David Litchfield

David Litchfield is a British computer security researcher best known for extensive vulnerability research into Oracle Database and Microsoft SQL Server, and for co-founding the security consultancy Next Generation Security Software (NGSSoftware, later known as NGS). Along with his brother Mark Litchfield, he was named among the "World's Best Bug Hunters" by Information Security magazine in December 2003.

Early career and Cerberus

Before founding NGSSoftware, Litchfield established Cerberus Information Security, a UK-based security consultancy of unrecorded founding date. Cerberus was acquired by the U.S. security firm @stake in 2000. He subsequently co-founded Next Generation Security Software (around 2001, per Wikipedia) alongside colleagues and family members, reportedly including his brother Mark and his father.

SQL Server research and the SQL Slammer worm

In July 2002, Litchfield presented proof-of-concept exploit code for a buffer-overflow vulnerability in Microsoft SQL Server 2000 at the Black Hat Briefings. Per Wikipedia's account of the SQL Slammer worm, that code became the template for the worm that spread rapidly across the internet on January 25, 2003, exploiting the underlying flaw (CVE-2002-0649) roughly six months after Microsoft had already made a patch available. Litchfield's disclosure and demonstration predate and are distinct from the worm itself, which was written and released by unknown parties; the episode is frequently cited as an early, stark illustration of the gap between patch availability and real-world exploitation.

Database security research and publications

Litchfield built a reputation as one of the most prolific researchers targeting commercial database software, credited with discovering large numbers of flaws in Oracle, Microsoft, and IBM products over the course of his career. He later focused increasingly on Oracle database forensics, publishing a multi-part "Oracle Forensics" whitepaper series and developing an open-source tool called the Forensic Examiner's Database Scalpel (F.E.D.S).

He co-authored The Shellcoder's Handbook: Discovering and Exploiting Security Holes (Wiley, 2004) with Jack Koziol, Dave Aitel, Chris Anley, Sinan "noir" Eren, Neel Mehta, and Riley Hassell. He also co-authored The Database Hacker's Handbook: Defending Database Servers (Wiley, 2005) with Chris Anley, John Heasman, and Bill Grindlay, and wrote The Oracle Hacker's Handbook: Hacking and Defending Oracle (Wiley, 2007) as sole author, in addition to contributing to SQL Server Security.

Recognition and later career

NGSSoftware received several industry and national honors during Litchfield's tenure, including the Queen's Award for Enterprise (2007) and an SC Award for Best Security Company in Europe (2008). Wikipedia's article on Litchfield also states he later held the title "Director of Information Security Assurance" at Apple; this specific claim could not be independently corroborated during this research (no second source was found) and should be treated as unverified. Likewise, his exact birth date and the precise founding date of NGSSoftware are not firmly pinned down in available sourcing — only the birth year (1975) and an approximate founding year (2001) are given by Wikipedia, which itself carries no inline citations for several biographical details.

Timeline

• 2000Cerberus Information Security, the consultancy Litchfield had founded, was acquired by @stake.
• 2001Co-founded Next Generation Security Software (NGSSoftware) with brother Mark Litchfield and reportedly other family members (year approximate, per Wikipedia).
• 2002-07Presented proof-of-concept exploit code for a Microsoft SQL Server 2000 buffer-overflow vulnerability at Black Hat Briefings.
• 2003-01-25SQL Slammer worm spreads globally, based on the buffer-overflow flaw (CVE-2002-0649) Litchfield had disclosed and demonstrated.
• 2003-12Named, with brother Mark Litchfield, among 'World's Best Bug Hunters' by Information Security magazine.
• 2004Co-authored The Shellcoder's Handbook: Discovering and Exploiting Security Holes (Wiley).
• 2005Co-authored The Database Hacker's Handbook: Defending Database Servers (Wiley).
• 2007Authored The Oracle Hacker's Handbook: Hacking and Defending Oracle (Wiley); NGSSoftware received the Queen's Award for Enterprise.
• 2008NGSSoftware received an International Trade Award for Innovation and an SC Award for Best Security Company in Europe.