hey there, I'm Kelly

I'm a senior security researcher at Trail of Bits! Before this, I built and hacked distributed systems at Twitter. Previously I was also a graduate student in the NSR group at University of Colorado Boulder.

When I'm not working I am probably out hiking or skiing, depending on the season. I also like to take things apart, to fix things, to build new things, to cook things, and to eat (tasty) things. You'll probably find a lot of hiking scenery pictures and food (and, of course, pictures of my cat) on my socials.

github

email

mastodon

resume

technical blog

publications and talks

• Evan Sultanik, Marek Surovič, Henrik Brodin, Kelly Kaoudis, Facundo Tuesca, Carson Harmon, Lisa Overall, Joseph Sweeney, Bradford Larsen, "PolyTracker: Whole-Input Dynamic Information Flow Tracing", ACM ISSTA 2024. Won Distinguished Tool Award. [paper], [slides], [github]
• Ian Smith, Kelly Kaoudis: “Cedar, Rego, and OpenFGA Policy Languages: Comparative Language Security Assessment”, Trail of Bits, August 2024. [whitepaper]
• Fangfei Yang, Bumjin Im, Weijie Huang, Kelly Kaoudis, Anjo Vahldiek-Oberwagner, Chia-Che Tsai, Nathan Dautenhahn, "Endokernel: A Thread Safe Monitor for Lightweight Subprocess Isolation", Usenix Security 2024. [usenix link], [paper]
• Kelly Kaoudis, "Systems security in practice: threat modeling at Trail of Bits", invited guest lecture for University of Toronto's CleverHans Lab, Spring 2024. [updated slides]; also presented to UC Santa Cruz's Languages, Systems, and Data Seminar, Fall 2023. [slides]; also presented to Rice Univ. COMP 427: Intro to Computer Security, Spring 2023. [slides]
• Kelly Kaoudis, Shaun Mirani, Spencer Michaels, "Eclipse Mosquitto Threat Model", Trail of Bits, Nov 2023. [publication]
• Yi Chien, Vlad Bădoiu, Yudi Yang, Claire Huo, Kelly Kaoudis, Hugo Lefeuvre, Pierre Olivier, Nathan Dautenhahn, "CIVSCOPE: Analyzing Potential Memory Corruption Bugs in Compartment Interfaces", SOSP KISV (Proceedings of the 1st Workshop on Kernel Isolation, Safety and Verification pp. 33-40), 2023. [paper]
• Fangfei Yang, Weijie Huang, Kelly Kaoudis, Anjo Vahldiek-Oberwagner, Nathan Dautenhahn, "Endoprocess: Programmable and Extensible Subprocess Isolation", New Security Paradigms Workshop (NSPW), 2023. [paper]
• Artur Cygan, Kelly Kaoudis, Emilio López, "Eclipse JKube Security Assessment", Trail of Bits, Sept 2023. [report]
• Kelly Kaoudis, Will Brattain, "OIDC For HashiCorp Vault Access in GitHub Actions Workflows", Trail of Bits, Aug 2023. [whitepaper]
• Cliff Smith, Sam Alws, Kelly Kaoudis, Spencer Michaels, "Eclipse Jetty Security Assessment", Trail of Bits, June 2023. [report]
• Cliff Smith, Sam Alws, Kelly Kaoudis, Spencer Michaels, CVE-2023-36478, CVE-2023-36479, Eclipse Jetty, June 2023.
• Kelly Kaoudis, Henrik Brodin, Evan Sultanik, "Automatically Detecting Variability Bugs with Hybrid Control and Data Flow Analysis", LangSec (IEEE Security and Privacy Workshops), 2023. [langsec link], [paper]
• Yudi Yang, Weijie Huang, Kelly Kaoudis, Nathan Dautenhahn, "Automating Program Reasoning with the Object Encapsulation Model", LangSec (IEEE Security and Privacy Workshops), 2023. [langsec link]
• Kelly Kaoudis, "Beginner's guide to bug bounty", invited guest lecture for Rice University's COMP 427: Introduction to Computer Security, Spring 2022. [slides]
• Kelly Kaoudis, Sick Codes, "Pwning IPv4 parsing", DEFCON 29, 2021. [video]; also presented to CyberDT XSWG-14, Institute for Defense Analyses (IDA), July 2022. [updated slides]
• Sick Codes, Kelly Kaoudis, Victor Viale, John Jackson, CVE-2021-29922, CVE-2021-29923, CVE-2021-29921, CVE-2021-29662, CVE-2021-28918, CVE-2021-33318, April 2021.
• Kelly Kaoudis, "Application Security at (Twitter) Scale", Datadog Bits of Security, April 2021. [video]
• Kelly Kaoudis, "Scaling Validation of Streaming Data Products at Twitter", Strange Loop 2017. [video]
• Aimee Coughlin, Kelly Kaoudis, Eric Keller, "Augmenting Cloud Architectures to Support Decentralized Applications", IEEE Integrated Management, 2017. [paper]