Five Hackers Who Left a Mark on 2006

At the Black Hat Briefings in Las Vegas, Jon "Johnny Cache" Ellch teamed up with former SecureWorks researcher David Maynor to warn of exploitable flaws in wireless device drivers. The presentation triggered an outburst from the Mac faithful and an ugly disclosure spat that still hasnt been fully resolved.

For Ellch and Maynor, the controversy offered a double-edged sword. In many ways, they were hung out to dry by Apple and SecureWorks, two companies that could not manage the disclosure process in a professional manner. In some corners of the blogosphere, they were unfairly maligned for mentioning that the Mac was vulnerable.

However, among security researchers who understood the technical nature—and severity—of their findings, Ellch and Maynor were widely celebrated for their work, which was the trigger for the MoKB (Month of Kernel Bugs) project that launched with exploits for Wi-Fi driver vulnerabilities.

Since the Black Hat talk, a slew of vendors—including Broadcom, D-Link, Toshiba and Apple—have shipped fixes for the same class of bugs identified by Ellch and Maynor, confirming the validity of their findings.

Maynor has since moved on, leaving SecureWorks to launch Errata Security, a product testing and security consulting startup.

Mark Russinovich

Before Mark Russinovichs mind-blowing expose of Sony BMGs use of stealth technology in a DRM (digital rights management) scheme, "rootkit" was a techie word. Now, the word is being used in marketing material for every anti-virus vendor, cementing Russinovichs status as a Windows internals guru with few equals.

The Sony rootkit discovery highlighted the fact that anti-virus vendors were largely clueless about the threat from stealth malware and forced security vendors to build anti-rootkit scanners into existing products.

Russinovich, who now works at Microsoft after Redmond acquired Sysinternals, spent most of 2006 expanding on his earlier rootkit warnings and building new malware hunting tools and utilities.

Joanna Rutkowska

Polish researcher Joanna Rutkowska also used the spotlight of the 2006 Black Hat Briefings to showcase new research into rootkits and stealthy malware. In a standing-room-only presentation, she dismantled the new driver-signing mechanism in Windows Vista to plant a rootkit on the operating system and also introduced the world to "Blue Pill," a virtual machine rootkit that remains "100 percent undetectable," even on Windows Vista x64 systems.

In 2006, Rutkowska also pinpointed inherent weaknesses in anti-virus software; warned that the major operating system vendors are not yet ready for hardware virtualization technology and confirmed fears that stealth malware is the operating systems biggest security threat.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.

Reader Comments: Five Hackers Who Left a Mark on 2006 >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine