# Mike Gualtieri Homepage > Mike Gualtieri's posts on cybersecurity, Linux, Open Source Software, and electronics. This is the official homepage of Mike Gualtieri. Mike Gualtieri is a seasoned engineering leader with over 20 years of experience in cybersecurity, software engineering, and cloud-native infrastructure. He is an IANS Faculty member. He currently leads Security Engineering at Netlify - holding the role of Principal Security Engineer - having previously built and led the Security & Compliance program at the high-growth startup Gatsby through its acquisition by Netlify. Mike is an active security researcher with multiple CVEs. Mike has presented research at security conferences and developed cybersecurity curriculum for the University of Pittsburgh, covering penetration testing and red team tactics. Earlier in his career, Mike founded three tech companies and spent over a decade advising clients on software and cybersecurity initiatives. Author: Mike Gualtieri. Language: en. ## Pages - [About Mike Gualtieri](https://www.mike-gualtieri.com/about): Learn more about Mike Gualtieri, a seasoned technical engineering leader with over 20 years of experience in cybersecurity, software engineering, and cloud-native infrastructure. ## Posts - [2022 Conference Talks](https://www.mike-gualtieri.com/posts/2022-conference-talks): In 2022 I was honored to present at the SANS Pen Test HackFest Summit. Here is a recording shared of the event. - [2021 Conference Talks](https://www.mike-gualtieri.com/posts/2021-conference-talks): I was fortunate to have been invited to present at two conferences in 2021! Here are recordings shared online for each event. - [Purple Team Tactics: Simulating Supply Chain Attacks With DLL Hijacking](https://www.mike-gualtieri.com/posts/purple-team-tactics-simulating-supply-chain-attacks-with-dll-hijacking): This post details a method of creating a realistic synthetic supply chain attack, which can be conducted as part of a Purple Team exercise, using DLL hijacking to inject synthetic malware into an application. - [2020 Conference Talks](https://www.mike-gualtieri.com/posts/2020-conference-talks): I was fortunate to have been invited to present two conference talks in 2020, and even better each talk was recorded and shared online by the event! Here are the shared recordings. - [Live off the Land and Crack the NTLMSSP Protocol](https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol): Live Off the Land in Windows and intercept NTLMv2 hashes! A new tool NTLMRawUnHide is introduced to extract NTLMv2 hashes from raw packet traces, and we learn more about the NTLMSSP protocol. - [Red Team Tradecraft: Loading Encrypted C# Assemblies In Memory](https://www.mike-gualtieri.com/posts/red-team-tradecraft-loading-encrypted-c-sharp-assemblies-in-memory): This post explores creating a simple C# dropper example that loads remotely hosted encrypted assemblies in memory. - [Hooking Linux Libraries for Post-Exploitation Fun](https://www.mike-gualtieri.com/posts/hooking-linux-libraries-for-post-exploitation-fun): Explore Linux shared library hooking and process injection techniques using LD_PRELOAD to intercept passwords from htpasswd and PHP applications in memory. - [Finding a Decade-Old Flaw in GNU Mailutils](https://www.mike-gualtieri.com/posts/finding-a-decade-old-flaw-in-gnu-mailutils): I recently discovered a Linux privilege escalation flaw dating back over 10 years in GNU Mailutils, a popular package self-described as - [Modifying Empire to Evade Windows Defender](https://www.mike-gualtieri.com/posts/modifying-empire-to-evade-windows-defender): By tearing into the Empire code base, we can easily modify some key areas and bypass that pesky client-side antivirus. - [Fax Vulnerability May Have Lasting Effects for Small Businesses](https://www.mike-gualtieri.com/posts/fax-vulnerability-may-have-lasting-effects-for-small-businesses): Vulnerabilities in the fax protocol may rear it's ugly head for some time, especially for small-to-mid sized businesses; and especially for those that handle sensitive data. - [Multiple Flaws Uncovered in Pydio 8](https://www.mike-gualtieri.com/posts/multiple-flaws-uncovered-in-pydio-8): Security research uncovering multiple vulnerabilities in Pydio 8, including XSS, SSRF, and Remote Code Execution flaws. CVE-2018-1999016, CVE-2018-1999017, CVE-2018-1999018. - [S3 Buckets: Now With Both Leak & Fill Vulnerability](https://www.mike-gualtieri.com/posts/s3-buckets-now-with-both-leak-and-fill-vulnerability): Earlier this week I had the privilege of providing insight for a Bleeping Computer article about the impending time-bomb that is world-writable Amazon S3 buckets. - [Stealing Data With CSS: Attack and