a formal analysis of the Signal messaging protocol used by WhatsApp and many others. He's also been seen writing fuzzers for WebRTC at Google's Stockholm office. He holds a master's degree in mathematics and computer science, and has reviewed papers for various top academic conferences.
Sharon Conheady is the director of First Defence Information Security and a founding member of The Risk Avengers. She specialises in the human side of security and has social engineered her way into dozens of organisations across the UK and abroad, including company offices, sports stadiums, government facilities and more. Sharon has presented at security conferences including DEF CON social engineering village, Deepsec, Recon, CONFidence and InfoSec. She is the author of Social Engineering in IT Security: Tools, Tactics, and Techniques published by McGraw-Hill.
Daniel Cuthbert is the Global Head of Security Research for Banco Santander. With a career spanning over 20 years on both the offensive and defensive side, he's seen the evolution of hacking from a small groups of curious minds to organized criminal networks and nation state we see today. He is the original co-author of the OWASP Testing Guide, released in 2003 and now the co-author of the OWASP Application Security Verification Standard (ASVS).
Matt Devost is a technologist, entrepreneur, and international security expert specializing in counterterrorism, critical infrastructure protection, intelligence, risk management and cybersecurity issues.
Currently, Mr. Devost is President & CEO of FusionX, LLC, a cybersecurity consultancy that helps international corporations identify and manage dynamic threats in complex operational environments. Additionally, Mr. Devost has been an Adjunct Professor at Georgetown University since 2002 where he teaches a graduate course on Information Warfare and security, and is a Founding Director of the Cyberconflict Studies Association. Mr. Devost founded the Terrorism Research Center, Inc. (TRC) in 1996, where he served as President and CEO until November 2008. As founder and President, Mr. Devost oversaw all research, analysis, intelligence, assessment, and training programs. Previously, Mr. Devost held leadership positions at iSIGHT Partners, Technical Defense, Security Design International, iDEFENSE and SAIC. Mr. Devost has been a speaker at hundreds of international conferences and a contributor/author to several books on terrorism and information security.
Mark Dowd is an expert in application security, specializing primarily in host and server based Operating Systems. He is currently the director of Azimuth Security, a botique security company he founded that specializes in code review and cutting edge security research. Prior to starting Azimuth, his professional experience includes several years as a senior researcher at a fortune 500 company, where he uncovered a variety of major vulnerabilities in ubiquitous Internet software. He also worked as a Principal Security Architect for McAfee, where he was responsible for internal code audits, secure programming classes, and undertaking new security initiatives. Mark has also co-authored a book on the subject of application security named "The Art of Software Security Assessment," and has spoken at several industry-recognized conferences.
Eric Evenchick has worked in development and reverse engineering roles for hardware and software companies for the past eight years. He has specialized in embedded devices, automotive systems, and bespoke tool development. He is currently a Senior Research Consultant at Atredis Partners.
Eric's work with embedded systems began with development of research vehicles at the University of Waterloo, in partnership with General Motors and the US Environmental Protection Agency. This experience lead to roles in developing automotive firmware and reverse engineering vehicle systems at companies including Tesla Motors and Faraday Future.
In 2014, Eric founded Linklayer Labs, which provided consulting services and developed open source hardware tools for the information security community. Since 2012, he has been a contributor to Hackaday, a blog covering hardware and software "hacks".
Leigh-Anne Galloway is a Security Researcher who specializes in application security and payment security. Leigh-Anne started her career in incident response, leading investigations into payment card data breaches. Which is where she discovered her passion for payment technology. She has presented and authored research on ATM security, mPOS vulnerabilities, NFC payments and application security. She has previously spoken at DevSecCon, BSides, Hacktivity, 8dot8, OWASP, Ekoparty, Troopers, DEF CON and Black Hat USA.
