Our contributors

Hardik Shah
Hardik Shah specializes in network security, reverse engineering and malicious code analysis. He is also interested in web and application security. He can be reached at hardik05@gmail.com or http://hardikshah.info
Hardik, together with Anthony Williams, wrote an article on analyzing malicious code.

Anthony L. Williams
Anthony L. Williams is the information security architect for IRON::Guard Security, LLC where he performs penetration testing, vulnerability assessments, audits and incident response. He can be reached at awilliams@ironguard.net or http://www.ironguard.net

Victor Oppleman
Victor Oppleman is an accomplished author, speaker, and teacher in the field of network security and a consultant to some of the world's most admired companies. Victor Oppleman's open source software has been distributed to hundreds of thousands of computers worldwide and he holds US intellectual property patents in distributed adaptive routing and wireless consumer applications.


Ruben Santamarta
Ruben Santamarta has been interested in reverse engineering, low-level and computer security since he was 16 years old. With totally self-taught skills, he started working at 19 as a programmer. Later on, he has continued working on sectors related with low-level, anti-virus and vulnerabilities. Currently his activities are focused on this last field.


Risto Vaarandi
Risto Vaarandi received his PhD in Computer Engineering from the Tallinn University of Technology, Estonia, in June 2005. For the past eight years, he has been working in SEB Eesti �hispank as an IT development engineer, and currently he is also a part-time researcher at the Institute of Computer Science, University of Tartu, Estonia. You can contact Risto through his home page at http://kodu.neti.ee/~risto.


Gilbert Nzeka
Gilbert Nzeka is a nineteen years old French student impassioned by programming and computer security since he's fourteen years old. Author of a french computer security book at the age of sixteen published by Hermès Sciences editions, he has been interested for two years in malwares programming and cryptography. White Hat during his hobbies time, he helps administrators to make safe their systems, he worked for FCI an AREVA subsidiary company like pen-tester and gives courses on GNU/Linux and security in his engineer school. For one year, he actively develops AJAX and XUL applications in PHP and Javascript, he is the instigator of UneTV, a VODcasting platform presented at the World Summit on the Information Society in Tunis.


Lars Packschies
Dr. Lars Packschies works as a research associate at the regional computer center of the University of Cologne and is the contact person for chemistry related software and databases as well as for cryptographic applications. He administrates the software and takes care of the privacy protection under Linux, SunOS/Solaris, IRX and AIX. He is the author of Praktische Kyptografie unter Linux (Practical cryptography under Linux).


Simon Castro
Simon Castro is a member of the Gray World team (http://gray-world.net). This international research unit is dedicated to computer and network security with a special interest for NACS bypassing (Tunneling, covert channels, network related steganographic methods). Contact with the authors : simon@gray-world.net or team@gray-world.net


Dan J. Bernstein
Dan, commonly known as DJB, is 33 years old. He's currently working as an Associate Professor in the Department of Mathematics, Statistics, and Computer Science, and as an Adjunct Associate Professor in the Department of Computer Science of the University of Illinois at Chicago. In 1995 he has gotten a Ph.D. in the Department of Mathematics, University of California at Berkeley. During the last nine years he has gotten four grants as a Principal Investigator from the National Science Foundation and a Sloan Research Fellow grant from the Sloan Foundation. His main work areas and interests are related to software development, software security and cryptography.
DJB is the creator of qmail, djbdns, ucspi-tcp, daemontools, publicfile and lots of other software including various libraries, some of it based on his own algorithms and calculation methods. What's most unusual about his programming is the fact that it uses very few library functions – Dan writes his own, much more secure replacements. He also offers cash prizes for finding bugs in his most popular creations. The prizes have not been claimed so far, for over ten years.
Dan was interviewed by our magazine.

David Barroso Berrueta & Alfredo Andr�s Omella
David Barroso specialises in incident response and network security. He currently works in a Spanish security company called S21sec. He is also deeply involved in the global security community, writing articles, papers and developing new security tools.

