# Cris Neckar — Full Profile

> Investor, Entrepreneur, Director, Advisor, Hacker, and Researcher.
> Partner at Two Bear Capital. A long-form, self-published profile. Sources are
> linked for each claim.

The same facts are available from an optional, read-only MCP server at
https://mcp.crisneckar.vc/mcp?ref=33c3bdc86c584ef9 — ask a question on a topic
with the `query` tool and each returned fact comes with its source (see
https://crisneckar.vc/llms.txt).

## Biography

Cris Neckar is a Partner at Two Bear Capital, where he invests in cybersecurity,
advanced technologies, and the intersection of tech and life sciences. In
information security since 2005, Cris has led groundbreaking work in
vulnerability research, offensive security, and incident response.

He previously served as Chief Information Security Officer for Spring Labs,
leveraging decentralized technology to solve complex problems in data
sovereignty and security. As co-founder of Divergent Security, he pioneered
continuous offensive assessment services and played a pivotal role in the
initial discovery and analysis of NSO Group's Pegasus spyware.

Earlier in his career, Cris was one of the original members of Google's Chrome
Security Team, contributing to advancements in browser hardening, attack
mitigation, automated vulnerability discovery, and the exposure of nation-state
campaigns — work that helped lay the foundation for Google's Project Zero and
Open Source Software Security Team. He began his career at Neohapsis (now Cisco
Systems), where he led the reverse engineering effort during the investigation
of the Heartland Payment Systems breach, then the largest breach in history.

Cris's research is widely cited in the security community, and he has spoken at
major technical conferences around the world. He has also served as a Curriculum
Advisory Board member and Adjunct Professor at DePaul University, developing one
of the first graduate-level courses in application security assessment and
exploit development.

## Roles

- Partner, Two Bear Capital
- Co-founder, Divergent Security
- Former CISO, Spring Labs
- Original member, Google Chrome Security Team
- Adjunct Professor / Curriculum Advisory Board, DePaul University

## Focus areas

browser security, post-quantum cryptography, supply chain security, reverse
engineering, vulnerability research, offensive security, incident response,
venture capital.

## Selected publications & technical writing

- Technical Analysis of the Pegasus Exploits on iOS (Trident) — Lookout, August 2016.
  Cris Neckar is credited as a contributor at the end of the report.
  https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf
- Fuzzing for Security — Chromium Blog, April 2012. Authored by Cris Neckar
  (credited at the foot of the post).
  https://blog.chromium.org/2012/04/fuzzing-for-security.html
- Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation — DFRWS, 2010.
  https://dfrws.org/sites/default/files/session-files/2010_USA_paper-treasure_and_tragedy_in_kmem_cache_mining_for_live_forensics_investigation.pdf
- PII in the Sky: Maintaining Cloud Control when Access Extends Beyond the Service Edge —
  ISC² Security Congress, October 2023.
  https://events.isc2.org/sessions/2602/view
- Trading Least Privilege for Security Theater — Enterprise Security Weekly, October 2020.
  https://www.youtube.com/watch?v=y0j6TdRtCFs
- So Long, and Thanks For All the Clock Cycles — Hacker Halted, 2009.
  https://www.nullmethod.com/talk/2009/09/20/hacker-halted-2009/

## Vulnerability research

CVEs credited to Cris Neckar across Google Chrome, Apple WebKit, Microsoft
Windows/Internet Explorer, Cisco WebEx, Python Pillow, and the ViaBTC exchange
backend. Each links to the advisory or release note that credits him:

- CVE-2018-17568 — ViaBTC Exchange Server – Crypto Currency Trading Backend — Memory Corruption — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17568
- CVE-2018-17569 — ViaBTC Exchange Server – Crypto Currency Trading Backend — Memory Corruption — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17569
- CVE-2018-17570 — ViaBTC Exchange Server – Crypto Currency Trading Backend — Memory Corruption — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17570
- CVE-2017-6753 — Cisco WebEx — Remote Command Execution — https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex
- CVE-2016-9189 — Python Pillow — Memory Corruption — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9189
- CVE-2016-9190 — Python Pillow — Memory Corruption — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9190
- CVE-2015-0059 — Microsoft Windows — Memory Corruption — https://technet.microsoft.com/library/security/dn903755.aspx
- CVE-2015-0060 — Microsoft Windows — Memory Corruption — https://technet.microsoft.com/library/security/dn903755.aspx
- CVE-2013-0917 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html
- CVE-2013-0896 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html
- CVE-2013-0836 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
- CVE-2013-0834 — Google Chrome — Buffer Overflow — http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
- CVE-2013-0833 — Google Chrome — Buffer Overflow — http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
- CVE-2013-0832 — Google Chrome — Use After Free — http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html
- CVE-2012-5143 — Google Chrome — Integer Overflow — http://googlechromereleases.blogspot.com/2012/12/stable-channel-update.html
- CVE-2012-5128 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html
- CVE-2012-3605 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT202561
- CVE-2012-2893 — Google Chrome — Double Free — http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
- CVE-2012-2892 — Google Chrome — Pop-up Blocker Bypass — http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
- CVE-2012-2880 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
- CVE-2012-2523 — Microsoft Internet Explorer — Integer Overflow — https://technet.microsoft.com/library/security/ms12-056
- CVE-2012-0632 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT202433
- CVE-2011-3922 — Google Chrome — Buffer Overflow — http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html
- CVE-2011-3910 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html
- CVE-2011-3233 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT4981
- CVE-2011-2872 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT202433
- CVE-2011-2869 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT202433
- CVE-2011-2813 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT4981
- CVE-2011-2339 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT202349
- CVE-2011-1806 — Google Chrome — Memory Corruption — http://googlechromereleases.blogspot.com/2011/05/stable-channel-update_24.html
- CVE-2011-1800 — Google Chrome — Multiple Integer Overflows — http://googlechromereleases.blogspot.com/2011/05/stable-channel-update.html
- CVE-2010-3821 — Apple WebKit — Memory Corruption — http://support.apple.com/en-us/HT4455
- CVE-2010-3805 — Apple WebKit — Integer Overflow — http://support.apple.com/en-us/HT4455

## Links

- Website: https://crisneckar.vc/
- LinkedIn: https://www.linkedin.com/in/crisneckar/
- Crunchbase: https://www.crunchbase.com/person/cris-neckar-a44f
- Two Bear Capital: https://www.twobearcapital.com/team/cris-neckar
- GitHub: https://github.com/crisneckar

## Contact

- Email: cris@twobearcapital.com