Defense](https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense): A method is detailed, dubbed CSS Exfil, which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. - [Model Radio Tower using 555 Timer and Lego Bricks](https://www.mike-gualtieri.com/posts/model-radio-tower-using-555-timer-and-lego-bricks): Sometimes basic analog circuits are the best choice. This project uses a 555 timer to pulse lights on a model Lego radio antenna. - [Move Over S3: Open Directory Indexes Continue to be a Problem](https://www.mike-gualtieri.com/posts/move-over-s3-open-directory-indexes-continue-to-be-a-problem): Analysis of publicly accessible web server directories containing sensitive data, showing millions of exposed files indexed on Google beyond just S3 bucket misconfigurations. - [xterm can talk (001): Amazon Delivery](https://www.mike-gualtieri.com/posts/001-xterm-can-talk-amazon-delivery): A tech-themed cartoon exploring the humorous side of smart home technology and Amazon's delivery ecosystem. - [Security Researchers Lose a Favorite DNS Recon Tool Jan 2018](https://www.mike-gualtieri.com/posts/security-researchers-lose-a-favorite-dns-recon-tool-jan-2018): Scammers can now conceal their campaigns by utilizing a wildcard certificate, so the phishing sub-domain does not appear in the Certificate Transparency project. - [KRACK: How To Protect Yourself on a Flawed Network](https://www.mike-gualtieri.com/posts/krack-how-to-protect-yourself-on-a-flawed-network): KRACK underscores an important lesson. You can't trust your network. As soon as a packet leaves your computer or smartphone, assume always that it's being sniffed and manipulated. - [iOS Credential Phishing 'Flaw' Not Limited to Malicious Apps](https://www.mike-gualtieri.com/posts/ios-credential-phishing-flaw-not-limited-to-malicious-apps): While this isn't necessarily a direct flaw within iOS, the attack vector is subtle and I bet would fool many people. - [Equifax, SEC, & Now Deloitte: Organizations Must Employ Offensive Security](https://www.mike-gualtieri.com/posts/equifax-sec-and-now-deloitte-organizations-must-employ-offensive-security): Offensive security is a school of thought, where a proactive approach is taken to computer security. While defensive measures are essential, an offensive security approach focuses on penetration testing and thinking like an attacker, with a goal of finding weaknesses in your own organization's systems and software. - [Equifax Redux Part 1: Assume You Are Already Compromised](https://www.mike-gualtieri.com/posts/equifax-redux-part-one-assume-you-are-already-compromised): I'm not going to speculate why a software package went unpatched. It should have been patched - and swiftly - but what if the flaw was a so-called 0-day exploit without a patch? Would Equifax still be held liable for such a massive breach? The answer should be a resounding yes! - [Chaining Remote Web Vulnerabilities to Abuse Let's Encrypt](https://www.mike-gualtieri.com/posts/chaining-remote-web-vulnerabilities-to-abuse-lets-encrypt): Recently I started playing around with the ACME validation routine Let's Encrypt uses to verify domain ownership, suspecting that it may be abused to issue an SSL certificate to an attacker. - [Build a Raspberry Pi Powered Arcade Machine!](https://www.mike-gualtieri.com/posts/build-a-raspberry-pi-powered-arcade-machine): Complete guide to building a retro arcade machine powered by Raspberry Pi with MAME, including hardware setup, GPIO controls, and custom software configuration. - [Build an Arduino Word Clock](https://www.mike-gualtieri.com/posts/arduino-word-clock): Complete tutorial for building an Arduino word clock that displays time as sentences using LEDs, shift registers, and a real-time clock module. - [Check Out My New Site: makeRF.com](https://www.mike-gualtieri.com/posts/new-website-makerf): If you are interested in radio and hobby electronics be sure to check out my new website makeRF.com! - [Hacking My House #1.5: When Lightning Rings](https://www.mike-gualtieri.com/posts/hacking-my-house-1-5-when-lightning-rings): How I fixed my Arduino doorbell that randomly rang during thunderstorms by adding a simple filter circuit to eliminate electrical noise from lightning and appliances. - [Hacking My House #1: Building a Musical Arduino Doorbell](https://www.mike-gualtieri.com/posts/hacking-my-house-1-building-a-musical-arduino-doorbell): Building a custom Arduino doorbell that plays music using PWM, featuring circuit schematics, code, and an LM386 amplifier to replace boring ding-dong chimes. - [Moving Your Landline To Google Voice](https://www.mike-gualtieri.com/posts/moving-your-landline-to-google-voice): A step-by-step guide to porting your landline phone