Dug Song: From Password Sniffing to Duo Security

Every time your phone buzzes to ask whether that login was really you, you're using an idea that Dug Song and Jon Oberheide turned into a company in Ann Arbor, Michigan, in 2010.

Before that, Song was the hacker who wrote dsniff, the toolkit that showed how easily passwords could be lifted off a network, and the founding security architect of Arbor Networks. He came up through a hacker think tank whose members went on to build WhatsApp and Napster.

In 2018 Cisco paid $2.35 billion for Duo Security, Michigan's first tech unicorn. Song's response to becoming very rich was to stay exactly where he was.

Dug Song at a Glance

• At the University of Michigan, Song managed security for what Duo later described as the world's largest production Kerberos environment, and joined w00w00, a 1990s security think tank.
• In 1999 he contributed to the first release of OpenSSH. In December 2000 he shipped dsniff 2.3, a suite that sniffed passwords and hijacked SSH and HTTPS sessions, written "with honest intentions."
• He built the first commercial network anomaly detection system, later acquired by NFR and Check Point, then spent seven years as founding chief security architect at Arbor Networks.
• In 2010 he and Jon Oberheide founded Duo Security in Ann Arbor to make two-factor authentication something people would actually use. Duo had 2,000 customers by 2015.
• On August 2, 2018, Cisco announced it'd buy Duo for $2.35 billion. The deal closed on October 1, 2018, and Song joined Cisco's security business.
• He now runs Song United, a family office, chairs the Michigan Founders Fund, and started the Song Foundation with his wife in 2020.

The Life of Dug Song

Song's Early Years

Dug Song learned security the practical way, running it. At the University of Michigan he managed security in what Duo's own bio called "the world's largest production Kerberos environment," the authentication system that decided who could log in to what across a sprawling campus.

He also belonged to w00w00, a loose security think tank founded in 1996 whose thirty-odd members spanned twelve countries and later founded more than a dozen companies, including WhatsApp, Napster and Arbor Networks. When the OpenBSD team pried SSH loose from its licensing mess in the autumn of 1999, Song was among the non-crypto contributors credited on the first release of OpenSSH.

dsniff

In December 2000 Song released version 2.3 of dsniff, and the security world has been quoting its README ever since.

The suite did three things. Tools like dsniff, mailsnarf and urlsnarf "passively monitor a network for interesting data (passwords, e-mail, files, etc.)."

Then arpspoof, dnsspoof and macof "facilitate the interception of network traffic normally unavailable to an attacker," which meant the comforting belief that a switched network was safe from sniffing was dead. And sshmitm and webmitm "implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI."

Song's note at the bottom was the voice of a defender: "I wrote these tools with honest intentions - to audit my own network, and to demonstrate the insecurity of most network application protocols. Please do not abuse this software." Twenty-five years later, dsniff is still the standard classroom demonstration of why unencrypted protocols are a bad idea.

Arbor Networks

Song built "the first commercial network anomaly detection system," a product later acquired by NFR and then Check Point, and became the founding chief security architect of Arbor Networks, the Ann Arbor company that built network protection for the big internet providers.

He stayed seven years. By the time he left, Duo's bio noted, Arbor was "protecting 80% of the world's Internet service providers" and had grown past $120 million in annual revenue on its way to being acquired by Danaher.

Duo

Two-factor authentication existed in 2010; it was simply hated. Hardware tokens, codes read off a keyfob, enrollment forms. Song and Jon Oberheide, a Michigan PhD who'd worked at Arbor and Merit Network, founded Duo Security in Ann Arbor that year "to make secure access simple and human-centered," starting with a push notification: a phone buzzes, you tap Approve, and you're in.

"At Duo, we learn together faster," Song said of the company's culture. "We're not bigger, smarter, or have more resources than our competitors, but we learn faster. That's what makes us more agile."

The pitch to customers was "hassle-free and human-centered" security, and it worked: 2,000 customers by 2015, and by 2017 more than 500 employees across Ann Arbor, San Mateo, Austin and London.

Duo also quietly changed the conversation about what the second factor was for. Checking the device's health, not just the user's identity, before letting it in was an early form of what the industry now calls zero trust.

$2.35 Billion

On August 2, 2018, Cisco announced that it'd acquire Duo for $2.35 billion in cash and assumed equity awards. "Cisco created the modern IT infrastructure," Song said, "and together we will rapidly accelerate our mission of securing access for all users, with any device, connecting to any application, on any network."

The deal closed on October 1, 2018. Song and his team joined Cisco's networking and security business, and Duo, still headquartered in Ann Arbor, went on to serve more than 40,000 customers in more than 100 countries as part of Cisco Security.

Song's own summary is the shortest: Duo was "Michigan's first tech unicorn and multibillion-dollar venture-backed acquisition."

Dig and Be Dug

Song didn't move to California. His personal site opens with a motto borrowed from Langston Hughes: "Dig And Be Dug, In Return."

He's co-founder and CEO of Song United, which he describes as a Michigan family office "aligning investment and philanthropy in service of community wealth." He co-founded and chairs the Michigan Founders Fund, which helps entrepreneurs "turn business success into positive community impact," and in 2020 he and his wife started the Song Foundation to back people and organizations "improving the quality of life for all in Southeast Michigan."

The board seats pile up: the Detroit Regional Chamber, the Wallace House Center for Journalists, the University Musical Society, Michigan's computer science department and its Zell-Lurie entrepreneurship institute. He served on the transition teams of Governor Gretchen Whitmer and Detroit Mayor Mary Sheffield, and when the state's economic development agency made a 2021 ad about why talent should pick Michigan, the face it chose was his. In early 2026 he and Oberheide sat for a two-hour podcast on how they built a unicorn in a college town.

Dug Song: Dig and Be Dug

Song's career is a tidy argument that the best defenders are the people who know exactly how the attack works. He wrote the tool that stole passwords, then built the company that made them matter less.

The money went back into the place that made him. Ann Arbor got its unicorn, and then it got a patron.

The phone buzzes, you tap Approve, and one of Song's ideas does its job. Back in Michigan, he's putting the proceeds to work too.