Nathan Hamiel is the Director of Research & Advisory Services at Kudelski Security, an international security company providing innovative and tailored solutions to enterprises and public-sector clients. Nathan works in the innovation group defining the future of services and products for the company. A security veteran with a strong focus on software security, he has spent his nearly 20-year career helping customers around the world solve complex security challenges.
Nathan has presented his research at global security events including Black Hat, DEF CON, HOPE, ShmooCon, SecTor, ToorCon and many others. He is also a member of the Black Hat review board where he evaluates research for inclusion into the various conferences around the world.
Twitter: @nathanhamiel
Robert Hansen is the Vice President of WhiteHat Labs at WhiteHat Security. He's the former Chief Executive of SecTheory and Falling Rock Networks which focused on building a hardened OS. Mr. Hansen began his career in banner click fraud detection at ValueClick. Mr. Hansen has worked for Cable & Wireless doing managed security services, and eBay as a Sr. Global Product Manager of Trust and Safety. Mr. Hansen contributes to and sits on the board of several startup companies. Mr. Hansen has co-authored "XSS Exploits" by Syngress publishing and wrote the eBook, "Detecting Malice." Robert is a member of WASC, APWG, IACSP, ISSA, APWG and contributed to several OWASP projects, including originating the XSS Cheat Sheet. He is also a mentor at TechStars. His passion is breaking web technologies to make them better.
Jeff Horne is currently the Senior Director of Information Security at SpaceX. Jeff is an accomplished security professional with over 16 years in reverse engineering, vulnerability assessment, antivirus engine creation, incident response, and malware research experience. Prior to SpaceX Jeff was the Vice President of R+D and Chief Architect with Accuvant LABS where he oversaw teams of researchers specializing in malicious code, incident response, breach analysis, and vulnerability assessment. Prior to Accuvant LABS, Jeff pursued a variety of roles in research and software engineering at other major security companies. Jeff worked as a Vulnerability Researcher at Internet Security Systems, where he was responsible for vulnerability discovery, exploit creation, IDS evasion research, and behavioral detection of malware. At Webroot Software, Jeff was the Director of Threat Research where he led several teams of malware researchers, reverse engineers, and a development organization specializing in creating anti malware functionality and signatures for all Webroot products. Jeff is well known for his insight in interviews for numerous news channels and publications, speaking roles at various security conferences, as well as authoring several vulnerability disclosures and patents.
Monnappa K A works with Cisco Systems as information security investigator focusing on threat intelligence, investigation of advanced cyber-attacks, researching on cyber espionage and targeted attacks. He is the creator of Limon Linux sandbox and winner of Volatility plugin contest 2016. He is the author of the upcoming book "Learning Malware Analysis". He is the co-founder of the cyber-security research community "Cysinfo". His fields of interest include malware analysis, reverse engineering, memory forensics and threat intelligence. He has presented at various security conferences like Black Hat, FIRST, SEC-T, DSCI, National Cyber Defence Summit and Cysinfo on various topics which include memory forensics, malware analysis, reverse engineering and rootkit analysis. He has conducted trainings at Black Hat, FIRST (Forum of Incident Response and Security teams), SEC-T, OPCDE cyber security conferences. He has also authored various articles in eForensics and Hakin9 magazines.
He regularly conducts training titled "A Practical Approach to Malware Analysis and Memory Forensics" around the world including Black Hat USA, Black Hat Asia and Black Hat Europe. You can find some of his contributions to the community in his YouTube channel, and he publishes blog posts at cysinfo.com
Twitter: @monnappa22
Jon (@bitquark) has been part of the UK hacking scene for over 20 years. Leaving his life as a senior developer to become a security researcher, Jon reached the #1 spot on Bugcrowd before being hired by Tesla to work on its infamous Red Team, where he proactively protects the company from internal and external threats. Jon's current Interests include automation, artificial intelligence, and getting into places he shouldn't.
