Michal Zalewski

Michał Zalewski, widely known by his handle lcamtuf, is a Polish-born computer security researcher whose work spans network protocol analysis, browser security, and automated vulnerability discovery. Born January 19, 1981, he grew up in Poland before moving to the United States in 2001. He became active in the security community in the mid-1990s, posting frequently to the Bugtraq mailing list and building a reputation as a prolific, largely self-taught vulnerability researcher on Unix-like systems.

In June 2000 Zalewski released p0f, a passive TCP/IP fingerprinting tool that identifies a remote host's operating system and network characteristics purely by observing existing traffic rather than sending active probes. This line of research into indirect, passive attack techniques culminated in his first book, Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks (No Starch Press, 2005).

Browser and Web Security Research

Zalewski subsequently turned his attention to the security of web browsers and web applications. While working at Google he wrote the open-source web security tools Ratproxy and Skipfish, both used for automated reconnaissance and vulnerability probing of web applications. This research was distilled into his second book, The Tangled Web: A Guide to Securing Modern Web Applications (No Starch Press, 2011), a detailed technical account of browser security mechanisms that became a standard reference in the field.

American Fuzzy Lop and Fuzzing

In November 2013, Zalewski released American Fuzzy Lop (afl), a coverage-guided, compile-time-instrumented fuzzer that used genetic-algorithm-style input mutation to maximize code-path coverage while remaining simple to deploy. afl's design proved dramatically effective, uncovering hundreds of previously unknown bugs in widely used software such as OpenSSL, PHP, Firefox, SQLite, and Bash. It quickly became the de-facto standard fuzzing tool in both industry and academic security research, with the community-maintained fork AFL++ later adopted by Google's OSS-Fuzz infrastructure.

Career at Google and Snap

Zalewski spent nearly 11 years at Google, where he led an international product-security engineering team responsible for code audits, penetration testing, and vulnerability management. He announced his departure from Google in March 2018, and shortly afterward joined Snap Inc. as Vice President of Security & Privacy Engineering.

Legacy

Zalewski's legacy in the security field rests chiefly on p0f's role in passive network reconnaissance, his systematic treatment of browser security, and afl's outsized influence in popularizing coverage-guided fuzzing as a mainstream software-testing and vulnerability-discovery technique.

Timeline

• 1981-01-19Born in Poland.
• 2000-06-10Releases p0f, a passive OS/network fingerprinting tool, announced on Bugtraq.
• 2005Publishes 'Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks'.
• 2007Joins Google, eventually leading its product/information security engineering team.
• 2011Publishes 'The Tangled Web: A Guide to Securing Modern Web Applications'.
• 2013-11Releases American Fuzzy Lop (afl), a coverage-guided fuzzer widely adopted in security research.
• 2018-03Announces his departure from Google after almost 11 years.
• 2018-04Joins Snap Inc. as VP of Security & Privacy Engineering.
• 2022-01Publishes 'Practical Doomsday: A User's Guide to the End of the World'.