Kai Lu Email & Phone Number

San Jose, California, Us

1. Focus on vulnerability hunting and exploitation research, analyze ITW 0-day exploits, develop fuzzers for vulnerability discovery, and write technical research blogs.2. Spoke my talk "Uncovering the Hidden Dangers of 3D Models in Microsoft 365: A Journey of Discovering 110+ Vulnerabilities in the SketchUp File Format in Office 3D Component" at Bluehat October 2023.

San Jose, California, Us

1. Focus on vulnerability hunting and exploitation research, analyze ITW 0-day exploits, develop fuzzers for vulnerability discovery, and write technical research blogs. 2. Discovered over 120 vulnerabilities in Microsoft’s products, Adobe Acrobat, and Apple’s products, and was recognized as the Top 1 on MSRC 2023 Q1 Security Researcher Leaderboard of the Microsoft Researcher Recognition Program. https://msrc.microsoft.com/blog/2023/04/congratulations-to-the-top-msrc-2023-q1-security-researchers/

Sunnyvale, Ca, Us

1. Analyze the vulnerabilities reported by me on macOS and write the research blog.2. Research new Emotet malware samples and analyzed them deeply, and wrote a research blog.3. Research on IcedID malware, I provided a comprehensive analysis report of this family malware.4. Research on Linux malware written in Golang and write research blogs5. Analyze a newly captured Thanos Ransomware and write a research blog.6. Write two tutorials about how to write an exploit of stack overflow vulnerability in ARM.7. Do a deep analysis of the WhatsApp double-free vulnerability (CVE-2019-11932) using the GEF-GDB Debugger, and provided a walkthrough of an exploit of this double-free vulnerability.8. Dive into the analysis and exploitation of BlueFrag CVE-2020-0022 for Android 8.0 and 9.0. At the end of April 2020, insinuator posted their new research blog about a Bluetooth RCE vulnerability CVE-2020-0022 on Android 8.0 and 9.0. The author gave a detailed analysis and some details about how to exploit, as well as test python scripts. Regarding the exploit, the author didn’t reveal the ROP chain in his post, just left the reader to finish it alone. In this post, I provide a dive into the analysis of this bug, and detail the exploitation by step-by-step debugging. In the end, I implemented the full ROP chain with 5 ROP gadgets by myself to complete the full exploit. The demo video is here.9. Research on WiFi router security. I present a walkthrough of an Exploit of Netgear WiFi router httpd buffer overflow vulnerability(CVE-2020-15416) and teach you how to set up a debugging environment using QEMU without the hardware.10. Fortiweb signature development

Sunnyvale, Ca, Us

1. Attend security conference and presented my researches as a speaker2. Research on macOS security. Hunting vulnerability on macOS and developing a freeware named FortiAppMonitor by myself. FortiAppMonitor is a powerful utility for monitoring system activities on macOS. It enables users to understand malware capabilities and quickly analyze the malicious behaviors of malware targeting macOS. Its capabilities include the following features: 1).Monitors process execution with command-line arguments and process exit. 2). Monitors all common file system events, including file open, read, write, delete, and rename operations. 3). Monitors network activities, including UDP, TCP, DNS query and response, and ICMP for both IPv4 and IPv6 protocols. 4). Monitors .dylib loading events. 5). Monitors KEXT loading and unloading events. It also provides a fine-grained filter so that users can set a filter for those event types they are interested in and powerful search functionality so users can quickly search through records based on the keywords. Users can also save all records into a JSON format file. In addition, all these FortiAppMonitor features are accessed through an easy-to-navigate GUI design. 3. Research on Android security. I focused on android malware analysis, wrote research blogs about the new android malware findings. And I did a deep dive into reverse engineering some popular packers, such as aijiami, bangcle, tencent etc. I attended and presented my research as a speaker, “Dig Deep into FlexiSpy for Android” at ToorCon 19 in 2017 in San Diego. 4. Research on macOS security.

Sunnyvale, Ca, Us

1. Develop BT DHT nodes and Emule KAD network nodes collecting and crawling system, as well as node verification using python. In this project, I used the thread pool to perform more efficiently the crawling and verification work, and also use the NOSQL db(mongodb) to save all node info.2. Develop DAC(deep application control) signatures, which are used to identify some behaviors related to cloud applications, video website, etc. These behaviors include file upload, download, and delete for cloud applications, whereas it includes what video you watched for a video website.3. Do Security research. Develop fuzzing tools to hunt vulnerabilities for most popular software vendors, such as Google, Microsoft, Adobe, Apple, Foxit, etc. Develop a PCRE fuzzing tool to fuzz the PCRE engine. 4. Research in android security, I found two vulnerabilities in the Android system. Android malware analysis, 5. Top 100 security researchers ranked by Microsoft. Fortinet was ranked at 33. We reported 11 vulnerabilities with CVE numbers to Microsoft. I reported 10 out of 11.6. Write research blogs

1. Vulnerability analysis and debugging, IPS signature development2. Develop the fuzzing tool to hunt bugs, report the findings to the vendor3. Handle the customer issues related to IPS signatures4. Maintain an internal system to collect the vulnerability attack PoCs from some different sources and do statistics for signature coverage.

Master'S Degree, Cryptography, Network Security

Bachelor'S Degree, Information Security