How Offensive Security Made Me Better at Defense

How Offensive Security Made Me Better at Defense

Speaker: Dino Dai Zovi (Block)

Conference: OffensiveCon 2025 — May 16–17, 2025, Berlin (Closing Keynote)

YouTube: https://www.youtube.com/watch?v=60BcjiChncE

Reading time: ~9 minutes

TL;DR

In the closing keynote of OffensiveCon 2025, Dino Dai Zovi — veteran of Pwn2Own, Defcon CTF, and co-author of multiple security books — argues that deep offensive expertise is not just complementary to defense work but a prerequisite for building effective security engineering organizations. Drawing on two decades of experience from writing browser exploits and winning hacking competitions to running the Applied Security Engineering team at Block (formerly Square), Dai Zovi frames security as an economics problem where attacker resource constraints, attack graph reasoning, and threat model precision — skills intrinsic to exploit development — determine whether defenders spend effort where it actually matters.

Introduction

Closing keynotes at offensive security conferences often skew toward retrospective or inspirational territory. Dino Dai Zovi's talk at OffensiveCon 2025 does both, but with a sharper technical underpinning than most: it attempts to articulate precisely which cognitive skills developed through offensive security work transfer to defense, and how they translate into concrete engineering decisions.

Dai Zovi is an unusual figure in that he has been a practitioner at elite levels on both sides of the discipline. He won Pwn2Own in 2007 with a QuickTime Java exploit written overnight, co-wrote "The Mac Hacker's Handbook" with Charlie Miller, was present at the origins of bug bounty advocacy with the "No More Free Bugs" initiative, founded Capsule8 (a Linux EDR startup later acquired by Sophos), and now runs security engineering at Block — the fintech company operating Cash App, Square hardware, a Bitcoin custody product, and HSM infrastructure for payment processing.

The talk rejects the "defender's dilemma" framing — the popular claim that defenders must be right every time while attackers only need to win once — and replaces it with an engineering discipline grounded in attacker economics, attack graph analysis, and systems thinking.

Rejecting the Defender's Dilemma: Security as Engineering

▶ Watch: Security Engineering vs. Defender's Dilemma (0:00)

Dai Zovi opens by explicitly repudiating the "defender's dilemma" as false and counterproductive. In its place, he proposes the frame of security engineering — building systems, including organizations as systems, that remain dependable under malice, error, or mischance. He draws from Ross Anderson's textbook definition: a discipline focused on the tools, processes, and methods needed to design, implement, and test complete systems, and to adapt them as their environment evolves.

The practical implication is that security is not about achieving perfection at every point of contact with an attacker but about building systems with favorable economics — where the attacker's cost-to-exploit consistently exceeds the expected return. Offensive experience, Dai Zovi argues, gives defenders an intuitive and calibrated sense of what those costs actually are, something that is extremely difficult to develop without having personally done exploit development.

Attacker Economics and Attack Graph Reasoning

▶ Watch: Attacker Math and Attack Graphs (10:00)

A central theme of the talk is what Dai Zovi calls attacker math — the economic reasoning that offensive practitioners apply naturally when choosing between exploitation paths, but that most defenders have never internalized. He illustrates with a 2011 attack graph example against the browser ecosystem of the time.

At that point, Chrome 10 still used WebKit and JavaScriptCore. An attacker's options included:

• Develop a browser-specific exploit chain (sandbox escape + LPE) requiring multiple independent vulnerability classes.
• Exploit a Java plugin vulnerability, achieving medium-integrity native code execution across all three major browsers simultaneously with a single bug.

From an offensive perspective, the choice is obvious: Java gives you multi-browser reach for less work. But Dai Zovi's point is that most defenders in 2011 were not thinking about Java as a cross-browser threat multiplier — they were thinking about browser hardening in isolation. The attack graph reveals the actual threat priority, and building that graph requires the attacker's mental model.

He applies the same reasoning to sandbox escape: once a renderer is compromised, the rational next step is often not to pursue a renderer sandbox escape followed by a separate LPE, but to directly exploit the kernel if a suitable attack surface exists from the sandboxed context, skipping an entire step in the chain. Defenders who have never reasoned this way are prone to over-investing in the sandbox boundary and under-investing in kernel hardening relative to attacker economics.

▶ Watch: Early Career and Defcon CTF (2:00)

Dai Zovi grounds these points in autobiography: his first Defcon (DC7) as a teenager, where he placed second in CTF competing solo against teams; his work at Sandia National Labs, where he was first exposed to structured attack graph methodology (which he initially dismissed as unnecessary overhead when he could "just get remote root"); and his penetration testing career at AtStake and Matasano, which gave him breadth across many target types.

Pwn2Own 2007 and the Overnight QuickTime Exploit

▶ Watch: Pwn2Own 2007 Story (4:00)

The most technically detailed anecdote in the talk is Dai Zovi's account of winning the first Pwn2Own in 2007. After a friend called to tell him no one had won the MacBook on day one of CanSecWest, Dai Zovi — working a full day job in New York — spent the night reverse-engineering QuickTime for Java on Mac OS X.

