Alexander Sotirov
More info
- Known for
- Heap Feng Shui, the rogue CA built from an MD5 collision
The exploit researcher behind Heap Feng Shui and the rogue certificate authority conjured out of an MD5 collision.
In 2007 Sotirov presented Heap Feng Shui: a way to use JavaScript to arrange Internet Explorer's heap so precisely that an otherwise flaky memory bug could be exploited every single time. The following year he and Mark Dowd showed how the browser's exploit mitigations could be bypassed one by one.
In December 2008 he took the stage at the Chaos Communication Congress alongside Marc Stevens, Arjen Lenstra and others. The team had used around 200 PlayStation 3s to compute an MD5 collision and, with it, an intermediate CA certificate trusted by every browser. Certificate authorities dropped MD5 almost overnight — the demo achieved what a decade of warnings had not.