Alfredo Andr�s has been working in the security field for several years and contributing to the Open Source community developing tools and patches. Alfredo also works in S21sec, leading a pen-testing group.
Both authors were presenting their tool Yersinia on BlackHat Europe 2005. A Cisco zero-day attack was also presented, related to one of the protocols targeted by Yersinia (Cisco was notified, of course) and discovered when developing the tool.
David and Alfredo wrote an article about attacks on Layer 2 of the OSI model.

Christiaan Beek
Christiaan Beek has been working for several years in the security field. Working for national and international companies, he gained a lot of knowledege about hacking techniques, virus technology and intrusion detection. Currently he is working as a security consultant/ethical hacker for a Dutch company Getronics. His free time is spend with his family, reading and analysing/reverse engineering the output of his malware honeypots.

Christiaan wrote an article on techniques used by spyware.

Robert Bernier
Robert has been involved with computers in one form or another for almost thirty years. His first foray into programming dates back to the card punching days of the IBM 360 where he swore to never touch another computer again. Since that days he has changed his mind and is a teacher and writer in Canada'a national capital, Ottawa.

Robert wrote an article about SQL Injection techniques.

Kristof De Beuckelaer
Kristof, still a student, has several years of experience in the security field. His interest in security started to rise, since the day he started experimenting with Linux, about 4 or 5 years ago. After about a year he started using Linux From Scratch and built his own Linux distribution which he's still using. Since then, he's been involved in all kinds of projects. He's currently still studying to turn his greatest hobby into his job: network/security engineer.

Kristof is currently writing an article on smartspoofing.

Pablo Fern�ndez
Originally from Temperley, Argentina. 21 years old and with over 6 years of Linux experience, Pablo is a developer in Spain's Telefonica I+D (R&D), and has contributed many pieces of GPL'ed software, including Cronos II, a GNOME mail client. Pablo's interest in security started over 4 years ago and since then he has contributed to projects such as Nmap. In his free time Pablo likes playing tennis (played the Orange Bowl twice and held good positions in Argentinean junior ranking), developing software (mostly in C and C++), reading technical papers and playing with algorithms.

Pablo is currently writing an article about advanced L2.6KM rootkit development.

Sacha Fuentes Gatius
Sacha Fuentes has been working in the IT industry for the last seven years, doing almost everything – from programming to system operating (including user assistance). He is interested in all aspects of security, but currently concentrates mostly on web application security and education of end users.

Sacha wrote an article on finding and exploiting bugs in PHP Code.

Tobias Glemser & Reto Lorenz
Tobias Glemser has been an employee of Tele-Consulting GmbH, Germany for over 4 years, while Reto Lorenz is one of the company's executives.

Tobias and Reto wrote an article on VoIP security. Tobias previously wrote an article about SQL injection attacks on PHP and MySQL.

John Graham-Cumming
John is an author of a popular antispam POP3 proxy called POPFile. He's also the Vice President of Engineering at Electric Cloud, an inventor of two US patents, and a moderator of the Open Source Awards. More about John at his site.

John wrote an article about methods used by spamers to bypass filters.

Mark Hamilton
Educated in applied computer science, "Mark Hamilton" works as a freelance security consultant for small-scale enterprises and individuals. Besides neuroinformatics and grid computing, the security of web applications and networks are his main fields of activity.

Mark devised and described a method of outsmarting personal firewalls.

Roy Hills
Roy Hills is the founder of NTA Monitor Ltd, a UK based security testing company. He wrote the ike-scan tool to investigate IPsec security, and has found several vulnerabilities using this tool in products from Checkpoint, Cisco, Nortel, and Juniper.

Roy wrote an article about VPN fingerprinting.

Rudra Kamal Sinha Roy
Rudra Kamal Sinha Roy has been working in the field of security for quite a few number of years and is currently working for iViZ Techno Solutions, a security company based in India. He has been actively involved in a large number of security audits for various global organizations. He also leads the chapter chair of OWASP (Open Web Application Security Project), Kolkata chapter. His involvement in leading the Hands-on Training on Ethical Hacking has been crucial. He is also an active contributor in drafting of ISSAF (Internet Systems Security Assessment Framework), a globally accepted standard for security assessment.

Rudra wrote an article about Windows Server 2003 security.

