Cesar Cerrudo

In 2008 Cerrudo presented Token Kidnapping: Windows services running under restricted accounts could still get hold of tokens belonging to SYSTEM-level processes and climb all the way up. Microsoft needed several patches to close the variants, and the technique became a stock move for privilege escalation on servers.

His company Argeniss was bought by IOActive, where he became CTO. In 2014 he showed that wireless vehicle sensors feeding traffic lights in Washington, New York and elsewhere sent their data unencrypted and accepted unsigned firmware. It was an early, concrete demonstration of what urban IoT looks like when nobody planned for an attacker.