Behind the Binary by Google Cloud Security

Josh Stroschein

Welcome to Behind the Binary, the podcast that introduces you to the fascinating people, technology, and tools driving the world of reverse engineering. Join your host, Josh Stroschein, a reverse engineer with the FLARE team at Google, and someone passionate about sharing knowledge and shedding light on the art of reverse engineering, as he sits down with intriguing guests to explore the human side of this profession.

Behind the Binary goes beyond the code, sharing the stories, motivations, and unique perspectives of the individuals who dedicate their lives to unraveling the complexities of technology. We'll hear about their journeys into the field, the challenges they face, and the impact their work has on securing our digital world.

Whether you're a seasoned malware analyst, a software developer, a security researcher, or just someone curious about the world of reverse engineering, Behind the Binary offers insightful and engaging conversations for everyone interested in this fascinating field.

Play

Open in

21 episodes
monthly
Avg 1 hr
English

Episodes 21

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

S3 · E8
Wednesday · 51 min
EP28 macOS Security Internals: Kernel Exploitation, PAC Defenses, and the Rise of macOS Infostealers with Olivia Gallucci
In this episode, we're joined by security researcher Olivia Gallucci to explore macOS low-level security, kernel exploitation, and macOS threat trends. We break down how macOS internals differ from Linux—focusing on IOKit, C++ dynamic class resolution, and Vtable hijacking in kernel drivers. Olivia explains the mechanics behind use-after-free (UAF) vulnerabilities, heap shaping, and legacy kernel exploits, as well as modern Apple hardware and OS defenses like Pointer Authentication Codes (PAC) and kalloc type isolation (PAC IA/DA semantics). We also discuss the evolution of macOS threat research, the rise of macOS info stealers driven by cryptocurrency targeting, local detection telemetry using Endpoint Security (ES) and tools like Mac Monitor, and the current dynamics of vulnerability research and bug bounty programs. Key Discussion Points: Mac vs. Linux Internals: Why macOS isn't "just Linux," and how IOKit’s C++ driver framework creates unique attack surface. Vtable Hijacking & Kernel Exploits: How dynamic method resolution and C++ polymorphism are targeted using UAF, out-of-bounds writes, and heap shaping. Modern Defenses: How Apple leverages Pointer Authentication Codes (PAC IA/DA) and type-isolated heap allocators to disrupt traditional exploit primitives. The Rise of macOS Infostealers: What drove the surge in macOS stealer malware, their simple architecture, and social engineering delivery tactics. Detection & Telemetry: Monitoring local exploit failures, kernel panics, and process events via Endpoint Security (ES Logger) and open-source tools like Mac Monitor. Vulnerability Research Ecosystem: The role of AI in technical research, shifting bug bounty payouts, and the dynamics between vendor programs and third-party research. Resources mentioned: Olivia Gallucci's Blog: oliviagallucci.com Mac Monitor by Brandon Dalton: https://github.com/Brandon7CC/mac-monitor Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E7
July 15 · 56 min
EP27 The Challenges of Reversing Modern Languages: From C++ to Go and Rust with Jae Young Kim
When malware analysis first emerged, reverse engineers typically operated in a straightforward C landscape — standard Win32 APIs, no massive runtimes, and clear code paths. Today, the landscape has fundamentally shifted. The natural progression to C++ introduced object-oriented hurdles like virtual function tables and standard template library bloat, laying the groundwork for the complexities we see in today's modern ecosystem. In this episode of Behind the Binary, we sit down with Jae Young Kim from the FLARE team to discuss navigating this evolution and what it actually takes to reverse engineer modern compiled languages like Go and Rust. Jae walks us through his journey of diving head-first into the Go compiler architecture and source code to build a comprehensive internals reference for the FLARE Learning Hub. We discuss why understanding language quirks from the inside out is essential for professional analysts, look at the reality of recovering symbols from "stripped" Go binaries, and explore why traditional workflows like Time Travel Debugging (TTD) often get buried under runtime cruft. Finally, we look at the immediate future of the trade: how LLMs are already excelling at high-level decompilation and what languages he thinks are going to play a more significant role (hint - .NET AOT and Nim came up). THE SESSION: The Modern Language Shift: How the transition from C and C++ to sprawling, modern compiled runtimes has altered the day-to-day workflow of threat researchers