How a 22
Jann Horn
In 2013  a teenager named Jann Horn attended a reception in Berlin hosted by Chancellor Angela Merkel. He and 64 other young Germans had done well in a government-run competition designed to encourage students to pursue scientific research.
Interviews with  Horn  and people who know him show how a combination of dogged determination and a powerful mind helped him stumble upon features and flaws that have been around for over a decade but had gone undetected  leaving most personal computers  internet servers and smartphones exposed to potential hacking.
Other researchers who found the same security holes months after  Horn  are amazed he worked alone. "We were several teams  and we had clues where to start. He was working from scratch " said Daniel Gruss  part of a team at Graz University of Technology in Austria that later uncovered what are now known as Meltdown and Spectre.
 Horn  wasnât looking to discover a major vulnerability in the worldâs computer chips when  in late April  he began reading Intel Corp. processor manuals that are thousands of pages long. He said he simply wanted to make sure the computer hardware could handle a particularly intensive bit of number-crunching code heâd created.
But  Zurich-based Horn  works at Project Zero  an elite unit of Alphabet Inc.âs Google  made up of cybersleuths who hunt for "zero day" vulnerabilities  unintended design flaws that can be exploited by hackers to break into computer systems.
So he started looking closely at how chips handle speculative execution -- a speed-enhancing technique where the processor tries to guess what part of code it will be required to execute next and starts performing those steps ahead of time -- and fetching the required data.  Horn  said the manuals stated that if the processor guessed wrong  the data from those misguided forays would still be stored in the chipâs memory.  Horn  realized that  once there  the information might be exposed by a clever hacker.
"At this point  I realized that the code pattern we were working on might potentially leak secret data  " Horn  said in emailed responses to Bloomberg questions. "I then realized that this could -- at least in theory -- affect more than just the code snippet we were working on."
That started what he called a "gradual process" of further investigation that led to the vulnerabilities.  Horn  said  he  was aware of other research  including from Gruss and the team at Graz  on how tiny differences in the time it takes a processor to retrieve information could let attackers learn where information is stored.
 Horn  discussed this with another young researcher at Google in Zurich  Felix Wilhelm  who pointed  Horn  to similar research he and others had done. This led  Horn  to what he called "a big aha moment." The techniques Wilhelm and others were testing could be "inverted" to force the processor to run new speculative executions that it wouldnât ordinarily try. This would trick the chip into retrieving specific data that could be accessed by hackers.
Having come across these ways to attack chips   Horn  said  he  consulted with Robert Swiecki  an older Google colleague whose computer  he  had borrowed to test some of  his  ideas. Swiecki advised  him  how best to tell Intel  ARM Holdings Plc. and Advanced Micro Devices Inc. about the flaws  which  Horn  did on June 1.
That set off a scramble by the worldâs largest technology companies to patch the security holes. By early January  when Meltdown and Spectre were announced to the world  most of the credit went to  Horn . The official online hub for descriptions and security patches lists more than ten researchers who reported the problems  and  Horn  is listed on top for both vulnerabilities.
Wolfgang Reinfeldt  Hornâs high school computer-science teacher at the Caecilienschule in the medieval city of Oldenburg about 20 miles from Germanyâs north coast  isnât surprised by his success. â Jann  was in my experience always an outstanding mind â  he  said.  Horn  found security problems with the schoolâs computer network that Reinfeldt admits left him speechless.
Mario Heiderich  founder of Berlin-based cybersecurity consultancy Cure53  first noticed  Horn  in mid-2014. Not yet 20   Horn  had posted intriguing tweets on a way to bypass a key security feature designed to prevent malicious code from infecting a userâs computer. Cure53 had been working on similar methods  so Heiderich shot  Horn  a message  and before long they were discussing whether  Horn  would like to join Cure53âs small team.
Heiderich soon discovered that  Horn  was still an undergraduate at the Ruhr University Bochum  where Heiderich was doing post-doctoral research. Ultimately  he became Hornâs undergraduate thesis supervisor  and  Horn  signed on at Cure53 as a contractor.
Cybersecurity specialist Bryant Zadegan and Ryan Lester  head of secure messaging startup Cyph  submitted a patent application alongside  Horn  in 2016. Zadegan had asked  Horn   through Cure53  to audit Cyphâs service to check for hacking vulnerabilities.  His  findings ended up as part of the patent and proved so significant that Zadegan felt  Horn  more than merited credit as one of the inventors. The tool they built would ensure that  even if Cyphâs main servers were hacked  individual user data were not exposed.
After two years at Cure53 and completing his undergraduate program   Horn  was recruited by Google to work on Project Zero. It was a bittersweet day for Heiderich when  Horn  asked him to write a recommendation letter for the job. "Google was his dream  and we didnât try to prevent him from going there " he said. "But it was painful to let him go."
