Nick Cano's Resume
I have been coding for 20 years and have max skill points in security, C++, and automation. I am a full-stack, full-product engineer who can code anything in any language.
This is a web-friendly resume, a good ol' .pdf version is available upon request. An unfragmented list of my publications is here.
Employment History
Software Engineer, L5
Lead, Fuchsia OS Security Reviews
Oct 2021 - Jan 2023
I worked on the Fuchsia security team, where my primary work was reviewing design documents, RFCs, and source code to build threat models, identify security boundaries, quantify attack surface, locate vulnerabilities, recommend fixes or mitigations, and, in some cases, block insecure launches. I did this in partnership with development teams for everything from the Zircon kernel, down to the bootloader and drivers, all the way up to Google Assistant applications, and all across multiple networking stacks. In this job, I particularly aimed to identify systemic security issues so we could fix them at the source.
I took over technical leadership of reviews after a few months, where my focus narrowed to pairing, training, and delegating work to other members of the team as a means of growing our capacity and effectiveness.
In addition, I also wrote code for our package retrieval system, implemented new fuzzers for various codebases, and built an automated code scanning tool to help engineers and security reviewers in their day-to-day work. Further, I play tested the 2022 Google CTF and managed to score high while also being the first to solve a few challenges.
Skills Used
code auditing, fuzzing, vulnerability analysis, exploit development, operating system development, security engineering, filesystems, networking drivers, device drivers, bootloader and firmware security, syzkaller, Rust, C++, Python, Go, open source, leadership, communication
Blackberry/Cylance
Research Architect, Staff
Feb 2017 - Sept 2021
My first role at Cylance was researching, developing, and architecting advanced EDR technologies as part of the Office of the CTO initially, and as part of a dedicated research group later on. My job often found me temporarily embedded in existing teams, working with them to bring my prototypes into production. I occasionally lead cross-company efforts with technology partners to drive development forward.
After the BlackBerry acquisition, I moved into a group working on DLP where I contributed multiple proof-of-concept technologies and guided the architecture for their implementation. I later moved to the IVY team where I was one of four architects responsible for designing the system and leading the development.
Patents
Secured Code Package for Browser Plugin
One other currently in process
Publications
Skills Used
Windows kernel development, file format analysis, malware analysis, machine learning, user mode hooking, filesystems, PE file format, Windows internals, security engineering, application security, web security, Web Extensions, nodejs, cryptography, reverse engineering, C++, C#, C, Python, JavaScript, SQL cross-functional collaboration, leadership
Bromium
Senior Security Engineer
Jan 2014 - Feb 2017
I primarily focused on improving our malware analysis and detection platform by implementing novel behavioral detection capabilities, defining new rule sets, and analyzing emerging threats. Notable projects include refactoring our entire correlation engine, creating a robust packer detection system, building a framework to intercept Java applet execution, and implementing the initial version of our threat cloud. I also wrote internal security tooling, including an exploit framework that weaponized multiple CVEs which was used for product demonstrations.
Publications
Skills Used
Windows kernel development, malware analysis, user mode hooking, PE file format, Windows internals, reverse engineering, exploit development, security research, C++, C#, C, Python, Lua, Java, SQL
XenoBot
Founder
Doer of All Things
Dec 2010 - Nov 2017
XenoBot is an autonomous agent that can intelligently play a specific video game. I started writing it at age 15, and turned it into a business in 2010 when I was 17. At its peak, it had nearly 2,000 paid monthly users.
Engineering
The core of XenoBot is written from scratch, and is comprised of a code hooking library, a hand-rolled GUI engine, a packet capturing interface, a packet spoofer, a process memory manipulation library, proprietary code and function call injection routines, a memory fingerprint scanner, and a Lua binding around the aforementioned components.
The Lua binding also interoperates with the higher-level functionality, including a multi-dimensional, trainable, modified A* search, a state-machine based actuation controller, and a game state ensemble which correlates data from memory, packets, and hooks in the game's graphics engine.
Sysadmin & Security
XenoBot was supported by a variety of services, including a landing webpage, a VBulletin-based forum, an email server, redundant licensing servers, redundant update servers, and various DDoS protection technologies. I implemented all of these things and kept them running, up-to-date, and secure.
A non-trivial amount of my time was spent preventing DDoS, hardening licensing code against cracks, monitoring for suspicious activity, and actively fighting attacks such as DDoS, credential stuffing, targeted spam, and attempted intrusions.
Executive Duties
Aside from building the software, I also had to handle payments, provide customer support, draw up work contracts, hire consultants, pay invoices, run advertising and marketing campaigns, manage the business and registration, purchase code signing certificates, and moderate a forum.
Skills Used
graph theory, control theory, search algorithms, reinforcement learning, automation, reverse engineering, game design, game AI, game hacking, graphics programming, UI programming, Windows internals, Apache, cPanel, Cloudflare, Linux, Postfix, VBulletin, C++, Lua, Assembly, C, php, JavaScript, CSS, HTML, Python, SQL, Visual Basic, developer relations, leadership, communication, entrepreneurship
Tech Safari
Programmer Analyst
July 2012 - Jan 2014
I was responsible for writing algorithms in various languages that were capable of transforming, matching, and standardizing tens of millions of rows of data, scaled to run on systems with 128 cores and a terabyte of RAM. My code used a custom grammatical pattern matching engine for names, dates, and addresses, performed phonetic deduplication based on the Soundex algorithm, queried data geographically using orthodromic distance, and did fuzzy column-wise matches using radix trees.
I also wrote a transpiler which ingested formally-written statistical models for classifying medical data and produced scripts for a proprietary data processing language.
In all cases, I was responsible for scheduling time on machines and running my jobs in a manner which met customer deadlines and expectations. Moreover, I had to handle drops of data from vendors and to customers, while always using strong encryption and handling data with care and HIPAA compliance.
Skills Used
Distributed systems, algorithms, data structures, Linux administration, concurrency, cryptography, C++, Lua, Perl, Java, PostgreSQL
Additional Work
I can't help but hack, even in my spare time.
Books
Game Hacking: Developing Autonomous Bots for Online Games
No Starch Press
July 2016 | Code
Courses
Modern C++ Secure Coding Practices: Const Correctness
Pluralsight
July 2018
Talks
Game Runner 2049: The Battles Fought by King of the Replicants
DEFCON 26 Skytalks
Aug 2018
XenoScan: Scanning Memory Like a Boss
DEFCON 25
Aug 2017 | Slides | Video | Code
+1,000,000 -0: Cloning a Game Using Game Hacking and Terabytes of Data
DerbyCon 6.0
Sept 2016 | Slides | Video
The Hidden World of Game Hacking
HOPE X
July 2014 | Video
Ownage From Userland: Process Puppeteering
DerbyCon 3.0
Sept 2013 | Video
CVEs
DNS Rebinding against BlueStacks App Player IPC
CVE-2019-12936
June 2019
Connect
I am currently looking for work fitting the following description:
- Bay area or remote (relocation considered for exceptional roles)
- Principal-level engineering or security engineering roles
- Will consider engineering management roles in certain situations
- Prefer roles related to OS security, foundational AI models, or Windows internals
- Not interested in roles related to cryptocurrency
- Open to short-term consulting work
If you'd be interested in hiring me to build something with you, please get in touch.