Cesar Cerrudo

Cesar Cerrudo is an Argentine computer security researcher, born and raised in Paraná, Entre Ríos, who built a career spanning more than two decades of vulnerability research and critical-infrastructure security advocacy. He is one of Argentina's most prominent security researchers.

Cerrudo's early career centered on database and operating-system security. Beginning in the early 2000s, he was credited with discovering and reporting numerous vulnerabilities in Microsoft SQL Server, including a buffer overflow in the SQL Server 7.0 and 2000 openrowset/opendatasource functions (documented as CERT/CC VU#619707), as well as multiple Windows privilege-escalation flaws addressed in Microsoft security bulletins. In 2005 he presented research on Microsoft SQL Server and Oracle database security at Black Hat USA. Around this period he founded Argeniss, a boutique security research and consulting company based in Argentina.

IOActive and Smart City Research

In May 2011, Argeniss was acquired by the Seattle-based security firm IOActive, and Cerrudo was named Chief Technology Officer of IOActive Labs. In this position he directed research spanning ICS/SCADA systems, IoT devices, automotive security, and mobile platforms. His most widely publicized work came in 2014, when he presented findings at DEF CON 22 showing that roughly 200,000 wireless traffic-control sensors used in cities including New York, Washington D.C., San Francisco, London, and Melbourne transmitted data without encryption or authentication, making them susceptible to tampering that could disrupt traffic signals and speed-limit signs.

Building on this research, in 2015 IOActive published Cerrudo's white paper on smart-city cybersecurity risks, and he co-founded Securing Smart Cities, a non-profit initiative backed by IOActive, Kaspersky Lab, Bastille, and the Cloud Security Alliance aimed at helping cities and vendors adopt baseline security practices for connected urban infrastructure.

Community Involvement and Legacy

Cerrudo has been a long-standing presence at Ekoparty, Argentina's premier hacking conference; in 2018 he received Ekoparty's Premio a la Trayectoria (Lifetime Achievement Award). In 2023 he published a Spanish-language book on digital security and helped launch Ekoparty's "Programa Futuro Hacker," a school outreach program. Cerrudo's work is frequently cited as helping bring international visibility to Latin America's security research community and to the broader field of smart-city and embedded critical-infrastructure security.

Timeline

• 2002-02-19Publicly disclosed a buffer overflow in Microsoft SQL Server 7.0/2000's openrowset and opendatasource functions.
• 2005Presented database security research at Black Hat USA; founded the security firm Argeniss in Argentina.
• 2011-05Argeniss was acquired by IOActive; Cerrudo was named Chief Technology Officer of IOActive Labs.
• 2014-08-08Presented 'Hacking US Traffic Control Systems' at DEF CON 22, revealing roughly 200,000 vulnerable wireless traffic-sensor devices worldwide.
• 2015Co-founded the Securing Smart Cities non-profit initiative.
• 2018Received Ekoparty's Premio a la Trayectoria (Lifetime Achievement Award).
• 2023Published a Spanish-language cybersecurity book and helped launch Ekoparty's 'Programa Futuro Hacker' school outreach program.