Charlie Miller (security researcher)

Education

Miller holds a bachelor's degree in mathematics with a minor in philosophy from the then called Northeast Missouri State, and a Ph.D. in mathematics from the University of Notre Dame in 2000. He lives in Wildwood, Missouri.

Security research

Miller was a lead analyst at Independent Security Evaluators, a computer protection consultancy. He has publicly demonstrated many security exploits of Apple products.

In 2008, he won a $10,000 cash prize at the hacker conference Pwn2Own in Vancouver, British Columbia, Canada for being the first to find a critical bug in the MacBook Air.

In 2009, he won $5,000 for cracking Apple's Safari browser. Also in 2009, he and Collin Mulliner demonstrated an SMS processing vulnerability that allowed for complete compromise of the Apple iPhone and denial-of-service attacks on other phones. In 2011, he found a security hole in the iPhone and iPad, whereby an application can contact a remote computer to download new unapproved software that can execute any command that could steal personal data or otherwise using iOS applications functions for malicious purposes. As a proof of concept, Miller created an application called Instastock that was approved by Apple's App Store. He then informed Apple about the security hole, who promptly expelled him from the App Store.

Miller participated in research on discovering security vulnerabilities in NFC (Near Field Communication).

First Apple iPhone exploit

Charlie Miller presented about the first iPhone exploit in 2007. He demonstrated a vulnerability in the mobile Safari browser that allowed an attacker to gain control of the iPhone.

First Google Android exploit

Miller, along with his colleagues Mark Daniel and Jake Honoroff at ISE, identified and exploited a security vulnerability in the Android operating system. They found that the vulnerability was due to Google using an older, vulnerable version of the Webkit library utilized by Android.

The initial vulnerability was discovered and an exploit developed using the Android SDK and emulator.

It is rumored that Miller acquired a Google G1 device via a T-Mobile employee eBay auction prior to release day.

First remote car hacking exploit

Miller, along with Chris Valasek, is known for remotely hacking a 2014 Jeep Cherokee and controlling the braking, steering, and acceleration of the vehicle.

Publications

• iOS Hacker Handbook
• The Mac Hacker's Handbook
• Fuzzing for Software Security Testing and Quality Assurance
• Battery firmware hacking: inside the innards of a smart battery

References

References

1. (June 18, 2012). "Wildwood man is renowned for hacking, cybersecurity skills". STLtoday.com.
2. (24 August 2015). "Security researcher who hacked moving Jeep leaves Twitter".
3. O'Harrow Jr, Robert. (June 2, 2012). "Understanding cyberspace is key to defending against digital attacks". [[The Washington Post]].
4. (24 July 2007). "We hacked into Apple's iPhone, claim security researchers".
5. (28 March 2008). "MacBook Air first to fall in hacking contest vs Vista and Linux".
6. (28 March 2008). "Gone in 2 minutes: Mac gets hacked first in contest".
7. (18 March 2009). "Pwn2Own 2009: Mac falls in seconds".
8. "Apple boots security guru who exposed iPhone exploit".
9. Greenberg, Andy. (2012-07-25). "DARPA-Funded Researcher Can Take Over Android And Nokia Phones By Merely Waving Another Device Near Them". Forbes.
10. Kirk, Jeremy. "Researcher finds possible bug in Apple's iPhone - NYTimes.com".
11. "Exploiting the iPhone".
12. Miller, Charlie. "Hacking Leopard: Tools and Techniques for Attacking the Newest Mac OS X". [[Black Hat Briefings]].
13. Moscaritolo, Angela. (2008-11-03). "Vulnerability patched in Google's Android-powered phone".
14. "Exploiting Android".
15. Nosowitz, Dan. (2008-10-25). "T-Mobile G1 Security Flaw Found, But It's All Under Control, People".
16. Greenberg, Andy. (2015-07-21). "Hackers Remotely Kill a Jeep on the Highway—With Me in It". [[Wired (magazine).
17. Miller, Charlie.. (2012). "IOS Hacker's Handbook.". Wiley.
18. Miller, Charles, 1951-. (2009). "The Mac hacker's handbook". Wiley.
19. Takanen, Ari.. (2008). "Fuzzing for software security testing and quality assurance". Artech House.
20. Miller, Charlie. (2011-07-12). "Battery Firmware Hacking: Inside the innards of a Smart Battery".