Oliver Karow
Oliver Karow works as a Principal Security Consultant for a security vendor. He is currently focused on firewalls, IDS/IPS, Security Audits and Penetration Testing. Oliver is currently studying Information Technology at a German distance university. He works in IT since 1994 and from 1999 onwards is focused on IT security.

Oliver wrote an article on bypassing and attacking firewalls.

Konstantin Klyagin
Konstantin Klyagin, short is Konst, is a software engineer who has been working for 7 years in software development. At his 24 he has about 16 years of overall computers experience. Originally from Kharkov, Ukraine, currently Konst lives in Berlin (before, he lived in Bucharest, the capital of Romania). He is the author of the popular multi-IM client called centericq distributed under the terms of GPL and a bunch of other useful software. Apart from hacking around he enjoys traveling and discovering new places, photography, reading, writing and updating his own web site at thekonst.net. Konst holds MS in Applied Mathematics and speaks Russian, English, Romanian and Ukrainian. Currently he learns German.

Konstantin wrote articles about Instant Messenger security and port scanning techniques.

Alexander Kornbrust
Alexander Kornbrust is the founder and CEO of Red-Database-Security GmbH, a company specialised in Oracle security. He is responsible for Oracle security audits and Oracle Anti-Hacker trainings. Before that he worked several years for Oracle Germany, Oracle Switzerland and IBM Global Services as consultant. Alexander Kornbrust is working with Oracle products as DBA and developer since 1992. During the last 5 years found over 110 security bugs in different Oracle products.

Alexander wrote an article on Oracle rootkits.

Martin Krzywinski
Martin Krzywinski, the author of the PortKnocking website is a bioinformatics research scientist. He works with fingerprint maps of large genomes and loves to write Perl scripts of all sizes. He has a background in *NIX system administration and system automation. He is originally from Warsaw, but now lives in Vancouver, Canada where he kayaks and drinks a lot of espressos. More information about Martin on his homepage.

Martin wrote an article about port knocking.

Guillaume Lehembre
Guillaume Lehembre is a French security consultant and has been working at HSC (Herv� Schauer Consultants) since 2004. During his varied professional career he has dealt with audits, studies and penetration tests, acquiring experience in wireless security. He has also delivered public readings and published papers on security.

Guillaume wrote an article about WEP, WPA and WPA2 security.

Stavros Lekkas
Stavros, originally from Greece, is a 3rd year student of The University of Manchester (formerly known as UMIST). His research interests include cryptography, information security, data mining, higher mathematics (logic and number theory) and computational complexity. He is curretnly working on a dissertation, which concerns a compiler-related topic.

Stavros is writing an article about his own proof-of-concept tool for automating buffer overflow exploitation.

Robin Lobel
Robin Lobel has conducted several IT research projects for years, including audio compression, realtime image analysis, realtime 3D engines, etc. He studied the TEMPEST system thoroughly in 2003 and was lucky enough to be able to use a full laboratory to conduct these experiments and succeed. He also enjoys composing music and doing some 2D/3D artwork. He is currently studying cinema arts in Paris. More information about Robin on his website.

Robin wrote an article about compromising screen emanations using the TEMPEST method.

Jeremy Martin
With over 10 years of experience in the IT industry (accreditations: CISSP, ISSMP, ISSAP, CHS-III, CEI, CEH, CCNA, Network+, A+), Jeremy Martin is the Communications Director for PLUSS Corporation. A member of ACFEI (American College of Forensic Examiners International), BECCA (Business Espionage Controls and Countermeasures Association), ISC (International Information Systems Security Certification Consortium), ISACA (Information Systems Audit and Control Association), ISSA (Information Systems Security Association), YEN NTEA (Young Executives Network) and OISSG (Open Information Systems Security Group).

Jeremy wrote an article about physical system security and is preparing an article on warXing.

Arrigo Triulzi
Arrigo Triulzi is a SANS certified instructor, trained in Pure Mathematics, holds an MSc in Mathematical Computation from Queen Mary, University of London, and is working towards a PhD in Algebraic Computation. He is co-founder and Chief Security Officer of K2 Defender Limited, a bespoke high-end IDS solutions provider. Arrigo is also a free-lance consultant in IT Security with particular expertise in secure network design, network security analysis, and incident handling. He is also the administrator of the IDS Europe mailing list. Having worked with both popular and less common flavours of Unix he is comfortable working in any heterogeneous networking environment and his knowledge also includes esoteric operating systems such as Guardian/NSK. Arrigo is co-inventor in an EU patent for a high-performance distributed IDS design, and has written on a variety of security topics. Recent work includes web research into IDS deployment on IPv6, firewall verification using IDS, and distributed concept virii.

