Public Contributions

Analyzed the Pandora DDoS botnet's command-and-control panel and found exploitable flaws that could be used to disrupt it.

Contributor to the Building Security In Maturity Model (BSIMM), the software security benchmark used to measure and compare security programs.

Found a vulnerability in Apache Solr running on Jetty (SOLR-4861) and coordinated the fix with the Apache Solr project.

Found a sandbox breakout in Google Translate and reported it to Google.

Found SQL injection and input validation flaws in the Scalr cloud management platform.

DEF CON 22 talk (2014) on how much internet infrastructure runs on open-source software that nobody has reviewed and nobody is funded to secure. Built the dataset behind it: 2,000+ open-source projects analyzed with a Jenkins pipeline on an AWS spot fleet.

Found vulnerabilities in Security Onion's CapMe interface; the Security Onion team patched them and published an advisory.

Showed how a disguised USB charging station, such as a laptop hidden in a jacket and offered as free charging at an event, can compromise smartphones.

Found denial-of-service and cross-site scripting flaws in the Google Glass developer program and disclosed them to the Glass team, with an upstream patch to Google's mirror-quickstart-java sample.

Found cross-site scripting flaws on CNN.com and reported them.

Analyzed the Firesale botnet's web panel and found exploitable flaws in the operators' infrastructure.

Analyzed the BlackEnergy botnet's command-and-control infrastructure and found exploitable flaws that could be used to disrupt it.

Found a denial-of-service flaw in the Apache Batik SVG toolkit (BATIK-1023) and reported it to the Apache Batik project.

Reported a cross-site scripting issue in jQuery core (ticket #12254), a library used on millions of sites.

Reverse-engineered the Carberp banking trojan's command-and-control and found exploitable flaws and broken cryptography.

Analyzed how HTTP and cookie RFCs are implemented and found denial-of-service techniques that abuse them.

Found a cross-site scripting flaw in MediaWiki core, the software behind Wikipedia (CVE-2015-6729).

Found cross-site scripting flaws in the LDAP Tool Box Self Service Password application.

Technical editor of this IGI Global reference (ISBN 1466645261) on the organizational, legal, and technical responsibilities of information system administration. Also technical editor for 110+ peer-reviewed papers and chapters on information systems, cybersecurity, and software engineering (2008–2026).

Lecture for the ISC2 West Michigan chapter on why external scrutiny and bug bounty programs find what internal testing misses. Recurring ISC2 speaker, listed as a Top Rated Speaker.

Found vulnerabilities in Basecamp and 37signals infrastructure and disclosed them to 37signals.

DEF CON 23 talk (2015), also given at ToorCon 17 and ROOTCON 9, on cryptographic weaknesses and supply-chain attacks through Git internals, and how they put development pipelines at risk.

Found a secret-handling flaw in Square's Keywhiz secret management system and reported it through Square's bug bounty program; Square engineers opened the fix (PR #50) from the report.

Found unpatched cross-site scripting and a potential remote code execution path in the Cloud9 online IDE.