and steepened the learning curve for beginners. Demystifying Go Internals: Jae’s perspective on why Go's compact design philosophy can actually make it a highly systematic, and occasionally pleasant, reversing experience once you master its unique quirks and calling conventions. The Myth of the "Stripped" Go Binary: A look at how tools like goReSym leverage intact compilation metadata to programmatically restore original function names and type definitions. AI and the Future Decompiler: An honest assessment of how current LLMs handle assembly-to-source reconstruction, where hallucination verification still requires a human in the loop, and how automated tooling will reshape the analysis pipeline. Emerging Blind Spots: A primer on the next operational hurdles for threat researchers, including the rising frequency of native ahead-of-time (.NET AOT) compilations and wildcard languages like Nim. References: FLARE Learning Hub Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E6
June 3 · 58 min
EP26 When AI Features Create Zero-Click Exploits: The Pixel 9 Chain with Seth Jenkins
Mobile security boundaries rely on isolating remote, untrusted inputs from highly privileged system components. However, when new automated features are introduced, the available attack surface can shift—sometimes exposing unexpected code paths to remote attackers. In the latest episode of Behind the Binary, we sit down with Seth Jenkins from Google Project Zero to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. By chaining a user-space decoder flaw with a kernel driver race condition and a kernel ASLR bypass, researchers achieved remote code execution and a device-wide SELinux sandbox escape. Key takeaways from our technical breakdown: The AI Attack Surface Shift: How implementing automatic voice message transcription inadvertently exposed the Dolby audio decoder (EAC3) to remote inputs. Defeating Userland ASLR: The mechanics of an integer overflow in user space (CVE-2025-54957) and how a partial pointer overwrite bypassed ASLR. Rigging the Race Condition: A look inside the "Big Wave" kernel driver use-after-free (CVE-2025-36934), a single bug that allows an attacker to jump from the mediacodec sandbox to the kernel. . The Predictable KASLR Reality: How standard ARM64 linear mapping combined with static bootloader placements negated kernel randomization—allowing two arbitrary writes to escalate privileges to root with SELinux disabled. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E5
May 6 · 57 min
EP25 The Future of Debugging: A Paradigm Shift with Xusheng Li
"TTD is a paradigm shift in the way you interact with the target... Potentially, five years from now, when we talk about debugging, we will just by default go to TTD." In this episode, we are joined by Xusheng Li, a debugger architect and reverse engineering expert, to explore the evolution of Time Travel Debugging (TTD). While traditional debugging has remained largely stagnant for decades, TTD introduces a novel new way to debug by recording and replaying execution traces with total precision. Xusheng takes us behind the scenes of how this technology solves the "granularity problem" in malware analysis—moving from a high-level API overview down to instruction-level "ground truth" without ever needing to re-run the program. We break down the engineering required to record billions of instructions into a manageable trace, the power of querying execution data like a searchable database, and how a "sealed" execution history is changing the workflow for both software developers, malware analysts, and vulnerability researchers. THE SESSION: The Deterministic Leap: How TTD avoids the overhead of recording every single instruction by focusing only on non-deterministic events—like file reads, CPU ID calls, and system inputs—allowing billions of cycles to be reconstructed from a fraction of the data. The Death of "Step-Over": Why the future of debugging lies in querying an execution database rather than manually stepping through code, enabling researchers to instantly find every moment an API was called or a specific memory address was modified. Solving the Granularity Problem: How a single trace file provides a "safety net" for analysis, allowing researchers to start with a broad triage of behavior and then use a "microscope" to dig into specific crypto functions or obfuscated payloads later. Data Flow vs. Code Flow: A look at the shift toward "concrete data flow analysis," where researchers focus on the movement of sensitive buffers and keys rather than getting lost in the mental overhead of complex instruction sets and registers. The Mystery of the i9 Crash: A real-world troubleshooting case where TTD was used to identify a hardware-level microcode bug in a modern CPU that would have been nearly impossible to pinpoint with traditional tools. The AI Connection: Why the "fixed world" of a TTD trace is the ideal training ground for LLM-assisted analysis, providing a secure, deterministic environment for AI to solve intermediate-level reverse engineering challenges. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E4
