Liang Chen

Background

Liang Chen is a Chinese computer security researcher who holds an undergraduate degree from Shanghai Jiao Tong University and a master's degree from Fudan University. He is a co-founder and senior security researcher at Tencent Keen Security Lab (KeenLab), a Shenzhen-based offensive security research team that operated for years under the name Keen Team before its acquisition by Tencent. His research has focused primarily on software vulnerability discovery and exploitation, with particular attention to web browser security on both desktop and mobile platforms, and to sandbox escape techniques used to break out of the restricted execution environments that protect modern operating systems.

Rise at Pwn2Own

Chen and his colleagues at Keen Team first drew wide attention after winning the iPhone Safari category at Mobile Pwn2Own in 2013. The team followed this in March 2014 by defeating Apple's Safari browser running on OS X Mavericks at the main Pwn2Own contest in Vancouver, earning $65,000 using a heap-overflow-and-sandbox-bypass exploit chain that Chen said took roughly three months to develop. In press interviews at the time, Chen described locking himself away for weeks of preparation and praised the strength of Apple's underlying security architecture even as his exploit defeated it. In the same 2014 contest, other Keen Team members separately defeated Adobe Flash on Windows 8.1, reinforcing the team's reputation as one of the most capable non-Western entrants in the competition's history.

Leadership at Keen Lab

Following Tencent's acquisition of Keen Team, Chen continued as a lead researcher and project leader for Pwn2Own efforts inside the renamed Tencent Keen Security Lab. In March 2016 he led Tencent Security Team Sniper to the "Master of Pwn" title at Pwn2Own, and later that year led a team, working alongside researchers including Marco Grassi, Wayne Liang, and Yubin Fu, to a Master of Pwn win at Mobile Pwn2Own 2016. That contest saw the team install a rogue application on a Nexus 6P running Android Nougat and separately compromise an iPhone 6S running iOS 10.1 by chaining a use-after-free bug in the browser renderer with a memory-corruption bug in the sandbox, working overnight after Apple released an unexpected iOS update the day before the event. The team earned roughly $215,000 across its exploits that year. Chen's team went on to take Master of Pwn again at Mobile Pwn2Own 2017.

Other Research and Legacy

Beyond competition work, Chen contributed to the development of the Keen Jailbreak tools for iOS 10.3.2 and iOS 11.1.1, and has presented research at security conferences including XCON, Black Hat USA and Europe, CanSecWest, REcon, and POC. Within Keen Team and later Keen Lab, members described their motivation less in terms of the term "hacker" and more as defensive research intended, in their words, to "better safeguard the system." Chen's sustained record of browser and mobile exploitation over multiple years helped establish Tencent Keen Security Lab as a globally recognized vulnerability research organization and contributed to a broader wave of Chinese teams becoming dominant forces at Pwn2Own through the mid-to-late 2010s.

Timeline

• 2013Wins the iPhone Safari category at Mobile Pwn2Own 2013 as a member of Keen Team.
• 2014-03Wins the Mavericks Safari category at Pwn2Own 2014 in Vancouver, earning $65,000 with a heap-overflow-and-sandbox-bypass exploit chain.
• 2016-03Leads Tencent Security Team Sniper to the "Master of Pwn" title at Pwn2Own 2016.
• 2016-10Leads Tencent Keen Security Lab to "Master of Pwn" at Mobile Pwn2Own 2016, exploiting a Nexus 6P and an iPhone 6S running iOS 10.1.
• 2017Leads Tencent Keen Security Lab's team to "Master of Pwn" at Mobile Pwn2Own 2017.
• 2018Speaks at Black Hat USA 2018 as a representative of Tencent Keen Security Lab.