Nicolas Waisman

Nicolas Waisman, known throughout the security community as "Nico Waisman," is an Argentine security researcher whose career centers on offensive software security and, in particular, heap-exploitation techniques. Conference bios describe him as having "experience in all areas of offense-related software security, from vulnerability analysis to exploit and trojan development," with heap exploitation singled out as the specialty that earned him international recognition.

Immunity, Inc.

Waisman joined Immunity, Inc. — the offensive-security firm founded by Dave Aitel — in February 2004, and mailing-list records confirm he was still active there as late as 2018-2020. His first public advisory, posted to the Bugtraq and Full-Disclosure lists on November 26, 2004, described a Windows vulnerability granting remote unauthenticated system access, distributed through Immunity's subscription-based Vulnerability Sharing Club. Over the following years he took on an organizing role within the company as well, announcing talk schedules and keynote speakers for Immunity's Infiltrate conference (2011-2013) and running the company's annual "Hack Cup" indoor-soccer tournament held alongside Black Hat and DEF CON in Las Vegas. By 2018, conference bios listed him as Immunity's Vice President of Latin America.

Conference Research

Waisman has presented original vulnerability research at major security conferences. At Black Hat USA 2010 (and again at New Zealand's Kiwicon 4 that November) he delivered "Aleatory Persistent Threat," covering a use-after-free vulnerability in Internet Explorer 8 and associated heap-crafting exploitation techniques. In 2018 he returned to Black Hat USA and to Argentina's ekoparty conference with "The Unbearable Lightness of BMC's," co-presented with fellow Immunity researcher Matías Soler, demonstrating a reliable remote-code-execution chain against Baseboard Management Controllers that allowed bidirectional movement between a server and its BMC — a serious data-center lateral-movement and backdoor risk.

GitHub Security Lab

By 2020, Waisman was working as a security researcher with GitHub's Security Lab team. He authored a March 2020 GitHub blog post describing a partnership with CERT to automate open-source vulnerability remediation, and was credited as a contributor to the Security Lab's May 2020 writeup on the "Octopus Scanner" malware, which targeted the open-source supply chain via infected NetBeans projects. He does not appear on GitHub Security Lab's current public team roster, suggesting he has since moved on, though no source documents where.

Waisman maintains a GitHub account (nicowaisman), listing a Seattle, Washington location, with public repositories reflecting continued reverse-engineering interests, including a Ghidra processor-module extension and a CodeQL security-research workshop.

Timeline

• 2004-02Joins Immunity, Inc. as an offensive-security researcher.
• 2004-11-26Publishes a Windows remote-code-execution advisory via Immunity's Vulnerability Sharing Club, posted to Bugtraq and Full-Disclosure.
• 2010-07-28Presents "Aleatory Persistent Threat" (Internet Explorer 8 use-after-free / heap-crafting research) at Black Hat USA 2010.
• 2010-11-27Repeats "Aleatory Persistent Threat" at Kiwicon 4 in New Zealand.
• 2011-04-01Delivers "How to FAIL at [Fuzzing]" at Immunity's Infiltrate 2011 conference in South Beach, Florida.
• 2013-06-10Announces the fourth annual "Hack Cup" tournament tied to Black Hat week in Las Vegas.
• 2018-08-08Co-presents "The Unbearable Lightness of BMC's" with Matías Soler at Black Hat USA 2018, identified as Immunity's Vice President of Latin America.
• 2018-09-27Repeats the BMC research talk at ekoparty 14 in Buenos Aires.
• 2020-03-18Authors a GitHub Security Lab blog post on a CERT partnership for automated vulnerability remediation, identifying him as part of the GitHub Security Lab team.
• 2020-05-28Credited as a contributor to GitHub Security Lab's "Octopus Scanner" malware research.