I sorta run things around SkullSecurity.
I registered “skullsecurity.org” (along with .net and .com) a couple years ago, to host the site for a Shadowrun campaign that ended up with the same name (that’s a long story, but maybe I’ll tell it some day!). When I created it, I knew it’d be an awesome name for a security site or group or whatever, so I told myself that someday, I’d create a blog there. And here we are.
This blog is, as the tagline (currently) says, “just another security weblog”. I’ve been in the security field for awhile now, and am doing some work that I consider interesting, and thought I’d start sharing it. If you want to know what I’m working on, or what I do for fun, or what I need to access later, check out my wiki.
Anyway, with that aside, a little about myself. My name is Ron Bowes, I’m
24 25 26 27 38 (wow, what a gap in updates) 39 and have a Bachelors of Computer Science (honours) from the University of Manitoba. I have a bunch of expired certifications, I’ve worked at big companies (like Google), moved from Canada to the US, and have had a pretty cool life.
These days, I do security research for the Emergent Threats team at Rapid7. I use my personal blog largely for CTF writeups, but I have this idea where I want to post more short-form blogs on techniques I use a lot.
Previously, I did consulting for Counter Hack.
I cut my teeth, security-wise, on reverse engineering games for Battle.net, for the purposes of writing emulation bots, non-malicious hacks/plugins, and just plain educational tinkering. To my knowledge, I’m the first to have publicly released code for Warcraft 3 SRP, the Lockdown Modules, and Warden. One of my favourite things I wrote for Battle.net, in my programming infancy, was a Message Spoofer, which would allow users to send various control characters in their messages for effects like colours and alighment. To my knowledge, it was the first and only program that specialized in message spoofing.
My work in late 2008 and all of 2009 revolved around Microsoft’s NetBIOS and SMB (aka, CIFS) protocols. Using a fantastic book called Implementing CIFS, by Christopher R. Hertel, I learned how Windows systems talk to each other, on a low level, and how I can manipulate this to assist penetration testers. I wrote a large collection of Nmap scripts to take advantage of this protocol in some interesting ways. You can find lots of blogs on this site about them.
Updated on January 1, 2010
2009 was the first year I participated significantly in the security community. I met a lot of well known folks at Defcon in Vegas and gave my first real presentation at Toorcon in San Diego. I also finished SANS 504 and, toward the start of 2010, started learning the DNS protocol in detail and writing some tools for cute DNS tricks. You can look forward to some blogs about DNS coming up, and hopefully 2010 will be another great year!
If you have any questions, feel free to email me or post a response here!
Bio (updated 2015-09-09)
(I keep needing a bio when submitting talks and keep losing it, so I’ll keep it here for safe keeping)
From the time he was in highschool, Ron Bowes was fascinated by hacking and tinkering. He pushed some boundaries early in his career when he was the first to document and publish source code for Battle.net’s secure login sequences. When he didn’t get in trouble for that, he started publishing password breaches on his site - skullsecurity.org - where they can still be found. After graduating with a Computer Science degree, Ron has been everything from an analyst to a researcher to a PHP dev (yes, PHP dev). Currently, he spends his days as a security engineer at Google and his nights working on open source projects, such as SMB and MSRPC support in Nmap and his DNS-based command-and-control backdoor, dnscat2.