Rafal Wojtczuk

Background

Rafal Wojtczuk is a computer security researcher from Poland who holds a master's degree in computer science from the University of Warsaw. He began publishing security research in the late 1990s, at a time when memory-corruption exploitation techniques and kernel-level vulnerabilities were an active frontier of offensive security research.

Early Exploitation Research

Wojtczuk's early work focused on defeating operating system exploit mitigations and finding kernel-level flaws. Around 1998 he published research on defeating Solar Designer's non-executable stack patch for Linux, one of the earliest widely deployed anti-exploitation defenses. He went on to identify a BSD procfs vulnerability (2000) and a Linux ptrace vulnerability (2001), and in 2002 he published an influential paper on "advanced return-into-lib(c)" exploitation, extending return-oriented exploitation techniques used to bypass non-executable stack protections. In 2003 he reported a vulnerability in SELinux, and in 2005 he authored a tool for automatic discovery of integer-overflow bugs in Win32 binaries. During this period he also authored libnids, a low-level network packet reassembly library used in intrusion-detection tooling.

Move into Virtualization Security

Prior to 2008, Wojtczuk worked at McAfee's Avert Labs, where he continued research into kernel and OS security. In July 2008 he joined Invisible Things Lab (ITL), a boutique research and consulting firm founded by Joanna Rutkowska that specialized in operating-system and virtualization security. At ITL, Wojtczuk shifted his research focus to hypervisor and virtual-machine-monitor (VMM) security, an area that was, at the time, largely unexplored from an offensive-security perspective.

The Xen 0wning Trilogy

In August 2008, Wojtczuk co-presented a three-part Black Hat USA briefing known as the "Xen 0wning Trilogy," alongside Joanna Rutkowska and Alexander Tereshkin. In the first part, "Subverting the Xen Hypervisor," Wojtczuk demonstrated reliable and portable DMA-based attacks that could escalate access from a Xen management domain (Dom0) into hypervisor memory, and introduced "Xen Loadable Modules," a mechanism for loading arbitrary code modules into a running Xen hypervisor. Using this technique, he presented what were described as the first working Xen hypervisor rootkits. In the second part, "Detecting and Preventing the Xen Hypervisor Subversions," presented jointly with Rutkowska, Wojtczuk examined how Intel VT-d technology was used in Xen 3.3 to protect the hypervisor from such attacks, and demonstrated ways to bypass VT-d protections on certain motherboards. This body of work is widely cited as foundational research in hypervisor rootkit and virtualization-escape security.

Bromium and Later Research

Wojtczuk later became a Security Architect at Bromium, a virtualization-based endpoint security company, where he continued researching vulnerabilities in operating system kernels and virtualization platforms including Xen, VMware, and Microsoft's virtualization products. In 2015, writing for the Bromium Labs blog, he published a detailed technical analysis of CVE-2014-9322, nicknamed "BadIRET," a Linux kernel privilege-escalation vulnerability arising from improper handling of a stack-segment fault during an IRET instruction. His writeup detailed how the flaw could be exploited to gain kernel-mode code execution and examined which contemporary CPU mitigations, such as SMEP and SMAP, could block exploitation. He also continued to present research at Black Hat conferences (including Black Hat USA 2014 and 2016), maintaining a public profile as a specialist in virtualization and low-level kernel exploitation.

Significance and Legacy

Wojtczuk's career spans two distinct but connected eras of offensive security research: the early-2000s development of memory-corruption exploitation techniques against hardened operating systems, and the later emergence of virtualization and hypervisor security as attackers and defenders began to take VM-escape threats seriously. His Xen hypervisor rootkit research with Invisible Things Lab is frequently cited as some of the earliest practical demonstration that hypervisors themselves could be subverted, influencing subsequent hardware and hypervisor security features such as improved IOMMU/VT-d protections. His later work at Bromium extended this focus into kernel privilege-escalation research relevant to both cloud and endpoint security.

Timeline

• 1998Published research on defeating Solar Designer's non-executable stack patch for Linux.
• 2000Identified a vulnerability in BSD procfs.
• 2001Identified a Linux ptrace vulnerability.
• 2002Published the "Advanced return-into-lib(c)" paper on exploitation techniques.
• 2003Reported a vulnerability in SELinux; libnids TCP reassembly flaw (CVE-2003-0850) was also disclosed this year.
• 2005Authored a tool for automatic integer-overflow discovery in Win32 binaries.
• 2008-07Joined Invisible Things Lab after previously working at McAfee Avert Labs.
• 2008-08Co-presented the "Xen 0wning Trilogy" at Black Hat USA with Joanna Rutkowska and Alexander Tereshkin, demonstrating Xen hypervisor rootkits.
• 2014Presented research at Black Hat USA 2014 while working in virtualization/kernel security.
• 2015-02Published, as Bromium Security Architect, a technical analysis of the CVE-2014-9322 ("BadIRET") Linux kernel privilege-escalation vulnerability.
• 2016Presented research at Black Hat USA 2016.