Arrigo is currently preparing an article about Differential Firewall Analysis

Antonio Merola
Antonio Merola is a security expert. He started his career 10 years ago; he used to work as consultant serving several company as Systems Administrator (Microsoft Certified Systems Engineer). Since 2001 he has been involved in many aspects of perimeter security such as firewall, vpn, intrusion detection etc. as employee for Telecom Italia. Additional, as a freelancer, he serves several companies as consultant and instructor on a wide variety of security topics.Antonio, holds several certifications and is working towards to complete his University Degree in Informatics Engineer from Università degli Studi di Napoli. He is a speaker on international security events and as author he published articles in several Italian magazines and has been collaborating with hakin9. His recent interests include honeypots, wireless security solutions and forensic analisys.
Contact the author at a.merola@securityindepth.org

Antonio wrote articles about IDS system internals, ICMP use and abuse and Differential Firewall Analysisis currently preparing an article for hakin9 starterkit issue.

Syed Naqvi
Syed Naqvi, originally from Pakistan, is a research associate at T�l�com Paris. He has been working in Grid Security for last three years. His research activities are funded by the European Commission’s Information Society Technologies (IST) projects. His current projects include Security Expert Initiative (SEINIT), Secure Communication based on Quantum Cryptography (SECOQC), Building Security Assurance in Open Infrastructures (BUGYO), Dependable Security by Enhances Reconfigurability (DESEREC), etc. Syed's research focuses around the security and trust modelling for the large scale, open, heterogeneous distributed systems. He is working on the virtualization of security services with their pluggable implementation. He is the architect of Grid Security Services Simulator (G3S) which is the pioneer tool for the design and analysis of Grid Security Solutions.

Syed is currently writing an article about Grid Security.

Tomasz Nidecki
Tomasz Nidecki graduated from the IT Institute at Warsaw University and studied for two years at the Department of Journalism at the same university. He has been associated with IT press for over 12 years and is currently Managing Editor of hakin9 magazine. He is also a programmer and administers several mail servers.

Tomasz wrote several articles, mainly on spam protection and Internet mail and news technology.

Michał Piotrowski
Michał Piotrowski has a masters degree in computer science, and is an experienced system and network administrator. His work experience includes three years as a security officer at an organization supporting the primary certification authority in Polish PKI infrastructure. Currently, he is working as a security specialist at one of the biggest polish financial institutions. He spends his free time programming and studying cryptography.

Michał wrote multiple articles, including ones on writing shellcodes, google hacking, creating an IPS using Snort.

Christophe Reverd
Christophe is a member of International Information Systems Security Certification Consortium (ISC)² and holds its CISSP and ISSMP certifications. He is also a member of Information Systems Audit and Control Association (ISACA) and Project Management Institute (PMI). As one of the founding members, he contributes to the Montreal chapter of the Information Security Management Systems (ISMS) International User Group (ISO/IEC 17799 and BS7799-2). Being an Internet pioneer in France, he now works as a telecommunications network security officer for Hydro-Quebec transport division.

Christophe is writing an article on practical issues of implementing the ISO/IEC 17799 security norm.

Massimiliano Romano, Simone Rosignoli, Ennio Giannini
Massimiliano Romano's main interests are computer science and networks. He works as a freelancer in one of the largest Italian mobile telephony companies. He spends much of his spare time on Ham Radio, studying and decoding digital radio signals.

Simone Rosignoli is a student of the University La Sapienza in Rome. He is currently completing a degree in Computer Science Technologies (Systems and Security). His interests range from programming to computer security.

Ennio Giannini works as a system analyst. He spends his free time experimenting in GNU/Linux environments. He is a strong supporter and promoter of Open Source.

Massimiliano, Simone and Ennio wrote an article about botnets.

