June 1st, 2021 – Alisa Esage
I never dreamt of a consulting career. Quite the opposite, I'd scoff at it. In my perception, a consultant was a kind of extremely boring middle-aged white collar dude making a living by solving nonexistent problems with fake expertise (sorry, guys!). That's a major anti-hero role for someone as passionate about one's work as myself, so even as I gained expertise and learned to solve arbitrarily complex technical challenges, the idea of technical consulting never touched my mind.
It all has changed when I started receiving very interesting and advanced technical questions from extremely serious technical professionals. Think of top 5 your favorite technological companies, that's the kind of specialist that came for advice with long deep technical emails describing the nature of the challenge they're facing. As I answered their questions (and I have to admit that was a sort of relieving experience, as true knowledge sharing is not really common in this industry, in which everybody considers everybody else as a potential malicious adversary, and a definite cut-throat competitor), I was surprized to learn a few things not just technical, but also personal.
First: somehow I was able to accurately see the solution, even if I never touched the subject in practice. It turns out, as I later reflected, that at some level of experience your theoretical modeling capability becomes accurate enough to transcend your immediate practical specialization. So people asked me some crazy questions about low-level intricacies of writing their own OS based on a proprietary hypervisor, and I instantly knew the answer by way of "connecting the dots" (MANY dots!) from my hands-on technical research experience with deep-systematical insights about how systems work in general, collected over two decades of multi-specialized low-level hacking. That was a surprize.
Second and most importantly: I felt self-realized, and completely at home. As an engineer, there is only so much information which is required to solve a specific technical challenge at hand; as a highly experienced multi-specialized engineer, the "only so much" part is a tiny fraction of your knowledge, so most of it remains unused and feels like a burden. You can write books, or read lectures, or shift to management, or hire a team that would put your knowledge to work and scale it; or you can optimize its applications by solving technical problems theoretically for those who are in a good position to implement it in practice. Maybe all of that? So I thought, why not.
This is how the idea of Zero Day Engineering consulting services was born, and with this blog I make it officially available.
Subject-wise, your consulting offer may be anything within the scope of this project (reverse-engineering, vulnerability research, exploit development, hypervisors or any other software system internals most of which I am familiar with). If you have a challenge that your team can't solve for some reason (and I mean "can't" as in no capability, vs. don't want to do it because it's too boring or routine), that would be a perfect thing for me. Cutting edge technical challenges that haven't seen enough public info or tools to solve trivially is always my favorite type of research, and so is advanced exploit development for non-trivial vulns.
Important note: consulting will never be my main job, just as trainings and bug bounty hunting never were - all of those I consider as late hour treats, that I may like to do for fun or a public service. In practice it means that I would be extremely discrete with what I accept, and choose only those opportinities that value and respect my work, time and knowledge.
Did I mention that those people to whose emails I wrote detailed answers never bothered to bounce even a "thank you" in return? So, neither should you bother me asking to give away my work, time and knowledge for free.
Booking and further details are available by email: contact@zerodayengineering.com.