Alisa Shevchenko

From Wikipedia, the free encyclopedia

Alisa Esage
Born
Алиса Шевченко

19.05[1] 1984[2]
Russia
Other namesAlisa Shevchenko
OccupationCybersecurity researcher
OrganizationZero Day Engineering
WebsiteHomepage

Alisa Esage (Russian: Алиса Шевченко), also known as Alisa Shevchenko, is a Russian hacker, recognized for working with companies to find vulnerabilities in their systems. A self-described "offensive security researcher," a 2014 profile in Forbes says of Shevchenko: "she was more drawn to hacking than programming."[3][4] After dropping out of school she worked as a malware analysis expert for Kaspersky Labs for five years. In 2009, she founded the company Esage Labs, later known as ZOR Security (the Russian acronym stands for Цифровое Оружие и Защита, "Digital Weapons and Defense.")

Shevchenko's company ZOR Security was placed on a list of US sanctioned entities after being accused of "helping Vladimir Putin bid to swing the [2016] election for Trump". Regarding White House accusations, Shevchenko stated on the record that authorities either misinterpreted facts or were deceived.[5] To this day, U.S. officials have not said why they believe Shevchenko worked with the GRU's hackers, or what she allegedly gave them.[6]

In early 2021 Alisa Esage officially started[7] the Zero Day Engineering project, specialized on professional training, research intelligence, and consulting in the area of advanced computer security research.

Alisa Esage is a winner of multiple international advanced hacking competitions, including Pwn2Own.

Achievements[]

In 2014 Alisa was the winner of the PHDays IV "Critical Infrastructure Attack" contest (alternative name: "Hack the Smart City"), successfully hacking a fake smart city and detecting several zero-day vulnerabilities in Indusoft Web Studio 7.1 by Schneider Electric.[8][9]

In 2014-2018 Alisa was credited for discovery of multiple zero-day security vulnerabilities in popular software products from tech giants such as Microsoft,[10] Firefox,[11] and Google.[12] Part of those vulnerabilities were responsively disclosed via the Zero Day Initiative (ZDI) security bounty program,[13] previously owned by U.S. tech giant HP, and credited under various pseudonyms.[14]

Alisa Esage has presented her research at multiple international security conferences: RECON, Positive Hack Days,[15] Zero Nights,[16] POC x Zer0con,[17] Chaos Communications Congress.[18] In 2020 she was scheduled to give a talk at OffensiveCon, which had to be canceled due to travel constraints.[19]

Her work has been featured in various professional security industry publications such as Virus Bulletin, Secure List, and Phrack Magazine.

Pwn2Own[]

On 8 April 2021 Alisa Esage made history as the first woman to win in the Pwn2Own, the iconic advanced hacking competition running since 2007.[20] As part of her competition entry at Pwn2Own Vancouver 2021 Alisa targeted Parallels Desktop for Mac version 16.1.3 with a zero day exploit developed by herself, and was able to successfully demonstrate a guest-to-host virtual machine escape with arbitrary code execution on MacOS, on a fully patched system.[21] The entry was declared a partial win by the contest due to the fact that the targeted software vendor knew internally about the zero day bug that was leveraged in Alisa's exploit.

Controversy[]

The "partial win" naming of Alisa's Pwn2Own Vancouver 2021 exploit by the organizers raised a massive outrage in the global information security community, with many commenters on Twitter demanding that the rules of the competition be changed so that the attempt would be declared a complete win.[22] According to Pwn2Own rules of 2021,[23] a successful contest entry may be disqualified or downgraded in the competition charts if the targeted software vendor was internally aware of the respective vulnerability (while still unpatched) on the day of the contest. Alisa's participation attracted public attention to that point of the rules, with numerous reasonable arguments tweeted by prominent figures of the computer security community to support a change of rules.[24]

Alisa's status as the first woman in Pwn2Own history was also questioned, although to a lesser extent. While the competition livestream recording[25] is clear on that point, with the narrator saying at 05:08 "Alisa is our first ever female participant", and the Pwn2Own founder chiming in on Twitter,[26] the official contest tweet came with a side note: "the first female participating as an individual". Rumor has it that one of the former Pwn2Own participants who entered the contest as part of a male team has subsequently changed their gender identity post-factum of their contest appearance. Fact-wise, the public record of Pwn2Own in the official blog posts[27] and livestream recordings[28] holds no mentions of female participation prior to Alisa's 2021 entry.

Motivation and personality[]

Alisa quotes her father as being the main inspiration to her choice of occupation and career: "He taught me to solder when I was 5 years old, I think. So I started reading books about computers and programming in early school and taught myself to code in C++ and x86 assembly language as soon as I got a PC at age 15."[29]

On her participation in the Pwn2Own competition: "It’s an essential milestone in a professional hacker’s career, and a major goal personally. I am super hyped! And relieved"[30]

Publications and exploits[]

References[]

  1. ^ Shevchenko, Alisa [@alisaesage] (19 May 2018). "С днём рождения, Алиса! Мы тебя любим. Самые лучшие пожелания ⭐️ Happy Birthday, Alisa! Best wishes, Love, may God bless.