Tomasz Rybicki
Tomasz Rybicki is a Ph.D. candidate at the Department of Electronics and Information Technology at the Warsaw University of Technology. He is a member of MEAG (the Mobile and Embedded Applications Group). He has been a Java programmer for over five years.

Tomasz wrote articles about J2ME and Java VM vulnerabilities.

Philipp Schwaha & Rene Heinzl
Philipp Schwaha and Rene Heinzl are working on their Ph.D. thesis at the Technical University of Vienna in the area of microelectronics and are interested in mathematics, physical modeling and programming.

Philipp and Rene wrote an article about MD5 vulnerabilities.

Mike Shema
Mike Shema is CSO of the web application security company NT Objectives, Inc. He is the author of Hack Notes: Web Security and co-author of Hacking Exposed: Web Applications and The Anti-Hacker Toolkit. Mike has spoken about application security at several conferences, including IT Underground in 2004. In his spare time, Mike can be found in front of role-playing and board games.

Mike wrote an article about advanced SQL Injection techniques.

Tim O. Shenko"Tim O. Shenko" is an Information Security Expert and has been working in the InfoSec field for 3 years now. As a consultant, he has worked for the biggest companies in his home country, including major financial institutions and big Internet retail companies. Also as a researcher, he's been involved in the discovery of a couple of vulnerabilities in network hardware devices and also doing wireless security research.

"Tim" is currently writing an article comparing the exploit frameworks.

Piotr Sobolewski
Piotr Sobolewski holds degrees in software engineering from Szczecin University (Poland) and navigation from the Szczecin Maritime University. For over two years, he was Chief Editor of hakin9 magazine. He is currently working as a freelance security consultant.

Piotr wrote multiple articles, including those on format string vulnerabilities and various buffer overflow techniques.

Ilja van Sprundel & Christian Klein
Ilja van Sprundel, Employed By Suresec Ltd. has a passion for somewhat offensive computer security. Among other things he has previously imlemented a secure creditcard transaction solution. Ilja also attended the RWTH-Aachen summerschool of applied I.T. security where he learned a great deal about offensive and defensive security mechanisms. He is also the winner of the 21c3 stacksmashing contest and a member of the Netric security research group.

Christian Klein is a computer science student at the University of Bonn, Germany. After working in a consulting company for the industry and government, he dropped out to return to research and development.

Ilja and Christian are preparing an article on MacOS kernel security


Brandon Dixon
Brandon has over 5 years of experience in the information technology and security industry. Mr. Dixon is currently a member of G2, Inc. where he performs network and application penetration testing services.

Tam Hanna
Tam Hanna has been in the mobile computing industry since the days of the Palm IIIc. He develops applications for handhelds/smartphones and runs for news sites about mobile computing:
http://tamspalm.tamoggemon.com
http://tamspc.tamoggemon.com
http://tamss60.tamoggemon.com
http://tamswms.tamoggemon.com
If you have any questions regarding the article, email author at: tamhan@tamoggemon.com

Rodrigo Rubira Branco
Rodrigo Rubira Branco (BSDaemon) is a Security Expert at Check Point Software Technologies in Brazil. Prior to that, he worked as the Principal Security Researcher at Scanit (http://www.scanit.net), the biggest security company in the Middle East, incorporated by the giant Oger Systems. Also, worked as a software Engineer at IBM, member of the Advanced Linux Response Team (ALRT), part of the IBM Linux Technology Center (IBM/LTC) Brazil also worked in the IBM Toolchain (Debugging) Team for Power Architecture. He is the maintainer of the StMichael/StJude projects (www.sf.net/projects/stjude), the developer of the SCMorphism (www.kernelhacking.com/rodrigo) and has talks at the most important security-related conferences in the world. Rodrigo is also a member of the Rise Security (www.risesecurity.org). You can contact the author at rodrigo@kernelhacking.com

Filipe Alcarde Balestra
Filipe Alcarde Balestra is an Information Security Researcher at Firewalls Security Corporation in Brazil. He is also member of the Forensic Department of Firewalls Security Corporation. In the past, he worked as a Security Consultant and Forensic Consultant for leading companies in Brazil. Filipe discovered security vulnerabilities in different softwares like *BSD Kernels, Solaris, Microsoft, QNX, Web Applications and others. He is also an ex-member of the group Priv8Security (now dead) – many security studies (advisory/exploit) published – and a past speaker at Hackers to Hackers Conference 2006 about Syscall Proxing / Pivoting. You can contact the author at filipe.balestra@firewalls.com.br

Neil Bergman
Neil Bergman is a software engineer, artist, and white hat hacker. He has a formal education in Computer Science and has been programming since he was a child.

