Chris Valasek: From Windows Exploits to the Jeep Hack

Chris Valasek is the other half of the most famous car hack in history, and the half who shouted "You're doomed!" down the phone while a Wired reporter coasted to a stop on a St. Louis interstate.

Before cars, he was known for something far more obscure: the inner workings of the Windows heap, the memory machinery that most programmers never think about and attackers think about constantly. He's also chaired SummerCon, the oldest hacker conference in the United States.

Then came the Jeep, a 1.4-million-vehicle recall, and a strange career turn. The man who showed the world how to take over a car has spent the decade since trying to make sure nobody can do it to a car that drives itself.

Chris Valasek at a Glance

• A University of Pittsburgh computer science graduate, Valasek took his first job in 2005 at a software company called Cambia and moved to Internet Security Systems a year later to write intrusion-detection software.
• At Black Hat USA 2010 he published "Understanding the Low Fragmentation Heap," a deep study of Windows memory management that made his name in exploit research.
• He went on to Coverity, Accuvant Labs and IOActive, where he became director of vehicle security research, and became chairman of SummerCon.
• In 2013 he and Charlie Miller, with DARPA funding, released tools and a paper showing how a laptop wired into a Ford Escape or a Toyota Prius could seize their controls.
• In August 2014 the pair presented "A Survey of Remote Automotive Attack Surfaces" at Black Hat, ranking cars by how exposed they were.
• In July 2015 they remotely hacked a 2014 Jeep Cherokee on a highway, and Chrysler recalled 1.4 million vehicles.
• Uber hired both for its self-driving lab in Pittsburgh that August; Valasek left on June 20, 2017, and in July joined Cruise with Miller to run its autonomous-vehicle security team.
• Now at General Motors, he and Miller keynoted the USENIX VehicleSec conference in August 2025 with "Ten Years After the Jeep Hack."

The Life of Chris Valasek

Valasek's Early Years

Valasek is a Pittsburgh product. He earned a bachelor's degree in computer science at the University of Pittsburgh and started his career in 2005 at Cambia, a software company that later became part of Tripwire.

A year later he joined Internet Security Systems, the security company that IBM would soon buy, writing code for its intrusion prevention and detection products. It was the right place to learn how attacks look from the inside.

The Heap

Most people who break software go after the bugs. Valasek went after the ground the bugs stand on.

Windows manages the memory that programs request through a system called the heap, and Microsoft had reworked it around a component called the Low Fragmentation Heap, which didn't behave like the designs attackers had learned on. In 2010 Valasek, then an X-Force researcher, took the new design apart at Black Hat USA in a paper titled Understanding the Low Fragmentation Heap, explaining how it allocated memory and where it could still be abused.

It was dense, technical work, and it earned him a reputation as one of the sharpest reverse engineers of his generation. Jobs at Coverity and Accuvant Labs followed.

SummerCon

Valasek also ended up running a piece of hacker history. SummerCon is described as the oldest hacker conference in the United States, and by the 2010s he was its chairman.

It says something about his standing that the people who run the scene's oldest party handed him the keys.

Car Hacking for Poories

The car work began as a side project with Charlie Miller, the former NSA analyst and Pwn2Own champion, funded by a DARPA grant. In 2013 they took a Ford Escape and a Toyota Prius apart and figured out how the computers inside talked to each other.

The result was a paper, "Adventures in Automotive Networks and Control Units," and a library of tools that let a laptop plugged into a car's diagnostic port send its own commands over the internal network. The demonstration, with a Wired reporter driving around a South Bend, Indiana, parking lot while they killed the brakes and jerked the wheel from the back seat, made headlines worldwide.

A follow-up, "Car Hacking for Poories," explained how to do the same research without buying a whole car, and in August 2014 at Black Hat the two presented a survey of which models were most exposed. By then Valasek was director of security intelligence at IOActive, traveling from Tokyo to Las Vegas to explain that cars were computers now, and badly secured ones.

The Jeep

The wire came out in 2015. After a year of work, Miller and Valasek could reach a 2014 Jeep Cherokee over the cellular connection in its dashboard and from there send commands to the car itself.

On a July day they put Andy Greenberg of Wired behind the wheel on Interstate 64 and, from Miller's house ten miles away, turned the air conditioning to full, cranked the radio, switched on the wipers and finally cut the transmission as the Jeep climbed an overpass with a semi behind it. "You're doomed!" Valasek shouted over the speakerphone, though Greenberg could barely hear him over the music.

Wired published the story on July 21, 2015. Three days later Chrysler recalled 1.4 million vehicles, the first automotive recall ever prompted by a hacking flaw, and Valasek tested the attack again to confirm that Sprint was now blocking it on its network. The following month the two presented "Remote Exploitation of an Unaltered Passenger Vehicle" at Black Hat.

Uber, Cruise and GM

Having proved a car could be hijacked, they were hired to stop it from happening to the cars of the future. In August 2015 Uber brought both men into its Advanced Technologies Center in Pittsburgh, the lab building its self-driving fleet, where Valasek became security lead.

He left Uber on June 20, 2017. A month later he announced on Twitter that he and Miller would be heading up the autonomous-vehicle security team at Cruise, the self-driving car company General Motors had bought in 2016. He added the hashtag #reunited.

He rose to director of cybersecurity at Cruise, responsible for the cars, the infrastructure and the applications around them. Along the way the pair kept publishing, including research on injecting messages onto a car's internal network to control steering, and a paper on securing self-driving cars.

Valasek Today

When Valasek and Miller took the stage at the USENIX VehicleSec conference in Seattle in August 2025, the program listed both as General Motors engineers.

Their keynote, "Ten Years After the Jeep Hack," looked back at what the industry had fixed since 2015 and what it still hadn't. Valasek remains, as ever, the one asking the uncomfortable questions.

Chris Valasek: "You're Doomed!"

It's a strange thing to be famous for a joke shouted at a terrified journalist, but the joke made the point better than any paper could. A car is a computer, computers get hacked, and the driver is just along for the ride.

Valasek spent his twenties learning how memory allocators fail and his thirties teaching automakers the same lesson about their cars. Now his job is to stop those worst-case scenarios from happening.

The joke on the phone was "You're doomed!" The work since has been about keeping drivers safe.