Val Smith

Background

Val Smith, who publishes and presents under the handle "Valsmith", is an American computer security researcher whose work spans penetration testing, reverse engineering and malware analysis. Conference biographies published by DEF CON and Black Hat from 2007 onward describe him as having been active in the computer security community and industry for more than ten years at that point, working as a professional security researcher on problems for both government and private-sector clients. The same biographies state that he specialized in penetration testing, citing more than 40,000 machines assessed, alongside reverse engineering and malware research. He is also listed in his DEF CON 15 and DEF CON 16 biographies as a member of the Cult of the Dead Cow NSF.

Offensive Computing

Smith co-founded Offensive Computing, LLC, a public, open-source malware research project, together with Danny Quist. Black Hat USA 2007 materials list Quist as the company's CEO and co-founder and Smith as co-founder, while several DEF CON biographies credit Smith with founding the project. Offensive Computing operated a publicly accessible malware repository and research community at offensivecomputing.net; an archived copy of the site from December 2009 reports a collection of 877,058 malware samples and offers public search, sample upload and analysis features at a time when large open malware corpora were uncommon.

The project's data underpinned some of Smith's public research. At DEF CON 15 in 2007 he presented "Malware Secrets" with the researcher known as Delchi, a talk that drew on analysis of what the abstract described as an Offensive Computing collection of over 100,000 samples to examine which packers malware authors most commonly used, which packers were rare enough to suggest targeted attacks, and how anti-virus products performed against a large known-malicious data set.

Conference research and tooling

Smith presented at Black Hat USA 2007 and DEF CON 15 alongside H.D. Moore, the founder of the Metasploit Project, on a talk titled "Tactical Exploitation". The presentation argued that penetration testing had become overly focused on individual vulnerabilities and services, and instead walked through compromising an organization without relying on conventional exploit code, using a combination of new tools and less-documented techniques. The abstract stated that many of the tools would be released as new modules for the Metasploit Framework. Conference biographies from the same period describe Smith as working on the Metasploit Project development team as well as other vulnerability development efforts.

Also in 2007 he presented "Covert Debugging: Circumventing Software Armoring Techniques" with Danny Quist at Black Hat USA and DEF CON 15. That work introduced a covert debugging platform named Saffron, which combined dynamic instrumentation with a page-fault-assisted debugger in order to strip packing and anti-analysis protections from armored malware binaries automatically.

Smith continued to publish on the post-exploitation phase of intrusions. At DEF CON 16 in 2008 he presented "MetaPost-Exploitation" with Colin Ames, addressing the labor-intensive work that follows initial compromise in large environments: maintaining persistent access, managing captured credentials and hashes, escalating privilege, leveraging trust relationships between systems, and obtaining GUI access. At DEF CON 17 in 2009 he presented "MetaPhish" with Colin Ames and David Kerb, describing a phishing framework built on top of Metasploit so that testers could automate client-side and spear-phishing attacks, along with techniques for second-stage backdoors and command-and-control communication over Tor.

Attack Research

By 2009 Smith had founded Attack Research, LLC, and appeared at DEF CON 17 under the title of CEO; his DEF CON 18 listing in 2010 gives his role as owner and CEO. His conference biography at the time described Attack Research as devoted to a deep understanding of the mechanics of computer attack. The firm describes itself as a boutique security company based in Northern New Mexico specializing in penetration testing and security consulting, and states that its teams emphasize identifying misconfigurations to facilitate privilege escalation and lateral movement rather than relying primarily on traditional exploits. Colin Ames, Smith's frequent co-presenter, is listed as a principal researcher at the firm.

At DEF CON 18 in 2010, Smith presented "Balancing the Pwn Trade Deficit" with Colin Ames and the Hong Kong-based researcher Anthony Lai. The talk examined the Chinese hacking community and advanced persistent threat style intrusions, combining Lai's familiarity with the Chinese-language security scene with the presenters' experience analyzing such campaigns, and aimed to add technical depth to a topic that was then receiving substantial press attention but limited detailed public analysis.

Significance

Smith's public work sits at the point where penetration testing shifted from vulnerability-by-vulnerability exploitation toward the tradecraft that later became standard in red teaming: credential reuse, trust relationships, persistence and lateral movement. "Tactical Exploitation" and the MetaPost-Exploitation and MetaPhish talks helped popularize that framing and pushed the associated tooling into the Metasploit Framework, where it reached a wide audience of practitioners. Offensive Computing, meanwhile, was one of the earlier public malware repositories to give independent researchers bulk access to samples, and the Saffron work contributed to the ongoing effort to automate unpacking of protected binaries.

Timeline

• 2007Presents "Tactical Exploitation" with H.D. Moore at Black Hat USA 2007 and DEF CON 15, releasing supporting tools as Metasploit Framework modules.
• 2007Presents "Covert Debugging: Circumventing Software Armoring Techniques" with Danny Quist, introducing the Saffron covert debugging platform.
• 2007-08Presents "Malware Secrets" with Delchi at DEF CON 15, analyzing packer use across the Offensive Computing malware collection.
• 2008Presents "MetaPost-Exploitation" with Colin Ames at DEF CON 16, listed as CTO of Offensive Computing, LLC.
• 2009Presents "MetaPhish" with Colin Ames and David Kerb at DEF CON 17, listed as CEO of Attack Research, LLC.
• 2009-12An archived snapshot of offensivecomputing.net reports a public collection of 877,058 malware samples.
• 2010Presents "Balancing the Pwn Trade Deficit" with Colin Ames and Anthony Lai at DEF CON 18, listed as owner and CEO of Attack Research, LLC.