I’ve participated in multiple public audits since I’ve started working at the Cryptography Services of NCC Group. People can often see my work through the research I do, but a good chunk of my time is spent auditing and breaking real world applications. NCC Group sometimes release public reports and I think it is a good opportunity for outsiders to see what I work on, and what the audit-part of my work looks like.

Recently, two reports were published with my name on it. The Android Pie and Nucypher PRE library.

Unfortunately we rarely release much details when we find critical vulnerabilities, so the more interesting reports are always partially published (like the Google one) or just not public. One day I’ll find a way to talk about (without leaking out any information about clients of course) some of the juicy findings I and others have found in my years of consulting. Some of these war stories are extremely entertaining. We sometimes don’t find much, but when we completely break a cryptocurrency or a company’s flagship product, it feels like we’re the best in the world at what we do.