GRIMM Named Finalist for the DC Timmy Awards: Best Tech Work Culture

By Anonymous -


GRIMM Named Finalist for the DC Timmy Awards: Best Tech Work Culture

GRIMM is excited to be named a finalist in the Best Tech Work Culture category for the DC Timmy Awards. These awards, now in their third year, recognize technology work cultures that actively promote technical creativity, innovation, and learning in the DC area and celebrate the organizations that make innovation possible.

Vote for GRIMM here!

Sponsored by Tech in Motion, the DC-area business community can vote online through September 8th to help choose who represents the best of DC tech. Winners will be chosen through a panel of expert judges and community votes. They will be announced live at DC Timmy Awards’ ceremony on September 28th at 1776 Crystal City in Arlington, where members of the DC tech community can attend for free and meet the finalists.

GRIMM takes deep pride in its dedication to education, innovation and technical problem solving. It takes great lengths to arm its entire team with the resources and freedom to tackle some of the most challenging security issues we face in an ever increasing connected world. From developing its model smart house, Howdy Neighbor, that simulates how multiple interactive “smart” home products can be hijacked by attackers to building its mobile car hacking lab, 3PO, built to demonstrate how hackers can hijack steering, accelerating, braking and communication systems in connected vehicles.
GRIMM’s team brings together diverse technical backgrounds from government, industry, academia and public policy to collaborate and pursue various areas of professional interest. While many organizations hire employees to focus on the development of a specific product or service, GRIMM looks for team members who are both creative and technical, who can step in to design and develop new innovative solutions that address today’s most critical cybersecurity challenges. GRIMM’s unique approach puts innovation first and foremost and has positioned the company as a thought leader within a diverse range of industries, including industrial control systems (ICS), smart grids and critical infrastructure, automotive and connected vehicles, IoT, smart home devices and other embedded technologies as well as web-based applications, networks, and systems.
GRIMM’s “learning first” culture provides its team with the autonomy to pursue various professional interests within cybersecurity. The company covers the costs of all employee training and educational opportunities and encourages team members to create at-home labs to pursue personal R&D projects. In addition to its robust internship program, GRIMM is developing several university cybersecurity club partnerships to help create a common curriculum for student hacking competitions. As a result, GRIMM’s team is hungry to innovate and solve cyber security’s most complex problems. While the team is rewarded with the flexibility to pursue projects that are unheard of at most traditional technology companies, employees also receive raises and bonuses for good work and family vacations for jobs well done.

The team at GRIMM is thrilled to be recognized among so many other great organizations in the DC tech community. The company looks forward to continuing to foster a culture of innovation and to research, develop, and advise on the art of the possible in cybersecurity.

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more