James Kettle is Head of Research at PortSwigger Web Security, where he designs and refines vulnerability detection techniques for Burp Suite's scanner. Recent work has focused on using web cache poisoning to turn caches into exploit delivery systems. James has extensive experience cultivating novel attack techniques, including server-side RCE via Template Injection, client-side RCE via malicious formulas in CSV exports, and abusing the HTTP Host header to poison password reset emails and server-side caches. He has spoken at numerous prestigious venues including both Black Hat USA and EU, and OWASP AppSec USA and EU.
Marina Krotofil is an Industrial Control Systems (ICS) Senior Security Engineer at a large chemical company. The last decade she spent specializing on offensive side of cyber-physical security such as discovering and weaponizing unique attack vectors, engineering damage scenarios, developing exploits and understanding adversarial techniques when attacking ICS. Offensive security skills serve Marina well during incident responses and forensic investigations, ICS malware analysis and when architecturing defenses. She previously worked as a Principal Analyst and Subject Matter Expert (SME) in Cyber-Physical group at FireEye (USA), Lead Cyber Security Researcher at Honeywell (USA) and as a Senior Security Consultant at the European Network for Cyber Security (Netherlands). She was featured in the "Tribe of Hackers" book, authored more than 25 academic papers and book chapters on ICS security and is a frequent speaker at the leading security events around the world. She holds MBA in Technology Management, MSc in Telecommunications, and MSc in Information and Communication Systems.
Andreas Lindh is a vulnerability researcher and consultant, currently working for Recurity Labs GmbH. He has over a decade of applied security experience, spanning areas such as application security, vulnerability research, network intrusion detection, incident response, and malware analysis. Andreas helped co-found Security Without Borders, a collective of hackers, developers, and security professionals, working pro bono to offer security assistance to organizations and people fighting for human rights. He has presented his work at conferences such as, among others, Black Hat USA, Troopers, and Security Fest.
Ping Look has over a decade of experience building, promoting and managing events in the IT space including two of the most iconic and massively influential IT security events: The Black Hat Briefings + Trainings and DEF CON. At Black Hat she managed the growth of brand from obscurity to profitability and grew the event from a three track, two-day event to a six day, 11 track and training intense event that brought together the best and the most relevant (and occasionally the most obscure) speakers and content providers to Black Hat events in Asia, Europe, the Middle East and the US. During her tenure at Black Hat she was often referred to as the Ping of Death aka "The One You Don't Want to Piss Off (or you will die)".
Ping is currently engaged as a program manager on the Detection and Reaction Team (DART) at Microsoft, Enterprise Cybersecurity Group.
Maria Markstedter is an independent security researcher and trainer, focusing her research and work on ARM exploitation and reverse engineering of embedded systems. After spending some time as a Penetration Tester, she discovered her passion for processor security and reverse engineering and founded Azeria Labs to fill the gap in educational material on the exploitation of ARM-based devices by offering free hands-on tutorials and workshops. She regularly speaks at various security conferences, including HITBSecConf, Security Analyst Summit, and 44Con. In 2018, Maria was listed as one of the Forbes 30 Under 30 in the technology Europe division.
Marion Marschalek is a Security Engineer within Intel's STORM team in Portland, Oregon. Prior to that she held different positions in the threat detection industry, as a malware reverse engineer and incident responder. Her most noteworthy contribution at the time was her analysis work on the malware 'Babar' and other representatives of a collection of French nation state malware, which was cited by a number of international news outlets and also got her listed as one of Forbes' "30under30” talents in the Technology Europe division in 2016. Marschalek is a frequent speaker at major security conferences, including Black Hat, DEF CON, HITB, RSA, and SyScan, among others. Until recently she was teaching reverse engineering classes at University of Applied Sciences, from where she graduated in 2011 with a Master's Degree in Information Security. In 2015 she started a hacker bootcamp for women titled BlackHoodie, which over the years established itself as a global initiative to attract more diverse talent to the security industry.
