Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Apple
    • Apple
    • Applications
    • Cybersecurity
    • Mobile
    • Networking

    Five Hackers Who Left a Mark on 2006

    By
    Ryan Naraine
    -
    January 2, 2007
    Share
    Facebook
    Twitter
    Linkedin

      In the security year that was 2006, zero-day attacks and exploits dominated the headlines.

      However, the year will be best remembered for the work of members of the hacking—er, security research—community who discovered and disclosed serious vulnerabilities in the technologies we take for granted, forced software vendors to react faster to flaw warnings and pushed the vulnerability research boat into new, uncharted waters.

      In no particular order, heres my list of five hackers who left a significant mark on 2006 and set the stage for more important discoveries in 2007:

      H.D. Moore

      H.D. Moore has always been a household name—and a bit of a rock star—in hacker circles. As a vulnerability researcher and exploit writer, he built the Metasploit Framework into a must-use penetration testing tool. In 2006, Moore reloaded the open-source attack tool with new tricks to automate exploitation through scripting, simplify the process of writing an exploit, and increase the re-use of code between exploits.

      Moores public research also included the MoBB (Month of Browser Bugs) project that exposed security flaws in the worlds most widely used Web browsers; a malware search engine that used Google search queries to find live malware samples; the MoKB (Month of Kernel Bugs) initiative that uncovered serious kernel-level flaws; and the discovery of Wi-Fi driver bugs that could cause code execution attacks.

      Love him or hate him—hackers marvel at his skills while software vendors decry his stance on vulnerability disclosure—Moores work nudged the security discussion to the mainstream media and confirmed that vulnerability research will remain alive in 2007.

      Jon “Johnny Cache” Ellch and David Maynor

      At the Black Hat Briefings in Las Vegas, Jon “Johnny Cache” Ellch teamed up with former SecureWorks researcher David Maynor to warn of exploitable flaws in wireless device drivers. The presentation triggered an outburst from the Mac faithful and an ugly disclosure spat that still hasnt been fully resolved.

      For Ellch and Maynor, the controversy offered a double-edged sword. In many ways, they were hung out to dry by Apple and SecureWorks, two companies that could not manage the disclosure process in a professional manner. In some corners of the blogosphere, they were unfairly maligned for mentioning that the Mac was vulnerable.

      However, among security researchers who understood the technical nature—and severity—of their findings, Ellch and Maynor were widely celebrated for their work, which was the trigger for the MoKB (Month of Kernel Bugs) project that launched with exploits for Wi-Fi driver vulnerabilities.

      Since the Black Hat talk, a slew of vendors—including Broadcom, D-Link, Toshiba and Apple—have shipped fixes for the same class of bugs identified by Ellch and Maynor, confirming the validity of their findings.

      Maynor has since moved on, leaving SecureWorks to launch Errata Security, a product testing and security consulting startup.

      Mark Russinovich

      Before Mark Russinovichs mind-blowing expose of Sony BMGs use of stealth technology in a DRM (digital rights management) scheme, “rootkit” was a techie word. Now, the word is being used in marketing material for every anti-virus vendor, cementing Russinovichs status as a Windows internals guru with few equals.

      The Sony rootkit discovery highlighted the fact that anti-virus vendors were largely clueless about the threat from stealth malware and forced security vendors to build anti-rootkit scanners into existing products.

      Russinovich, who now works at Microsoft after Redmond acquired Sysinternals, spent most of 2006 expanding on his earlier rootkit warnings and building new malware hunting tools and utilities.

      Joanna Rutkowska

      Polish researcher Joanna Rutkowska also used the spotlight of the 2006 Black Hat Briefings to showcase new research into rootkits and stealthy malware. In a standing-room-only presentation, she dismantled the new driver-signing mechanism in Windows Vista to plant a rootkit on the operating system and also introduced the world to “Blue Pill,” a virtual machine rootkit that remains “100 percent undetectable,” even on Windows Vista x64 systems.

      In 2006, Rutkowska also pinpointed inherent weaknesses in anti-virus software; warned that the major operating system vendors are not yet ready for hardware virtualization technology and confirmed fears that stealth malware is the operating systems biggest security threat.

      Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.

      Ryan Naraine

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Careers

      SThree’s Sunny Ackerman on Tech Hiring Trends

      James Maguire - June 9, 2022 0
      I spoke with Sunny Ackerman, President/Americas for tech recruiter SThree, about the tight labor market in the tech sector, and much needed efforts to...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×