Dino Dai Zovi

Dino Dai Zovi is an American computer security researcher known for offensive security research on Apple platforms, for his role in the origin of the Pwn2Own hacking contest, and for co-founding several security companies. He earned a B.S. in Computer Science from the University of New Mexico.

Early Research: KARMA and Pwnie Awards Origins

In 2004, Dai Zovi and Shane Macaulay published some of the first public details of the KARMA attack, which abuses Wi-Fi client devices that broadcast their list of previously connected networks, allowing an attacker to impersonate a trusted access point. In 2007, following his own discovery of a cross-platform QuickTime vulnerability and Alexander Sotirov's discovery of a Windows ANI-file vulnerability, the two researchers co-founded the Pwnie Awards.

Pwn2Own 2007

Dai Zovi is closely associated with the first-ever Pwn2Own contest, held at CanSecWest in Vancouver in April 2007. Working overnight, he found and exploited a previously unknown vulnerability in the QuickTime library as loaded by Safari on Mac OS X. Because the contest required competitors to be physically present and Dai Zovi was not at the conference, his acquaintance Shane Macaulay hosted the exploit on a website to claim the MacBook Pro prize on Dai Zovi's behalf, while Dai Zovi separately sold the underlying vulnerability to TippingPoint's Zero Day Initiative for $10,000.

Books and Company Leadership

Dai Zovi went on to co-author two influential technical books on Apple platform security: 'The Mac Hacker's Handbook' (2009), written with Charlie Miller, and 'iOS Hacker's Handbook' (2012). In 2012, Dai Zovi co-founded the New York-based security research and consulting firm Trail of Bits alongside Alexander Sotirov and Dan Guido. In 2016, he co-founded Capsule8, a startup focused on Linux and cloud/container security; Capsule8 was acquired by Sophos in July 2021.

Legacy

Dai Zovi's 2007 exploit is widely credited as the win that established Pwn2Own as an annual fixture of the security research calendar. Alongside his books and the Pwnie Awards, his work is frequently cited as foundational to the emergence of Apple/Mac platform security research as a distinct area of offensive security study.

Timeline

• 2004Co-published, with Shane Macaulay, early details of the KARMA Wi-Fi client attack.
• 2007-04Found and exploited a zero-day QuickTime-in-Safari vulnerability at the first CanSecWest Pwn2Own contest.
• 2007Co-founded the Pwnie Awards with Alexander Sotirov.
• 2009Co-authored 'The Mac Hacker's Handbook' with Charlie Miller.
• 2012Co-founded the security research firm Trail of Bits.
• 2016Co-founded Linux/cloud security startup Capsule8.
• 2021-07Capsule8 was acquired by Sophos.