He had previously found a bug in QuickTime's JNI-style dynamic linking interface; reasoning that a single bug implies more bugs in similar code, he dove into the implementation again and around 4–5 AM identified a bounds-checking flaw in how QuickTime handled buffer lengths before calling memcpy. The exploit he wrote that night abused the QTObject.id() method, which returned the actual heap pointer to a QuickTime buffer as its identifier — a trivial information leak that converted what might otherwise have been a blind exploit into a precise write-four primitive. He used that primitive to overwrite the stack and win the contest.

▶ Watch: Pwn2Own Exploit Code (6:00)

Dai Zovi presents the actual exploit code from 2007 — a few dozen lines of Java — to make the point that the barrier to Pwn2Own-level exploitation has increased dramatically since then, but that the underlying reasoning process (find the information leak, convert it to a precise write primitive, overwrite control flow) remains consistent across eras. The simplicity of the 2007 exploit makes the reasoning transparent in a way that modern multi-stage chains obscure.

From Offensive Roots to Defensive Security Engineering at Block

▶ Watch: Transition to Defense at Square/Block (8:00)

Around 2013–2014, Dai Zovi pivoted from offense-oriented work to running security at Square (now Block). He describes two motivating factors: the opportunity to apply systems-level thinking to a product with genuine societal impact (enabling small businesses to accept card payments), and a specific technical challenge — designing a PCI-compliant PIN entry solution using the consumer mobile device a merchant already owned, rather than a dedicated PIN pad. The solution required creating a new PCI payment standard, which Block and others now implement for low-cost chip card readers.

This work led directly to Capsule8, a Linux EDR built on kernel tracing (using Linux perf events before eBPF was widely deployed, avoiding the kernel module approach to prevent system instability). Block later acquired the effort when Sophos bought Capsule8 and Dai Zovi returned to Block to lead Applied Security Engineering — a team spanning Cash App peer-to-peer payments, Square payment hardware, a Bitcoin hardware wallet, tap-to-pay integration for iOS and Android, and the HSM infrastructure for payment and cryptocurrency operations.

▶ Watch: Applied Security Engineering at Block (10:00)

The common thread across all of these domains, Dai Zovi argues, is that the offensive researcher's instinct — asking "what would I do if I were attacking this?" and following that analysis to its logical conclusion — drives better prioritization and more realistic threat models than checklist-based compliance approaches. Specific examples from the talk include using attack graph reasoning to identify that the weakest link in a payment hardware security model was not the cryptographic protocol but the update mechanism, and applying attacker economics to decide which threat actors were realistically resourced to attack Cash App's infrastructure versus which ones were not.

Notable Quotes

"The defender's dilemma — defenders have to be right every time, attackers only need to be right once — I think this is false and BS. What I like instead is practicing security engineering: building systems that are dependable in the face of malice, error, or mischance."

— Dino Dai Zovi, ▶ 0:00

"I can look for a sandbox escape and then an LPE, or I can just exploit the kernel. If I have the attack surface and the vulnerability, I'll just go there. Most people who haven't done that sort of work don't really have that intuitive understanding yet."

— Dino Dai Zovi, ▶ 12:00

"I have remote root, start node, end node. Why do I need a fancy picture? I have compromised the entire thing."

— Dino Dai Zovi, recalling his early skepticism about attack graph methodology at Sandia, ▶ 4:00

Key Takeaways

• Attacker economics is a transferable skill. The intuition an offensive practitioner develops for estimating the cost and probability of different exploitation paths — and choosing the cheapest path to impact — is directly applicable to prioritizing defensive investments, but it requires having actually done offensive work to develop reliably.
• Attack graphs impose discipline on threat modeling. Dai Zovi's early dismissal of attack graphs as unnecessary overhead is a common attitude among skilled individual hackers. He credits structured graph-based reasoning with enabling the transition from "I can own this" to "here is the realistic distribution of paths an adversary would take against this system at scale."
• The "No More Free Bugs" movement pre-figured bug bounties. Dai Zovi, Charlie Miller, and Alex Sotirov argued in 2009 that researchers disclosing bugs to vendors for free were subsidizing software security with no mechanism for cost recovery — a structural argument that helped catalyze the modern bug bounty ecosystem.
• Offensive skills enable creative defensive architecture. Block's PCI-compliant mobile PIN entry solution — which created a new industry standard — required a security engineer willing to reason adversarially about what attacks a solution must resist, rather than implementing only what existing standards prescribed.
• The current threat model must be grounded in attacker resource constraints. Not all adversaries are nation-states. Dai Zovi argues that a calibrated understanding of which threat actors have the resources and motivation to pursue specific targets — itself a product of offensive research experience — is essential to avoid both over-engineering defenses against unrealistic threats and under-engineering against realistic ones.