Matt Miller

Background and early publications

Matt Miller is an American security researcher who published for many years under the handle "skape". His personal site at hick.org, which carries the skape byline alongside the address mmiller [at] hick.org, collects the papers, tools and conference slides he produced from 2003 onward, and his GitHub account (epakskape) lists the same site as its homepage. His earliest published work, in January 2003, dealt with Unix and Linux topics: a paper on signing and verifying ELF executables and another on run-time process manipulation on Linux x86, accompanied by small utilities such as memgrep and libmelf hosted in his public code directory.

By the end of 2003 his focus had shifted to Windows. "Understanding Windows Shellcode" (December 2003) gave a detailed walkthrough of the structure and purpose of Windows payloads, covering reverse-connect, port-bind and file-descriptor-reuse techniques, and became a widely referenced primer on the subject. It was followed by "Remote Library Injection" (April 2004), which described loading a DLL directly into the memory of a remotely compromised process, and "Safely Searching Process Virtual Address Space" (September 2004), which introduced compact egg-hunt shellcode for locating a larger payload elsewhere in a process address space when the initial overflow allowed only a few bytes of code.

Metasploit and Meterpreter

Miller was a core developer of the Metasploit Framework from 2004 to 2008, working alongside project founder H. D. Moore and other contributors during the period in which the framework was rewritten in Ruby for its 3.0 release. In December 2004 he published "Metasploit's Meterpreter", the reference document describing the Meterpreter payload. Meterpreter, short for "The Meta-Interpreter", was designed as an in-memory post-exploitation payload whose functionality could be extended through shared-object (DLL) modules uploaded and injected into a running process after exploitation, avoiding writes to disk. Meterpreter remains a central component of Metasploit and its architecture influenced a generation of later post-exploitation agents.

Related work from the same period included "Post-Exploitation on Windows using ActiveX Controls" (Uninformed volume 1, May 2005), which described tunnelling attacker code through a trusted browser process to defeat outbound network filtering, and "Implementing a Custom X86 Encoder" (volume 5, September 2006), which walked through building a character-restricted payload encoder. In 2005 he presented "Beyond EIP" at Black Hat USA together with Metasploit developer spoonm.

The Uninformed journal

In 2005 Miller became involved with Uninformed, a technical journal describing itself as an outlet for research on security technologies, reverse engineering and low-level programming. Its about page lists skape first among the journal's editors, alongside rjohnson, trew and warlord. Ten volumes appeared between May 2005 and October 2008, and Miller was the most prolific contributor, with articles in every volume except the eighth as sole author or co-author on more than a dozen papers.

Several of these became standard references in Windows exploitation research. "Bypassing Windows Hardware-enforced DEP" (volume 2, September 2005), written with Skywing, showed how to execute code from non-executable stack and heap regions on default installations of Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1 without directly reprotecting memory. "Windows Kernel-mode Payload Fundamentals" (volume 3, January 2006), with bugcheck, decomposed kernel-mode payloads into four payload components and provided one of the first systematic treatments of the subject. "Bypassing PatchGuard on Windows x64" (also volume 3), again with Skywing, analysed the kernel patch protection introduced on 64-bit Windows and described ways around it. "Exploiting 802.11 Wireless Driver Vulnerabilities on Windows" (volume 6, January 2007), with Johnny Cache and H. D. Moore, documented fuzzing and exploiting wireless device drivers in kernel mode.

Defensive research and mitigation design

Miller's later Uninformed work moved from offense toward defense. "Preventing the Exploitation of SEH Overwrites" (volume 5, September 2006) proposed a runtime technique for defeating structured exception handler overwrites on 32-bit Windows without recompiling applications, by validating the integrity of the exception handler chain when an exception is dispatched. Windows subsequently shipped a mitigation of exactly this design, exposed today as the "Validate exception chains (SEHOP)" option, which checks that exception records lie within the stack, are aligned, contain no handler pointers into the stack, and terminate in a known final record.

"Reducing the Effective Entropy of GS Cookies" (volume 7, May 2007) analysed the stack cookie generated by Microsoft's /GS compiler flag and described how weak entropy sources could reduce its effective entropy by roughly 15 bits, noting that because /GS is a compile-time mechanism any weakness cannot simply be patched but requires affected applications to be rebuilt. Other papers in this period, including "Memalyze" on dynamic analysis of memory access behaviour, "Generalizing Data Flow Information", and "Improving Software Security Analysis using Exploitation Properties", reflected a growing interest in program analysis and in reasoning about exploitability independently of any single vulnerability.