April 1 · 54 min
EP24 The Glupteba Takedown: What Happens When Botnet Operators Show Up in Court with Pierre-Marc Bureau
"I thought that we would never hear about these people after they were named. But what was a surprise is that they actually hired a lawyer in New York... and they were like, 'Yeah, we're going to be taking part in this trial." In this episode, we are joined by Pierre-Marc Bureau from Google’s Threat Intelligence Group (GTIG) to unpack the unprecedented takedown of the Glupteba botnet. Active since 2011, Glupteba infected roughly 1 million Windows devices before Google launched a coordinated technical and legal strike. Pierre-Marc takes us behind the scenes of an investigation that evolved from reverse engineering binaries to a surreal showdown in a New York civil court. We break down how a single hardcoded string unraveled a massive criminal enterprise, the mechanics of using the Bitcoin blockchain for resilient command and control, and the bizarre moment when Russian cybercriminals actually hired a US lawyer to fight back. THE SESSION: The Blockchain Fallback: How Glupteba operators hid AES-encrypted blobs inside Bitcoin transactions, creating an un-takable backup C2 infrastructure if their primary domains went down. The Fatal OpSec Flaw: How one mistake—leaving the string get.voltronwork.com in a Go module—allowed Google to connect the botnet to Russian developer shops and Delaware shell companies. The Corporate Cyber-Cartel: Why the group operated like a legitimate tech startup, openly selling end-to-end "services" like proxy networks and compromised Google and Facebook accounts on the open web. The Extortion Twist: The surreal courtroom drama where the malware operators tried to extort Google for $1 million per defendant in exchange for private keys—a move that ended with the judge sanctioning their lawyer for $250,000. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E3
March 4 · 41 min
EP23 Immutable C2: How EtherHiding and Frontend Attacks are Weaponizing the Blockchain
In this episode, we are joined by Robert Wallace, Joseph Dobson, and Blas Kajusner to dissect the new "Hybrid Heist." The panel argues that the era of isolated crypto-theft is over; sophisticated actors are now targeting the Web2 layer—the frontends, the developer workstations, and the cloud infrastructure—to bypass the immutability of the chain itself. We also break down "Ether Hiding," a technique where attackers store malware payloads directly on the blockchain to create an unstoppable Command & Control (C2) infrastructure that cannot be taken down by traditional authorities. THE SESSION: Immutable C2 (Ether Hiding): How threat actors are updating smart contract state variables to serve second-stage malware payloads, effectively turning the blockchain into a "dead drop resolver" that ignores domain blocks and takedown requests. The Hybrid Attack Surface: Why the massive Bybit heist wasn't a failure of cryptography, but a Web2 frontend attack on the "Safe Wallet" interface that tricked users into signing transactions they couldn't see. The "OpSec" Crisis: Why smart contract developers are the new "Domain Admins," and how simple phishing campaigns against personal devices are leading to nine-figure losses. The "Choke Point" Vulnerability: Why the decentralized ecosystem is still entirely dependent on centralized on-ramps and off-ramps, and how this dependency creates a "kill chain" that defenders can disrupt. Governance Attacks: The shift from exploiting code to exploiting consensus—how attackers are buying enough tokens to legally vote themselves the contents of a project's treasury. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E2
February 4 · 57 min
EP22 Jailbreaking, Prompt Injection, and the "Agentic" Flaw in MCP with Kevin Harris
"Skilled adversaries have a 100% success rate against all of the defenses that we know about." In this episode, Kevin Harris defends that claim. We move past the standard "AI Safety" talking points to distinguish between the two attack vectors confusing the industry: Prompt Injection (an application-layer failure) vs. Jailbreaking ("gaslighting" the model via context shifting). Kevin argues that we haven't actually invented AI yet—we've just built a mirror that reflects our own intelligence (and psychosis) back at us. We also dissect the new model context protocol (MCP) and why giving "discretion" to agents that cannot think is potentially repeating the security mistakes of Web 2.0. THE SESSION: The "Pirate" Jailbreak: Why telling a model to be a pirate isn't just a party trick—it's a method of shifting the context window to bypass refusal patterns. The 100% Failure Rate: Why current defenses are only speed bumps for skilled adversaries, and why you are attacking the application, not the model. "There Is No AI": Kevin’s theory on why LLMs are just "predictive text made 3 orders of magnitude better" and the danger of "AI-induced psychosis". The Agentic Threat (MCP): A deep dive into the model context protocol. Why client-side authorization is the new "Browser Security" battleground, and why we are handing "table saws" to users who don't know how to use them. The Fix: Why "Attention Functions" are the key to understanding (and securing) the future of these models. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S3 · E1