Thomas Pornin is a Principal Security Consultant at NCC Group, specialized in cryptography. His research focuses on the design and implementation of cryptographic algorithms, with an emphasis on defense against timing-based side channel leaks; he is the author of BearSSL, an SSL/TLS library that embodies this approach and is optimized for constrained embedded systems. He is also an active participant to cryptographic competitions (AES, eSTREAM, SHA-3, PHC, and the ongoing Post-Quantum standardization process).
With over 13 years' experience in the information security industry specializing in application security incident response and investigations, Kymberlee Price got her start by pioneering the first security researcher outreach program in the software industry at Microsoft. Kymberlee was later a principal investigator in the Zotob criminal investigation, and analyzed APT's at Microsoft. She then spent 4 years investigating product vulnerabilities in BlackBerry's Security Response Team. Today at Bugcrowd, she is responsible for directing the efforts of Bugcrowd's more than 29,000 Crowd members in web application, mobile application, IoT and host infrastructure penetration testing as well as optimizing vulnerability reporting performance for customers and researchers.
Kymberlee co-chairs the Department of Commerce NTIA Working Group on Multi-Party Vulnerability Disclosure and speaks regularly on vulnerability management and product incident response best practices at conferences around the world including Black Hat, RSA, Kaspersky Security Analyst Summit, Nullcon, and Metricon.
Enno Rey is the founder and Managing Director of ERNW GmbH, where he and his crew focus on consulting and testing in all areas of IT security. With 20+ years of experience in network security, Enno has also published books and white papers (in the recent years mainly on IPv6), with an ongoing interest in the ethical parameters of those in and around the IT Security world (meaning everyone). Enno's passion for sharing knowledge manifests every year when he hosts the IT Security Conference "TROOPERS" in Heidelberg, Germany.
Raphaël Rigo is currently a senior security engineer and Red Team technical lead in the Airbus internal security evaluation team. A reverse engineer for more than 18 years, he also worked in vulnerability discovery, black-box security evaluations and incident response. His main interests are low-level and embedded security. He spoke at international conferences including Black Hat, SyScan, REcon, H2HC on various subjects such as Blue Coat proxies, encrypted HDD, or reverse engineering tools. He is part of the organizing and program committee of the French conference SSTIC. In the past, he did embedded security at Orange Labs, pentest on critical systems and incident response at the French National Cybersecurity Agency (ANSSI).
Jen Savage is a security researcher for Threatcare. She has over a decade of experience in tech including penetration testing, vulnerability assessment, vulnerability management, software development, technical management, and consulting services for companies ranging from startups to the Fortune 100. Her primary research interests are in Web Application Security and the Internet of Things.
Ryan Smith is the Vice President of Research at Cylance, where he leads teams performing both internal and external research. He has spent the last decade leading such teams for consulting, product, and fortune 50 organizations. As an individual contributor, Ryan has discovered and exploited highly impactful vulnerabilities in widely deployed client and server software. His interests include reverse engineering, exploitation, vulnerability discovery, analysis algorithms, and magnets. He has spoken at international conferences and is a two-time Pwnie Award winner for best server and client bugs.
Josh Thomas' specialties include advanced hardware and software reverse engineering, malware and rootkit development and discovery, and software development. Josh has extensive experience in developing secure solutions for mobile platforms and a deep understanding of cellular architecture. Josh currently holds a TS clearance, and has worked in many sensitive, cleared environments.
Josh began his career 14 years ago in network administration and software development. Prior to moving his focus primarily to security, Josh wrote Artificial Intelligence and cryptographic solutions for the Department of Defense. Josh has extensive hands on knowledge of mobile devices and cellular infrastructure. He is also dedicated to hardware reverse engineering and embedded device exploitation.
Josh most recently was a Senior Research Scientist with Accuvant's Applied Research team, and has worked as a Senior Research Developer at The MITRE Corporation. At MITRE, Josh performed analyses of the Android, Apple, Symbian and BlackBerry security models as well as other non-mobile embedded platforms and worked closely with the vendors and project sponsors. Josh also developed an open-source mesh networking solution for Smart phone communications that bypasses the need for physical infrastructure, performed advanced spectrum analysis for cleared communications, and designed a secure satellite communications system required to handle the most sensitive communications possible while also being resilient against the highest levels of waveform interference.
