Michael Lin

Summary

Experience

• Staff Security Research Engineer

  Didi Chuxing

  October 2016 – Present (1 year 6 months)San Francisco Bay Area

  Solving challenging problems at the world's largest ride sharing platform.
  
  We're hiring! Hardcore security researchers, data scientists and developers, WE WANT YOU! Desktop, server, mobile, IoT, network, we have something for every specialty.

• Founding Engineer

  AssureSec

  August 2016 – October 2016 (3 months)San Francisco Bay Area

  Acquired by Didi Chuxing.

• Sr. Security Research Engineer

  FireEye, Inc.

  June 2014 – August 2016 (2 years 3 months)San Francisco Bay Area

  Security researcher and detection engine designer at FireEye Labs.
  
  • Researched, prototyped and designed next-gen detection engines
  • Conceived and designed FireEye SmartVision
  • Studied and tracked threats targeting servers and network devices
  • Researched post-exploitation activities like network pivoting, lateral movement and persistence techniques

• Vulnerability Researcher

  TELUS Security Labs

  July 2013 – June 2014 (1 year)Toronto, Canada Area

  Analyzed software vulnerabilities, produced detailed vulnerability reports, and created exploit detection guidance for customers.
  
  • Isolated, analysed and reverse engineered software vulnerabilities
  • Performed static and dynamic analysis (IDA, BinDiff, WinDbg, OllyDbg)
  • Built proof-of-concept exploits
  • Developed signatures and detection logic for vulnerabilities and malicious code

• Technical Project Lead

  Hydro One Telecom

  May 2011 – July 2013 (2 years 3 months)Toronto, Canada Area

  Subject matter expert for several mission critical systems including inventory systems, ticketing systems and several network monitoring systems.
  
  • Delivered numerous data center projects
  • Liaised with vendors and evaluated products
  • Hired and mentored co-op students

• Technical Editor

  HotHardware.Com

  June 2006 – May 2011 (5 years)Toronto, Canada Area

  Conceived and wrote technical special-interest articles for a broad audience. Performed product testing, created and edited rich media, and worked closely with OEMs/vendors.
  
  • Published dozens of feature articles on topics related to computer hardware and consumer electronics
  • Articles have been featured on Slashdot, Digg, Engadget, Gizmodo and more
  • Worked with vendors on diverse editorial projects across all areas of computer hardware
  
  Publications listing available upon request. Too long to list here.

• Research Assistant (SHARCNET)

  Sheridan College

  January 2010 – September 2010 (9 months)

  Used the SHARCNET High Performance Computing system to conduct research into the strength of symmetric-key encryption algorithms against brute force attacks using modern HPC resources.
  
  • Assisted in developing and testing an adaptation of John the Ripper for MPI and parallel computing
  • Presented preliminary findings at the High Performance Computing Symposium 2010
  • Results peer-reviewed and published in Journal of Physics: Conference Series

Education

• Sheridan College

  BAIScBAISc

  2008 – 2012

• University of Toronto

  BAScBASc

  2005 – 2008

Certifications

• Associate of (ISC)² for CISSP

  (ISC)² - The International Information Systems Security Certification Consortium

  August 2012 – Present

• CompTIA A+

  Computing Technology Industry Association, License E6D89DSBHG1QQVNW

• CompTIA Security+

  Computing Technology Industry Association, License WTDV6WCBF3R4SFDP

Projects

• Post-exploitation Detection Engine (FireEye SmartVision)

  2016 – 2016

  Designed a network based detection engine intended to detect certain forms of post-exploitation activities like internal recon, user hunting, lateral movement, exfiltration, and Kerberos attacks. Built multiple prototypes. Worked across departments to build the solution and bring idea to market. Served as primary designer, researcher, and evangelist.

  Team members:

  • Michael Lin

• Malicious Web Script Analysis System

  2015 – 2015

  Designed and built a web script analysis system intended to triage potentially malicious scripts, extract useful artifacts and produce telemetry useful for malware analysts. The system uses a combination of static and dynamic analysis techniques to analyze samples. It also doubles as a sample repository, offering semi-automated classification features.

  Team members:

  • Michael Lin

• Security Content Development & Release System

  2015 – 2015

  Designed and built a system for security content development. Initially a side project I created for my own use after observing inefficiencies in the content development and release process. This system is now used by multiple research, intel, content, and QA teams across FireEye.
  
  The goal of the project is to automate and streamline as much of the development and release process as possible. I wanted to put the entire workflow, from development to QA to release, into the hands of the original researchers and content developers who know the content best, while freeing them from the burden of dealing with complex release tools and processes. Automatic validation, unit testing services, and peer review/approval systems prevent mistakes. Timely feedback, metrics and reports are provided to allow for continuous quality improvement.
  
  The system integrates content development, testing, validation, content release and version control into a single UI. A web front-end (JQuery, AJAX, Django), PostgreSQL DB, and multiple integrations (RabbitMQ, Celery, JSON, RESTful) tying together disparate back-end systems.

  Team members:

  • Michael Lin

• Internet Research Sensor Network

  2014 – 2014

  Designed and built an internationally distributed network of sensors and honeypots, with central logging, data normalization and a variety of anonymization and proxy techniques. Used to research and track security threats faced by internet connected network devices.

  Team members:

  • Michael Lin

Publications

• Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited

  FireEye

  February 2015

  A report about a SSH brute forcing campaign, targeting servers and network devices, that distributes a new family of Linux rootkit malware named “XOR.DDoS.” The campaign utilizes complex attack scripts to serve the malware through a sophisticated distribution scheme that allows the attackers to compile and deliver tailored rootkits on-demand to infect x86 and ARM systems alike.

  Authors:

  • Michael Lin,
  • Derek Gooley

• The Shellshock FAQ: Here's what you need to know

  ZDNet

  October 2014

  An approachable guide to the Bash vulnerability (AKA 'Shellshock'). Written for a broad, tech-savvy audience. We tried to answer the most pressing questions on the minds of users and systems administrators alike.

  Authors:

  • Michael Lin,
  • Larry Seltzer

• Shellshock in the Wild

  FireEye

  September 2014

  A timely analysis of the in-the-wild malicious activity that had been observed in the immediate wake of the Bash shell vulnerability, AKA 'Shellshock'.

  Authors:

  • Michael Lin,
  • James Bennett,
  • David Bianco

• MPI Enhancements in John the Ripper

  Journal of Physics: Conference Series

  2010

  Presented at the 2010 High Performance Computing Symposium.

  Authors:

  • Edward R. Sykes,
  • Michael Lin,
  • Wesley Skoczen