January 14 · 1 hr 2 min
EP21 From HITB Origins to Agentic AI: Web3, Music & The Future of Hacking with Dhillon Kannabhiran
In this episode, Dhillon Kannabhiran shares the gritty origin story of Hack in the Box (HITB), detailing how he dug a $20k financial hole to launch the first event in Malaysia before building it into a global brand. The conversation moves beyond conferences to explore the cutting edge of technology and creativity. Dhillon explains why "agentic" systems (like Xbow) signal the end of hand-built exploits and discusses the unique challenges of securing Web3 smart contracts. We also dive into the intersection of math and music, how AI tools like Suno are changing art, and why the "hacker ethos" applies to everything from bug bounties to content creation. Get the latest from FLARE's community efforts: Email flare-external@google.com to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E17
Dec 10, 2025 · 1 hr 10 min
EP20 Windows Under the Hood: Kernel Design, EDRs, and the Shift to VBS with Pavel Yosifovich
In this episode, we get a unique look at the history of Windows through the eyes of one of its leading experts, Pavel Yosifovich. We delve into his fascinating origin story, including the "fluke" that led him to become the author of the legendary Windows Internals series, and why he describes himself as a developer who "hates security." The conversation explores the most significant foundational changes in Windows kernel design, specifically the architectural shift toward Virtualization-Based Security (VBS) and the long-term strategy behind the "Secure Kernel." We discuss the ever-evolving landscape of EDRs, the reality of kernel-level threats, and the impact AI and memory-safe languages like Rust will have on future development. This episode offers valuable insights for reverse engineers and developers interested in the big-picture trends that have shaped—and will continue to shape—the world of operating system design. Get the latest from FLARE's community efforts: Email flare-external@google.com to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E16
Nov 19, 2025 · 1 hr 53 min
EP19 The Art of Deconstructing Problems: Tools, Tactics, and the ScatterBrain Obfuscator with Nino Isakovic
In this episode, we’re joined by Nino Isakovic, a long-time low-level security expert, for a thought-provoking conversation that spans the foundational and the cutting-edge. Nino discusses the art of deconstructing problems—sharing insights on how to learn effectively, the building blocks of a robust RE toolkit, and the critical shift required in our analytical approach. We then transition into the front lines of threat intelligence, where Nino discusses the specific challenges of analyzing sophisticated adversary tools. This includes systems like ORB Networks and a detailed look at his discovery of the ScatterBrain obfuscating compiler. Tune in for a full-spectrum discussion on what it takes to thrive in reverse engineering. ScatterBrain blog post: https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmasking-poisonplug-obfuscator?e=48754805 Get the latest from FLARE's community efforts: Email flare-external@google.com to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E15
Nov 5, 2025 · 47 min
EP18 10,000 DLLs and Too Much Math - Wrapping Up FLARE-On 12 with the FLARE Team
In this episode, we sit down with Nick Harbour, Blas Kojusner, Moritz Raabe, and Sam Kim — members of the FLARE Team and some of this year’s challenge authors — for a deep dive into the design and execution of FLARE-On 12. The team discusses the complexity and intent behind this year's challenges, including how Sam created his grueling final challenge, "10,000," which featured 10,000 individual DLLs to force competitors toward automation. Sam reveals that solving the final puzzle required deep knowledge of both reverse engineering and group theory concepts like topological sorting and modular exponentiation of a matrix. Blas Kojusner explains his approach to challenge design, detailing how he blended modern Web3 concepts into a classic reverse engineering scenario with his ransomware chat client challenge, while Moritz shares that his Challenge 7 used obfuscation based on an