Aditya K Sood, a.k.a. 0kn0ck
Aditya K Sood, a.k.a. 0kn0ck, is an independent security researcher and founder of SecNiche Security, a security research arena. He works for KPMG as a Security Auditor. His research articles have been featured in Usenix Login. He has given advisories to forefront companies. He is an active speaker at conferences such as EuSecWest, XCON, OWASP, and CERT-IN. His other projects include Mlabs, CERA, and TrioSec.

Davide Pozza
Davide Pozza holds a MS and Ph.D. degree in Computer Engineering from Politecnico di Torino, Torino, Italy. He is currently a postdoc researcher at the Department of Computer Engineering at that institution. He has published research papers in the fields of software and network security. His current research interests include: formal methods applied in the context of network vulnerability analysis, software engineering processes, methodologies and techniques for detecting, preventing and contrasting design and implementation vulnerabilities, automatic code generation, and cryptographic protocols. He also provides consultancies in the area of reliable and secure software. He can be reached at davide.pozza@polito.it

Harlan Carvey
Harlan Carvey is an incident responder and forensic analyst based out of the Metro DC area. He is the author of Windows Forensic Analysis, published in May 2007 by Syngress/Elsevier.

Anushree Reddy
Anushree Reddy is a team-lead at www.EvilFingers.com. She holds Master’s degree in Information Security and is very passionate about analysis of vulnerabilities, exploits and signatures. She can be contacted through EvilFingers website (or contact.fingers evilfingers.com).

Marco Lisci
Marco Lisci is a System Engineer and IT Consultant interested in creativity applied to computer systems. He works on information systems, network infrastructure and security. After a long period as Web Chief in creative agencies founded BadShark Communications, a web, video and audio, seo, advertising and security company. Stay tuned on badshark.org.

Antonio Fanelli
Electronics engineer since 1998 and is extremely keen about information technology and security. He currently works as a project manager for an Internet software house in Bari, Italy.

Israel Torres
Hacker at large with interests in the hacking realm. hakin9@israeltorres.org

Rishi Narang
Rishi Narang is a Vulnerability R&D consultant working with Third Brigade Inc., a security software company specializing in host intrusion defense. Narang’s profile includes research on recent & zero day vulnerabilities, reverse engineering and IDS/IPS Signature Development. He holds a Bachelor’s degree in Information Technology, and has authored articles on recent advances in Information Security & Research. He has been a speaker in OWASP & private security trainings and can be reached through his personal blog Greyhat Insight (www.greyhat.in). The information and opinions expressed in this article are the personal opinions of Rishi Narang provided for informational purposes only.

David Maciejak
David Maciejak works for Fortinet as a Security Researcher, his job is to follow the trend in the vulnerability underground market and provide some preventive protection to customers.

Russell Kuhl
Russell Kuhl has been working in Information Technology for over 12 years and holds both the CISSP and CEH certifications. He currently works as a Senior Engineer for a consulting firm in Boston, Massachusetts.

Peter Giannoulis
Peter is an information security consultant in Toronto, Ontario. Over the last 10 years Peter has been involved in the design and implementation of client defenses using many different security technologies. He is also skilled in vulnerability and penetration testing having taken part in hundreds of assessments. Peter currently maintains the first infosec video portal – www.theacademypro.com – which provides organizations streaming video on how to configure and troubleshoot many of today's top security products. He also spent many years involved with SANS and GIAC as an Authorized Grader, courseware author, exam developer, Advisory Board member, Stay Sharp instructor and just recently gave up his post as Technical Director for the GIAC family of certifications. Peter's current certifications include: GSEC, GCIH, GCIA, GCFA, GCFW, GREM, GSNA, CISSP, CCSI, INFOSEC, CCSP, & MCSE.

Advertisement