Research
This page summarizes vulnerability research, protocol analysis, and upstream contributions. The focus is on practical findings, correctness improvements, and integration into widely used tools.
Vulnerability Research (CVE)
| CVE | Vector | Summary |
|---|---|---|
| CVE-2020-36420 | Remote | Polipo denial of service via malformed HTTP Range header |
| CVE-2021-38614 | Remote | Polipo heap buffer overflow in Range handling |
| CVE-2021-31799 | Local | Ruby RDoc command injection via crafted filenames |
| CVE-2021-31810 | Remote | Ruby Net::FTP PASV response abuse (connection redirection / scanning) |
| CVE-2021-32066 | MITM | Ruby Net::IMAP STARTTLS stripping due to improper failure handling |
Systems Analysis & Methodology
The Fieldbook
The Fieldbook, Applied Cybernetic Necromancy in Haunted Infrastructure, is a technical book on failure analysis and repair in long-lived infrastructure.
It develops a field method around semantic authority, contracts and invariants, boundary failure, artifact truth, semantic drift, folklore, institutional memory, intervention, verification, and durable findings. The method treats technical components and operators as one coupled system and asks where an operation’s meaning is actually enforced when its representations disagree.
This is also the method I use in security work: read the implementation, identify authority and trust boundaries, test the invariants those boundaries are supposed to enforce, and include operational practice and institutional memory when they materially shape system behavior.
Protocol Analysis & Wireshark Contributions
Work focused on reverse engineering and improving Oracle TNS protocol support in Wireshark.
Highlights
- Added DATA message dissection helpers
- Implemented Set Protocol parsing
- Fixed Oracle 12c packet length handling
- Added SNS message parsing (Version, Services)
- Extended authentication and session key handling
- Static analysis cleanup
This work improved correctness and visibility of TNS traffic in real-world analysis scenarios.
Linux Kernel Contribution
- Input:
elan_i2c— added support for ELAN0618 (Lenovo V330-15IKB)
Additional work includes custom kernel patches for wireless security testing and device-specific kernel modifications.
Additional Accepted Upstream Work
Perl 5
Accepted fixes in core C sources and documentation, including
interpreter, regex, and portability code; I am listed in Perl’s
upstream AUTHORS file.
Other small accepted fixes include va_list cleanup
in XMRig, a
memory leak fix in zlog, and a
broken brute-force invocation in XSStrike.
Research & Submitted Patches
Nmap
- NSE script for Oracle TNS poisoning detection
- Fixes for TNS version detection
- Additional experimental NSE scripts
Aircrack-ng
- Patch adding manufacturer identification to client listings
Notes
Most work here originates from practical research: protocol behavior under edge conditions, real attack surfaces, and toolchain gaps discovered during testing.