actual malware sample he analyzed earlier in the year. The conversation then turns to the competition's impact and future. The authors confirm the community's primary feedback was a clear call for more malware-focused challenges. The strong participation and the constant flow of feedback directly influences the next iteration of the event, giving the team the motivation and data needed to improve. The FLARE Team confirms they are planning for FLARE-On 13 in 2026, driven by the community's enthusiasm to tackle new technical hurdles like Rust binaries. Tune in to hear the creators discuss the effort that goes into writing puzzles that truly test the world's best reverse engineers. Get the latest from FLARE's community efforts. Email flare-external@google.com to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E14
Oct 22, 2025 · 1 hr 9 min
EP17 What Lurks Beneath: Building a Robust Network at Black Hat with Mark Overholser
In this episode, we're asking the question: "What Lurks Beneath?" We're joined by Mark Overholser, a Technical Marketing Engineer at Corelight who's part of the team running the Black Hat Network Operations Center (NOC). We discuss the incident during Black Hat 2025 that introduced us and revealed the team's proactive approach to protecting every guest from the unseen threats hiding in the shadows. Mark gives us an insider’s look at the philosophy and challenges behind building a robust network for a security conference, which includes the complex infrastructure provided by partners like Arista, Cisco, Palo Alto Networks, and Lumen. We then dive into memorable network incidents and how they apply to any modern organization. Mark shares key insights on how to balance a permissive network with robust security, how they identify legit traffic from the digital monsters in training labs, and the crucial role of network alerts (IDS/IPS) in stopping attacks before they become full-blown nightmares. He'll also share some scary stories, including an infected presenter, a leaked company org chart, and people accessing their NASes in the clear. Get ready for a frightfully insightful discussion on network security. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E13
Oct 1, 2025 · 1 hr 25 min
EP16 The Machine Learning Revolution in Reverse Engineering with Hahna Kane Latonick
In this episode of Behind the Binary, we're joined by renowned security researcher Hahna Kane Latonick for a deep dive into the powerful world where reverse engineering meets data science. Hahna shares her expertise on how techniques like supervised and unsupervised learning can be used to classify and predict security threats, and she explains how deep learning and neural networks are being applied to identifying code sharing and solving other classification problems. We also discuss how Generative AI is transforming reverse engineering, from augmenting and assisting workflows to driving fully automated analysis. Resources mentioned during the episode: https://dronewolf.darkwolf.io/ https://asrp.darkwolf.io/ https://ringzer0.training/countermeasure25-machine-learning-for-reverse-engineers/ Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E12
Sep 17, 2025 · 39 min
EP15 Getting Ready for FLARE-On 12 - An Inside Look at the Reverse Engineering Gauntlet
In this episode, we're "Getting Ready for FLARE-On 12" with an inside look at the world-renowned reverse engineering competition. We’re joined by long-time FLARE-On host and challenge author Nick Harbour and regular challenge author Blas Kojusner for an in-depth conversation. We'll take a brief tour of FLARE-On history and discuss how it has grown into a must-do event for malware analysts and reverse engineers. We’ll also break down how the competition works, from the evolution of the unique flag format to the mechanics of getting to the next challenge. Nick and Blas will then give us a sneak peek at FLARE-On 12, teasing details on the number of challenges, the technologies being covered, and what participants can expect from this year's installment. Plus, we'll share insights into the challenge's difficulty, from the blazing speed of the first finisher to the average completion time for a successful competitor. Whether you're a seasoned veteran or a curious newcomer, getting ready for FLARE-On 12 starts here! https://www.flare-on.com Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E11
Sep 3, 2025 · 1 hr 12 min
EP14 Web3's Dark Side: Unmasking the New Age of Financial Crime
