Jonathan Brossard also known as endrazine, is a French hacker, engineer and a Professor of computer science at the Conservatoire National des Arts et Metiers. He is best known as a pioneer in firmware cybersecurity, having presented the first public example of a hardware backdoor. The MIT Technology Review called it "undetectable and uncurable". He has presented several times at conferences such as DEF CON and Black Hat. In 2026, he acquired SecurityFocus and relaunched the Bugtraq mailing list, one of the oldest and most influential full disclosure venues in cybersecurity.
Research
BitLocker In 2008, Jonathan presented the first public vulnerability affecting full disk encryption software Microsoft Bitlocker at DEF CON. His generic exploit also affected other full disk encryption software such as Truecrypt, and BIOS firmware from Intel.
Hardware backdoor In 2012, Jonathan presented a Proof of Concept BIOS and PCI firmware malware named Rakshasa, the first known example of a permanent hardware backdoor, at DEF CON and Black Hat. The attack consisted in the inclusion of a Bootkit in firmware either from the BIOS or Network cards.
Microsoft Edge, Chrome and Windows 10 In 2015, along with the security team at Salesforce, he presented at Black Hat the first public attacks against Microsoft Edge and the Windows 10 operating system, allowing credential theft over the internet. Researchers discovered that Google Chrome was vulnerable to the very same Server Message Block vulnerability.
Reverse engineering Jonathan is the main author of the Witchcraft Compiler Collection, a reverse engineering framework presented at major conferences including DEF CON, Black Hat and USENIX. This framework allowing to transform an ELF binary into a shared library is available on Linux distributions such as Debian, Ubuntu or the Kali Linux distribution.
Other notable research Jonathan served as a security expert for major media outlets, for instance in the XKeyscore program disclosed by Edward Snowden, mass surveillance programs, when the NSA allegedly hacked French President Nicolas Sarkozy's emails, or warning the industry about car hacking as early as 2012.
Hacking culture
Watch Dogs In 2014, Jonathan was the main cybersecurity consultant to Watch Dogs by Ubisoft, presenting the game to an international press audience in Chicago, with global coverage including Australia, Deutschland, France or Spain. In 2016, Jonathan was also the main consultant for the second opus of the franchise Watch Dogs 2 and presented it to the international press.
Nmap and Hakin9 In 2012, Jonathan, along with other top security researchers including Chris Valasek, Matt Suiche and Jon Oberheide submitted a bogus, computer-generated article on Nmap to the Hakin9 security magazine, as a way to protest against the constant spamming of top researchers by the magazine. While the stunt was praised by hackers, the response of Hakin9, legally threatening fellow Nmap author Gordon Lyon was so terrible that it earned the Pwnie Awards for most epic fail in 2013.
Conference organizer Jonathan is the co-founder of international cybersecurity conferences Hackito Ergo Sum and NoSuchCon. He also sits on the review boards of the Shakacon (Honolulu, USA) and Nullcon (Goa, India) conferences.
SecurityFocus and Bugtraq
In August 2026, Brossard announced the acquisition of SecurityFocus and the Bugtraq name at DEF CON 34 in Las Vegas. Founded in 1993, Bugtraq had been the primary mailing list for full disclosure of security vulnerabilities for over two decades before going dormant in early 2021 under successive corporate owners. Brossard relaunched the list as an independently operated, community-driven platform: "We are providing the platform. The community decides what it becomes." DEF CON founder Jeff Moss posted to the relaunched list welcoming the effort.
See also Hardware_backdoor Bitlocker Bugtraq SecurityFocus
References
External links