number to Google Voice using a prepaid cell phone as an intermediary. - [In Memoriam Steve Jobs](https://www.mike-gualtieri.com/posts/in-memoriam-steve-jobs): Remembering Steve Jobs and his legacy of design excellence, including the story of how rounded corners made their way into software. - [Facebook Facial Recognition Tool Is Good For Online Privacy](https://www.mike-gualtieri.com/posts/facebook-facial-recognition-tool-is-good-for-online-privacy): The scary part about Facebook is the part I'm not in control of, my Facebook Friends. Unfortunately, there is little I can do when friends share my personal information or pictures online. - [Android Could Overtake Windows in 2016](https://www.mike-gualtieri.com/posts/android-could-overtake-windows-in-2016): This model looks a bit more realistic, with total smartphone and PC sales in 2016 looking reasonable. 2016 is also the year where Android could surpass the Windows PC. - [The Path To Ubiquitous Desktop Linux: Kill the Desktop & Resurrect It](https://www.mike-gualtieri.com/posts/the-path-to-ubiquitous-desktop-linux): Envisioning a future where smartphones and tablets running Linux replace traditional desktop computers by interfacing with dumb terminals at work and home. - [Oh, No, Papa Smurf!](https://www.mike-gualtieri.com/posts/oh-no-papa-smurf): The problem with devices like the iPad is the same problem with the PC. They aren't designed for children, which can lead to usage issues. - [Microsoft's User Inexperience Team Strikes Again](https://www.mike-gualtieri.com/posts/windows-phone-7-terrible-ux): A critical look at Windows Phone 7's poor user experience design, including cut-off text, inefficient screen usage, and excessive swiping requirements. - [An Open Marketplace Does Not Mean Open Source](https://www.mike-gualtieri.com/posts/open-marketplace-is-not-open-source): Clarifying the difference between Android's open marketplace and open source software, and why security concerns about Android stem from closed source apps, not the OS itself. - [The Rockmite: A 40 meters CW QRP Rig (in an Altoids Tin)](https://www.mike-gualtieri.com/posts/rockmite-qrp-rig): The Rockmite is a low power (QRP) shortwave transceiver (combination receiver and transmitter) that can send morse code (CW) on a variety of frequencies. - [What the Lag YouTube?](https://www.mike-gualtieri.com/posts/what-the-lag-youtube): Am I the only person in the world who is unsatisfied with the major lag while playing YouTube video's this past week? - [Forget Rendering Engines, Browsers Need To Focus on Features and Usability!](https://www.mike-gualtieri.com/posts/browser-focus-on-usability): If browsers standardized on one rendering engine, engineers could pour their innovations into one experience that is fast and renders exactly the same on all screens. - [Android, iPhone, and Open Source Code Review](https://www.mike-gualtieri.com/posts/android-iphone-oss-code-review): Android, iPhone, and Open Source Code Review - Summer is the season for security conferences, and one hot topic making news is the (in)security of smartphones. - [FVWM Config](https://www.mike-gualtieri.com/posts/fvwm): A highly customizable FVWM window manager configuration for Linux, built for power users seeking ultimate desktop configurability. - [Kiddix - The Operating System for Kids!](https://www.mike-gualtieri.com/posts/kiddix): A family-friendly Linux-based operating system designed specifically for children, providing a safe, friendly, and fun computing environment. - [Linux Desktop Evolution](https://www.mike-gualtieri.com/posts/linux-screenshots): A visual journey through the evolution of Linux desktop environments from KDE in 2001 to modern configurations, showcasing the customization possibilities. - [Split Splat - An iPhone Game](https://www.mike-gualtieri.com/posts/splitsplat): An iPhone game developed in 2009 featuring a pigeon controlled by accelerometer, created during the iPhone app gold rush era. - [Welcome To My Updated Homepage!](https://www.mike-gualtieri.com/posts/welcome-to-my-updated-homepage): Mike Gualtieri: Homepage - Welcome To My Updated Homepage! I finally found some time to redesign my personal homepage, which has been in desperate need of an update. ## Feeds - [RSS Feed](https://www.mike-gualtieri.com/rss.xml): Full post feed in RSS format - [Atom Feed](https://www.mike-gualtieri.com/feed.xml): Full post feed in Atom format - [Sitemap](https://www.mike-gualtieri.com/sitemap.xml): Machine-readable index of every page ## Elsewhere - [X/Twitter](https://x.com/mlgualtieri) - [LinkedIn](https://www.linkedin.com/in/mlgualtieri/) - [GitHub](https://github.com/mlgualtieri) - [IANS Faculty bio](https://www.ians.com/faculty/mike-gualtieri)