In 2013  a teenager named  [TGT]  attended a reception in Berlin hosted by Chancellor Angela Merkel. He and 64 other young Germans had done well in a government-run competition designed to encourage students to pursue scientific research.
Interviews with  Horn  and people who know him show how a combination of dogged determination and a powerful mind helped him stumble upon features and flaws that have been around for over a decade but had gone undetected  leaving most personal computers  internet servers and smartphones exposed to potential hacking.
Other researchers who found the same security holes months after  Horn  are amazed he worked alone. "We were several teams  and we had clues where to start. He was working from scratch " said Daniel Gruss  part of a team at Graz University of Technology in Austria that later uncovered what are now known as Meltdown and Spectre.
 Horn  wasnât looking to discover a major vulnerability in the worldâs computer chips when  in late April  he began reading Intel Corp. processor manuals that are thousands of pages long. He said he simply wanted to make sure the computer hardware could handle a particularly intensive bit of number-crunching code heâd created.
But  Zurich-based Horn  works at Project Zero  an elite unit of Alphabet Inc.âs Google  made up of cybersleuths who hunt for "zero day" vulnerabilities  unintended design flaws that can be exploited by hackers to break into computer systems.
So he started looking closely at how chips handle speculative execution -- a speed-enhancing technique where the processor tries to guess what part of code it will be required to execute next and starts performing those steps ahead of time -- and fetching the required data.  Horn  said the manuals stated that if the processor guessed wrong  the data from those misguided forays would still be stored in the chipâs memory.  Horn  realized that  once there  the information might be exposed by a clever hacker.
"At this point  I realized that the code pattern we were working on might potentially leak secret data  " Horn  said in emailed responses to Bloomberg questions. "I then realized that this could -- at least in theory -- affect more than just the code snippet we were working on."
That started what he called a "gradual process" of further investigation that led to the vulnerabilities.  Horn  said  he  was aware of other research  including from Gruss and the team at Graz  on how tiny differences in the time it takes a processor to retrieve information could let attackers learn where information is stored.
 Horn  discussed this with another young researcher at Google in Zurich  Felix Wilhelm  who pointed  Horn  to similar research he and others had done. This led  Horn  to what he called "a big aha moment." The techniques Wilhelm and others were testing could be "inverted" to force the processor to run new speculative executions that it wouldnât ordinarily try. This would trick the chip into retrieving specific data that could be accessed by hackers.
Having come across these ways to attack chips   Horn  said  he  consulted with Robert Swiecki  an older Google colleague whose computer  he  had borrowed to test some of  his  ideas. Swiecki advised  him  how best to tell Intel  ARM Holdings Plc. and Advanced Micro Devices Inc. about the flaws  which  Horn  did on June 1.
That set off a scramble by the worldâs largest technology companies to patch the security holes. By early January  when Meltdown and Spectre were announced to the world  most of the credit went to  Horn . The official online hub for descriptions and security patches lists more than ten researchers who reported the problems  and  Horn  is listed on top for both vulnerabilities.
Wolfgang Reinfeldt  Hornâs high school computer-science teacher at the Caecilienschule in the medieval city of Oldenburg about 20 miles from Germanyâs north coast  isnât surprised by his success. â Jann  was in my experience always an outstanding mind â  he  said.  Horn  found security problems with the schoolâs computer network that Reinfeldt admits left him speechless.
Mario Heiderich  founder of Berlin-based cybersecurity consultancy Cure53  first noticed  Horn  in mid-2014. Not yet 20   Horn  had posted intriguing tweets on a way to bypass a key security feature designed to prevent malicious code from infecting a userâs computer. Cure53 had been working on similar methods  so Heiderich shot  Horn  a message  and before long they were discussing whether  Horn  would like to join Cure53âs small team.
Heiderich soon discovered that  Horn  was still an undergraduate at the Ruhr University Bochum  where Heiderich was doing post-doctoral research. Ultimately  he became Hornâs undergraduate thesis supervisor  and  Horn  signed on at Cure53 as a contractor.
Cybersecurity specialist Bryant Zadegan and Ryan Lester  head of secure messaging startup Cyph  submitted a patent application alongside  Horn  in 2016. Zadegan had asked  Horn   through Cure53  to audit Cyphâs service to check for hacking vulnerabilities.  His  findings ended up as part of the patent and proved so significant that Zadegan felt  Horn  more than merited credit as one of the inventors. The tool they built would ensure that  even if Cyphâs main servers were hacked  individual user data were not exposed.
After two years at Cure53 and completing his undergraduate program   Horn  was recruited by Google to work on Project Zero. It was a bittersweet day for Heiderich when  Horn  asked him to write a recommendation letter for the job. "Google was his dream  and we didnât try to prevent him from going there " he said. "But it was painful to let him go."