Prior to his tenure at The MITRE Corporation, Josh developed Artificial Intelligence and embedded cryptographic solutions for General Dynamics and other organizations. Josh projects including the design and development of robust routing architecture for UAV/UGV autonomous vehicles, battlefield troop movement predictive scenario generation, and creation of mathematical models the controlled de-orbit and reentry of the Mir Space Station.
Josh is the recipient of three DARPA Cyber Fast Track grants for advanced security research, and has presented at multiple security industry conferences, including Black Hat, DEF CON, DerbyCon and ToorCon. Josh is the lead developer and maintainer of the open-source SPAN mesh networking project for Android, has published and reviewed papers for IEEE, and holds a pending patent related to NAND flash memory hiding techniques. Josh holds a Bachelor's in Computer Science from Texas A&M University, and has been a frequent presenter at national and international security industry conferences.
Gabrielle Viala is currently a security engineer at Quarkslab. After working as a pentester for several years, she shifted in reverse engineering, where she found a great topic of interest - the Windows kernel. She is part of BlackHoodie from the very first edition and belongs to the organization crew. She also contributes as a speaker and trainer during not just BlackHoodie but also other security related events. She spoke at international conferences including Black Hat, Ekoparty and Infiltrate on various topics related to Windows Internals. She is still far from being an expert, but enjoys sharing with other people and learning from them.
Neil R. Wyler (a.k.a. Grifter) is an Information Security Engineer and Researcher located in Salt Lake City, Utah. Neil is currently with RSA Security as an Advanced Security Operations Specialist. He has spent over 15 years as a security professional, focusing on vulnerability assessment, penetration testing, physical security, and incident response. He has been a staff member of the Black Hat Security Briefings for over 13 years and is a member of the Senior Staff at DEF CON. Neil has spoken at numerous security conferences worldwide, including Black Hat, DEF CON, and the RSA Conference. He has been the subject of various online, print, film, and television interviews, and has authored several books on information security. Neil is a member of the DEF CON CFP Review Board and Black Hat Training Review Board. Follow him on Twitter at @Grifter801.
Chris Wysopal, Veracode's CTO and Co-Founder, is responsible for the company's software security analysis capabilities. In 2008 he was named one of InfoWorld's Top 25 CTO's and one of the 100 most influential people in IT by eWeek. One of the original vulnerability researchers and a member of L0pht Heavy Industries, he has testified on Capitol Hill in the US on the subjects of government computer security and how vulnerabilities are discovered in software. He published his first advisory in 1996 on parameter tampering in Lotus Domino and has been trying to help people not repeat this type of mistake for 15 years. He is also the author of "The Art of Software Security Testing" published by Addison-Wesley.
Stefano Zanero received a PhD in Computer Engineering from Politecnico di Milano, where he is currently an associate professor with the Dipartimento di Elettronica, Informazione e Bioingegneria. His research focuses on mobile malware, malware analysis, and systems security. Besides teaching "Computer Security" at Politecnico, he has an extensive speaking and training experience in Italy and abroad. He co-authored over 50 scientific papers and books. He is an associate editor for the "Journal in computer virology and hacking techniques". He's a Senior Member of the IEEE (covering volunteer positions at national and regional level), the IEEE Computer Society (for which he is a member of the Board of Governors), and a lifetime senior member of the ACM. Stefano co-founded the Italian chapter of ISSA (Information System Security Association), of which he is a senior member. He sits in the International Board of Directors of the same association. A long time op-ed writer for magazines (among which "Computer World"), Stefano is also a co-founder and chairman of Secure Network S.r.l., a leading Italian information security consulting firm, and a co-founder of 18Months, a cloud-based ticketing solutions provider.
