Mark Dowd

Background

Mark Dowd is an application-security researcher and exploit developer from Sydney, Australia, known in the security community by the handle "mdowd." He spent several years as a senior researcher at Internet Security Systems (ISS) X-Force, an IBM-owned security research group, where he built a reputation for identifying deep, low-level vulnerabilities in widely used server and client software. He later worked as a principal security architect for McAfee before moving into independent and commercial vulnerability research full time.

Vulnerability Research Career

During his time at ISS X-Force and afterward, Dowd was credited with discovering and helping to remediate serious flaws in software including Sendmail, Microsoft Exchange Server, OpenSSH, Internet Explorer, Mozilla Firefox, Checkpoint VPN products, and Microsoft's SSL implementation. This body of work spanned mail servers, network security appliances, and web browsers, reflecting a focus on memory-corruption and logic flaws in software that handled untrusted, attacker-controlled input.

The Art of Software Security Assessment

In 2006, Dowd co-authored, with John McDonald and Justin Schuh, "The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities," published by Addison-Wesley. The book became a widely cited reference in the vulnerability-research field, covering source-code auditing techniques, common vulnerability classes, and platform-specific security issues across Unix/Linux and Windows environments.

Black Hat 2008 and Browser Exploitation Research

In 2008, Dowd presented alongside fellow researcher Alexander Sotirov at Black Hat USA on browser memory-protection bypasses, in a talk titled "How to Impress Girls with Browser Memory Protection Bypasses." The presentation examined techniques for defeating exploit mitigations such as ASLR, DEP, GS stack cookies, and SafeSEH on Windows, and became one of the more widely referenced talks in the browser-exploitation research community during that period.

Azimuth Security

In 2008, Dowd co-founded Azimuth Security with fellow researcher John McDonald. Azimuth operated as a boutique firm specializing in in-depth source-code review, vulnerability research, and custom exploit development, working primarily with government clients in Australia, the United States, and allied countries. The company built a small, highly technical team focused on finding and weaponizing vulnerabilities in mobile operating systems, browsers, and other high-value software targets.

The San Bernardino iPhone Exploit

Azimuth gained public attention years after the fact for its role in a 2016 case: following the December 2015 San Bernardino terrorist attack, the FBI sought a way to unlock an iPhone 5C belonging to one of the shooters without triggering its data-erasure feature. According to reporting, Dowd had earlier identified a vulnerability in Mozilla open-source code that Apple used for handling accessories connected through the iPhone's Lightning port. Azimuth researcher David Wang combined this flaw with two additional vulnerabilities he found to build an exploit chain, internally nicknamed "Condor," that gave attackers control over the phone's core processor and allowed unlimited passcode guesses. In March 2016, the FBI tested and purchased the exploit from Azimuth for a reported $900,000, resolving a high-profile legal standoff between the U.S. government and Apple over whether Apple could be compelled to help unlock the device. Azimuth's involvement was not publicly confirmed until investigative reporting, including by The Washington Post, identified the firm in April 2021.

Later Career and Legacy

In 2018, Azimuth Security was acquired by the U.S. defense contractor L3 Technologies, and its operations were later folded into what became L3Harris Trenchant. Dowd has continued to be active in the offensive-security research community, appearing as a speaker at conferences such as OffensiveCon, and has been associated with later ventures including the security research outfit Vigilant Labs. His career, spanning corporate vulnerability disclosure, a foundational security textbook, and one of the most consequential government exploit acquisitions of the smartphone era, illustrates the trajectory of elite vulnerability researchers from public disclosure work toward the commercial and government-contracted exploit-development industry.

Timeline

• 2006-11Co-authored The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities with John McDonald and Justin Schuh, published by Addison-Wesley.
• 2008Presented "How to Impress Girls with Browser Memory Protection Bypasses" with Alexander Sotirov at Black Hat USA.
• 2008Co-founded Azimuth Security with John McDonald as a boutique vulnerability-research and exploit-development firm.
• 2016-03Azimuth Security, using an exploit chain built from a vulnerability Dowd discovered, helped the FBI unlock the San Bernardino shooter's iPhone 5C; the FBI purchased the exploit for a reported $900,000.
• 2018Azimuth Security was acquired by U.S. defense contractor L3 Technologies.
• 2021-04The Washington Post and other outlets publicly identified Azimuth Security and its role in the San Bernardino iPhone unlock, years after the fact.