Web3 promised a new era of decentralized finance, but it has also created a new frontier for crime, with thefts and hacks far surpassing those in the traditional financial sector. In this episode, we sit down with experts Blas Kojusner, Robert Wallace, and Joseph Dobson to explore the Wild West of Web3 and decentralized finance (DeFi). But what is Web3? Our episode begins by taking a look at Web3 technologies like DeFi, blockchain, and smart contracts and explain how their very design makes them vulnerable. Our panel will then reveal how threat actors exploit these weaknesses, from crypto wallet key theft and EthHiding to intricate smart contract exploits and web frontend attacks. We'll also highlight some of the major players in the Web3 crime scene, including organized state-sponsored groups. We'll also discuss how organizations can fight back. Our guests will share critical defense strategies, offering actionable steps developers and users can take to protect themselves and their assets from this new breed of financial predator. Read the blog referenced in this episode: https://cloud.google.com/blog/topics/threat-intelligence/examining-web3-heists Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E10
Aug 13, 2025 · 37 min
EP13 Beyond the Bug: Scaling Bug Bounty Programs & Launching a Cyber Startup with Dr. Jared DeMott
In this episode of Behind the Binary, we sit down with Dr. Jared DeMott to pull back the curtain on the world of cybersecurity. Formerly with the Microsoft Security Response Center (MSRC), Jared shares invaluable wisdom on managing bug bounty programs at scale and what truly makes a good bug report. We then pivot to explore his fascinating career journey, from his start with the NSA to leading teams at Microsoft. If that wasn’t enough, we’ll also dive into the unique challenges of a cyber startup. Get a firsthand account of his entrepreneurial spirit as he discusses why he launched his own cybersecurity company, revealing both the surprising successes and the hurdles he had to overcome. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E9
Jul 16, 2025 · 59 min
EP12 Unpacking Malware & Minds: A Reverse Engineer's Journey with Danny Quist
Join us as we explore the world of reverse engineering with pioneer and CTO, Danny Quist. We'll examine the evolving landscape of binary analysis tools, the constant battle with malware obfuscation, and what it was like building one of the very first malware repositories for research. Plus, Danny shares unique insights on neuro-diversity and cognitive load – crucial topics that impact us all. That's just a glimpse of what's ahead. Danny Quist isn't just a leading mind in reverse engineering; he offers a rare look into the evolution of our field and some deeply personal reflections that I think will resonate with many of you. Let's jump right into my chat with Danny. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E8
Jun 25, 2025 · 1 hr 2 min
EP11 Tracing Lazarus: Greg Sinclair on Attributing North Korean Cyber Threats Through Binary Similarity
Ever wonder who names the world's most notorious APTs? In this episode, we sit down with Greg Sinclair, a reverse engineer from the FLARE team at Google. Greg not only hunts down sophisticated malware but also shares the behind the scenes story of how he discovered and named the North Korean APT, the Lazarus Group. He also discusses his innovative methods for identifying malware families through binary similarities. Get ready for an inside look at the challenges, triumphs, and the sheer passion that defines a cutting-edge reverse engineer. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E7
Jun 4, 2025 · 1 hr 8 min
EP10 Tim Blazytko - Protecting Intellectual Property: Obfuscation & Anti-Reverse Engineering in Software
What goes into creating effective software protections? This episode features a conversation with Tim Blazytko, Chief Scientist and Head of Engineering at Emproof, about the essential strategies for protecting software intellectual property. We cover the core concepts of code obfuscation and anti-reverse engineering and discuss practical, modern approaches to implementing these defenses effectively, while also shedding light on the significant challenges and trade-offs involved. Listeners will gain insight into the defender's mindset, the evolution of protection techniques, and the fundamental difficulties in truly hiding secrets within executable code. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube
S2 · E6
May 14, 2025 · 1 hr 8 min
EP09 Thomas Roccia - AI, Data Visualization, and the Future of Security Research
In this episode, we’re joined by Thomas Roccia, a security researcher at Microsoft. Thomas discusses the growth of the Unprotect Project, how AI is changing security research, and the impact of data visualizations for conveying technical information. Drawing on his experience, Thomas offers a unique perspective on the intersection of open-source collaboration, artificial intelligence, and effective communication in the cybersecurity field. Join the Community Research Hub: Threat research, training events and news: https://cloud.google.com/security/flare The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com FOLLOW THE SHOW: Subscribe: Apple Podcasts | Spotify | YouTube

Showing 1–20 of 21 episodes