- 2006 - current: Consultant
- Ported a distributed object platfrom, roughly a million lines
of C++, from Windows to Linux.
- Wrote the first version of OWASP
(Securitycompass Web Application Analysis Tool), a C# tool
which scans PHP code for common security flaws. The user
interacts with a GUI written in Windows Forms, while
reports are written out in XML and then processed with XSLT
to generate a variety of output formats.
- Reviewed the design and implementation of the Microsoft
Vista firewall for security flaws. This project included
writing exploit code in C, x86 assembler, and Python, as
well as decompiling and modifying binary-only modules to
facilitate further analysis.
- Reviewed the design and implementation of the cryptographic
protocol underlying a commercial instant messaging system.
After working with the developers to identify their needs
and threat model, I identified several flaws in the existing
design and assisted the developers in building a protocol
more resistant to attack. I also helped the developers
optimize the implementation, significantly reducing the
latency of user sign-on.
- 2007 - 2008,
Volant Trading (New York, NY): Developer
- Designed and implemented price feeds for NASDAQ (ITCH3),
ARCA, and NYSE Quotes. The feeds process real-time market
traffic and provide price quotes via TCP or multicast to
the rest of the trading system. I used Python to automate
generation of message parsing routines.
- Designed and implemented a real time profit and loss
reporting service in C++ which marks all trades and
positions against market and model prices. Traders view
the report in a Qt GUI, and Python scripts are used to
generate hourly reports for import into spreadsheets.
- Wrote tools in C++ and Python to automate import and
export of data from an in-house distributed message
passing and persistence system. This allowed traders to
write spreadsheets that directly manipulated system
- 2005 - 2006,
Atlan Laboratories (Mclean, VA): Security Engineer
- Performed FIPS-140 reviews of a number of hardware and
software cryptographic implementations. These projects
involved reviewing and analyzing large amounts of
security-critical code written in C, C++, Java, and
assembler, finding potential flaws, writing proof of concept
exploits, and guiding the developers in remediating any
problems found during review.
- Redesigned and reimplemented Atlan's suite of proprietary
test tools (written in C++), which are used to analyze
implementations of cryptographic algorithms. The new version
reads tests from the source files (instead of requiring a new
binary for each test), and used abstraction features to make
it simpler to plug in a particular unit for evaluation.
- 2004 - 2005,
Cybertrust (Herndon, VA): Security Engineer
- Performed source code review and functional testing on a
variety of servers, clients, and web applications, including
a check scanning machine, an in-game advertising service, a
loan management system, and a distributed job control system.
- Performed penetration tests on a variety of customer
networks. In each case I then wrote up a detailed report
describing the flaws found, the anticipated risk and impact,
and the steps necessary for remediation.
- Built out and administered a 22 machine Linux/OpenBSD
cluster that ran a network security scanning service, as well
as numerous other Linux and OpenBSD scan machines and
- Gave half-day training sessions to developers on the proper
use of cryptographic algorithms and protocols to ensure
system security, and wrote a secure coding guide for C++
Open Source Projects
I have written a number of libraries and tools which I have
open sourced, including
- Botan is
a C++ library providing cryptographic services including a
variety of cipher, hash, and MAC algorithms, X.509
certificates, SSL/TLS, and a pipeline/filter message processor.
- CapOver is
a Linux Security Module that allows giving extra capabilities
(a shard of roots power) to particular combinations of users,
groups, and programs.
- VNCcrack is
a fast password cracker for the VNC authentication protocol.
Papers and Presentations
"CUTLASS - Encrypted, Peer-to-Peer Communications for Everyone",
Todd MacDermid, Jack Lloyd, Kathy Wang, and Nash Foster; ShmooCon 2005
"Cutlass - Cryptographic Protection for Everyone's Voice and Data",
Todd MacDermid, Jack Lloyd, Kathy Wang; ToorCon 2004
"OpenCM: Early Experiences and Lessons Learned",
Jonathan S. Shapiro, John Vanderburgh, Jack Lloyd;
2003 USENIX Annual Technical Conference, FreeNIX Track
"An Analysis of RMAC", Jack Lloyd;
IACR ePrint 2002/170
2003, B.Sc. Computer Science, Johns Hopkins University, Baltimore, MD