Martin Balao Alonso Email & Phone Number

Westford, Massachusetts, United States

I dedicate most of my time to the OpenJDK project, with special focus on the Security and Vulnerability groups. I currently hold a Committer role for the JDK development-line and a Reviewer one for stable releases [1].Some of the areas where I have been involved lately: - Enhancement of security libraries (PKCS#11 and NSS cryptography, GSS, Kerberos, TLS) - Security code reviews - Vulnerability research and analysis - Exploit writing - Security fix developmentIn addition to OpenJDK, I make contributions to OpenJDK derivatives in Red Hat Enterprise Linux and Fedora operating systems.My work involves critical code deployed across multiple operating systems and architectures. I organize my time in quarterly cycles, with a 50-50 assignment between software development and vulnerability work in each one.I am part of an engineering team at Red Hat, spread across North America and Europe. On a daily basis, I interact with other OpenJDK contributors, with several teams at Red Hat and with external customers after case escalation.--[1] - https://openjdk.java.net/census#mbalao

Some of the activities and initiatives I performed as part of the Core Labs Research Team at Core Security: - Open source tools development and maintenance with focus on Pcapy (PCAP for Python)- Analyzed current security attacks and technologies, contributing to the company products and assets- Organized and led the quarterly bug hunting week across the company- Promoted research and innovation giving internal talks- Conducted the Dalvik VM post-exploitation and privilege escalation research, which involved process injection on Linux ARM (Android) and VM internals analysis. This research was presented at the EkoParty Security Conference (2014) and won the Core Security Innovation Awards.

As a Senior Security Developer, I've been involved in the design, development and extension of different Core Impact components (US7757293 patent). In example:- Python VM and Core Impact kernel internals- Syscalls proxing architecture - Binary malware development for multiple OS and architectures (Windows, Linux, OS X, Android, x86, x86_64)- Wifi Man-in-the-Middle platform- Network pre-exploitation and post-exploitation modulesSome of my daily tasks and technologies involved:- IDA Pro assembly-level reversing and debugging on different architectures and operating systems (GDB for PowerPC architecture)- Network traffic and protocols analysis (Ethernet, TCP/IP, UDP, SSL, DNS, HTTP, etc.)- OS APIs and internals- Application Binary Interfaces (ABIs) and kernel calling conventions- Windows kernel network filtering platform- PE, PE+, ELF binaries and dynamic linking- OS dynamic symbol resolution- Process injection and dynamic forking techniques- Assembly eggs programming- Multi-threading programming and bug analysis- Python, C++ and C programmingI worked using an agile-based software engineering methodology, which included: code-review (for internal and external teams), peer-programming sessions, code refactoring, functional test-cases development, effort estimation, risk management and team coordination. I held a technical lead role in the team.

Digital signatures software product for servers & mobile devices. Generation and validation of digital signatures for the electronic invoicing system in Uruguay. XML Digital Signature and WS-Security signing implementation. High security and availability constraints (keys management, HMAC authenticated log generation, DB symmetric ciphering of sensitive information, authenticated communication channels). Public certificates (X509), private keys and Certificate Revocation Lists management. Communication with Hardware Security Modules, signing tokens (PKCS11 standard) and PKCS12 keystores. Communication with external applications through SOAP webservices. Extensive use of the Java Cryptographic Architecture (JCA). Other technologies involved in this project: Apache Xerces, Log4J, Hibernate, Dalvik VM (Android). Development of a custom and automated testing platform for functional regression. This product is currently working in medium and large scale organizations in Uruguay.I technically led this project from requirements engineering, to architectural design, implementation and testing.

- Consulting in the design and implementation of the National Public Key Infrastructure in Uruguay. Root certification authority and subordinate certification authority. Certification policies and certification practices statement definition. Architectural, functional and security design. Key generation ceremony. This project had high security constraints and public exposure.- Design of a secure communication protocol for a home automation application in the context of high hardware constraints. Mutual authentication (pre-shared keys, challenge-response mechanism). Security against replay attacks. HMAC, PBKDF2, WPA2 derivative keys generation and PRNG functions analysis. - Forensics analysis for payment card applications (PA-­DSS). - Pentesting of bank and financial services applications. - Security assessments in medium and large scale organizations (ISO 27000, OWASP and PCI­‐DSS standards).

Embedded Systems, Electronics Engineering

90% completed.

Computer Engineer, Computer Engineering