Microsoft

Miller's own record of his talks groups a July 2008 USENIX WOOT presentation under Leviathan Security Group and lists his Blue Hat Fall 2008 talk, "The Evolution of Microsoft's Exploit Mitigations", under Microsoft, marking his move to the company. Over the following decade he worked on exploit mitigation within Microsoft and co-presented much of the company's public mitigation research: "The Evolution of Microsoft's Exploit Mitigations: Past, Present, and Future" at CanSecWest 2009 with Tim Burrell, taint-driven fuzzing work at CanSecWest 2011 with Dustin Duran and David Weston, "Exploit mitigation improvements in Windows 8" at Black Hat USA 2012 with Skywing, "Modeling the exploitation and mitigation of memory safety vulnerabilities" at Breakpoint 2012, "Windows 10 mitigation improvements" at Black Hat USA 2016 with David Weston, and work on mitigating arbitrary native code execution presented at CanSecWest 2017 and SyScan360 Seattle in 2017.

His most widely cited result came from a talk at the BlueHat conference in Israel in February 2019, "Trends, challenges, and strategic shifts in the software vulnerability mitigation landscape". Drawing on Microsoft's own vulnerability data, Miller reported that roughly 70 percent of the vulnerabilities Microsoft addressed through security updates each year were memory safety issues, and that this proportion had remained near that level for about twelve years. The figure was reported by ZDNET and has since been quoted extensively in arguments for memory-safe programming languages and in government and industry guidance on secure software development. He presented a version of the same material at USENIX WOOT '19 in Santa Clara in August 2019, and in 2020 published a "Security analysis of memory tagging" paper and gave a talk titled "Pursuing Durably Safe Systems Software" at SSTIC.

Significance

Miller's career spans both sides of the exploitation arms race. As skape he wrote several of the foundational documents of Windows payload and shellcode development, helped build the post-exploitation machinery of the Metasploit Framework, and edited a journal that served as a publishing venue for low-level Windows research at a time when few such outlets existed. At Microsoft he worked on the defensive side of the same problems, contributing to mitigation design and to the public measurement of whether those mitigations were working. The 70-percent memory safety statistic he presented in 2019 became one of the most frequently cited data points in the subsequent policy debate over memory-safe languages.

Timeline

• 2003-01Published early papers on ELF binary signing and verification and on Linux x86 run-time process manipulation.
• 2003-12Published "Understanding Windows Shellcode", a detailed reference on the structure of Windows payloads.
• 2004-04Published "Remote Library Injection", describing in-memory DLL injection into remotely compromised processes.
• 2004Became a core developer of the Metasploit Framework, a role he held through 2008.
• 2004-09Published "Safely Searching Process Virtual Address Space", introducing compact egg-hunt shellcode.
• 2004-12Published "Metasploit's Meterpreter", the reference description of the Meterpreter post-exploitation payload.
• 2005-05Contributed two articles to the first volume of the Uninformed journal, where he is listed among the editors.
• 2005Presented "Beyond EIP" at Black Hat USA with spoonm, and "Exploitation Chronomancy" at ToorCon and BlueHat.
• 2005-09Co-authored "Bypassing Windows Hardware-enforced DEP" with Skywing in Uninformed volume 2.
• 2006-01Co-authored "Bypassing PatchGuard on Windows x64" and "Windows Kernel-mode Payload Fundamentals" in Uninformed volume 3.
• 2006-09Published "Preventing the Exploitation of SEH Overwrites" in Uninformed volume 5, proposing runtime validation of the exception handler chain.
• 2007-01Co-authored "Exploiting 802.11 Wireless Driver Vulnerabilities on Windows" with Johnny Cache and H. D. Moore.
• 2007-05Published "Reducing the Effective Entropy of GS Cookies" in Uninformed volume 7.
• 2008-10Published "Using dual-mappings to evade automated unpackers" in the tenth and final volume of Uninformed.
• 2008Joined Microsoft; presented "The Evolution of Microsoft's Exploit Mitigations" at Blue Hat Fall 2008.
• 2012-07Presented "Exploit mitigation improvements in Windows 8" at Black Hat USA with Skywing.
• 2016-08Presented "Windows 10 mitigation improvements" at Black Hat USA with David Weston.
• 2019-02At BlueHat Israel, reported that roughly 70 percent of Microsoft's annually patched vulnerabilities were memory safety issues, a figure widely reported afterwards.
• 2019-08Presented "Trends and Challenges in the Vulnerability Mitigation Landscape" at USENIX WOOT '19 in Santa Clara.
• 2020-03Published the Microsoft paper "Security analysis of memory tagging".