Elias Levy

Elias Levy is a Venezuelan computer scientist better known in the security community by his handle "Aleph One." He is best remembered as the author of "Smashing The Stack For Fun And Profit," a tutorial published in Phrack Magazine, Volume Seven, Issue 49, dated November 8, 1996, which walks the reader through the mechanics of stack layout and how overflowing a stack-allocated buffer can be used to redirect program execution.

Impact of the Phrack Paper

"Smashing The Stack For Fun And Profit" is widely described as the first high-quality, publicly available, step-by-step introduction to stack-based buffer overflow exploitation. While buffer overflows had already been exploited in the wild (most famously by the 1988 Morris worm), Levy's article is generally credited with systematizing the technique into a reproducible methodology for a broad audience. It became a foundational reference for a generation of exploit developers.

Bugtraq and the Full-Disclosure Movement

Levy moderated Bugtraq, the security mailing list originally founded by Scott Chasin in 1993, from 1996 until October 15, 2001. Under his moderation the list grew from a few thousand subscribers to tens of thousands, becoming the primary venue through which independent researchers publicly disclosed software vulnerabilities, often before or without a vendor patch being available.

SecurityFocus and the Symantec Acquisition

In 1999 Levy co-founded SecurityFocus alongside Oliver Friedrichs, Alfred Huger, and Arthur Wong, serving as the company's Chief Technology Officer. Bugtraq was folded into SecurityFocus's offerings. Symantec acquired SecurityFocus on August 6, 2002, a sale that drew criticism from parts of the community and is frequently cited as part of the backdrop to the creation of the separate Full-Disclosure mailing list in mid-2002.

Legacy

Levy stepped down as Bugtraq moderator shortly before the Symantec acquisition closed. His enduring legacy rests on the combination of the Phrack paper, which helped train a generation of exploit developers, and his stewardship of Bugtraq during the formative years of vulnerability disclosure as practiced today.

Timeline

• 1996-11-08Under the handle 'Aleph One,' Levy publishes 'Smashing The Stack For Fun And Profit' in Phrack, issue 49.
• 1996Becomes moderator of the Bugtraq mailing list.
• 1999Co-founds SecurityFocus and becomes its CTO; Bugtraq moves to SecurityFocus.
• 2001-10-15Steps down as Bugtraq moderator after roughly five years.
• 2002-08-06Symantec acquires SecurityFocus.