James Forshaw

James Forshaw is a British computer security researcher best known for his long-running, highly technical work on Microsoft Windows internals and for his role on Google's Project Zero vulnerability research team. Before joining Google, he worked at Context Information Security in the UK, appearing at Black Hat USA 2012 as a principal consultant for the firm and by Black Hat USA 2014 as its Head of Vulnerability Research.

While still at Context Information Security, Forshaw built a reputation in competitive and bounty-driven vulnerability research. At the March 2013 Pwn2Own contest in Vancouver, he independently exploited Oracle Java to win a $20,000 prize. Later that year, on October 10, 2013, Microsoft announced he had been awarded $100,000 through its Mitigation Bypass Bounty program — at the time the largest single payout in the program's history — for demonstrating a general Windows exploit-mitigation bypass technique.

Project Zero

Forshaw joined Google's newly formed Project Zero team in 2014. From this position he produced a large body of published research into Windows security internals, including privilege-escalation bugs in access tokens, COM and DCOM, RPC servers, named pipes, the .NET runtime, and legacy scripting engines. Notably, in December 2017 he co-authored the Project Zero post "aPAColypse now," detailing a chain of vulnerabilities in the WPAD/PAC network-configuration mechanism and the JScript engine that allowed a local-network attacker to fully compromise a Windows 10 machine.

Books and Legacy

Forshaw distilled his research methodology into two influential technical books published by No Starch Press: Attacking Network Protocols (2017), a guide to reverse-engineering and exploiting custom network protocols, and Windows Security Internals (2024), a deep examination of the Windows security reference monitor and authentication protocols. He also created and maintains widely used open-source security tooling, including the Canape network protocol analysis framework. His sustained output has made him one of the most cited independent voices in Windows exploitation research.

Timeline

• 2013-03Wins $20,000 at Pwn2Own for independently exploiting Oracle Java on Windows 8.
• 2013-10-10Awarded $100,000 by Microsoft's Mitigation Bypass Bounty program, at the time the largest single payout in the program's history.
• 2014Joins Google's newly formed Project Zero team.
• 2017-12-08Publishes the book Attacking Network Protocols through No Starch Press.
• 2017-12-18Co-authors the Project Zero post 'aPAColypse now,' detailing a Windows 10 exploit chain via WPAD/PAC and JScript.
• 2024-04-30Publishes the book Windows Security Internals through No Starch Press.