Trevor Eckhart

Full Stack Software Engineer, Secure App Development, Verizon Connect (formerly Telogis)2016 - present

• Applies secure development lifecycle (SDLC) practices, using Black Duck, SonarQube analysis and quality gates, and other security testing tools.
• Builds and secures full-stack enterprise applications: C# and .NET, Java, Python and Node.js on the back end, React, Angular, ExtJS and TypeScript on the front end, with REST APIs between them.
• Works with data in MS SQL Server, Postgres and Snowflake, and deploys to AWS and Google Cloud.
• Manages source repositories and CI/CD pipelines in TeamCity and Octopus Deploy.
• Ships applications for Windows, Linux and Android.
• Integrates generative AI into product workflows.
• Troubleshoots network traffic with Wireshark and Fiddler.

Solutions Developer, Professional Services, TelogisJun 2015 - 2016

• Promoted from Inside Technical Support to Solutions Developer on the Professional Services team.

Inside Technical Support, Telogis2011 - May 2015

• Supported enterprise customers carried over from Intergis and moved them onto the Telogis platform after the acquisition.
• Helped rewrite internal support tooling from VB to C#.

Systems Administrator, Intergis LLC2005 - 2011

• Built point-to-point IPSec VPNs between business locations on SonicWall, pfSense and m0n0wall.
• Ran Windows Server 2003/2008, Active Directory and about 300 workstations.
• Kept a load-balanced Citrix environment running for more than 900 users and helped run a high-availability VMware ESX farm of more than 100 virtual machines.
• DBA for several Microsoft SQL Server databases over 500 GB each. Also ran Exchange 2007 and Veritas Backup Exec.
• Received the company's 2009 Achievement Award for Outstanding Performance.

Carrier IQNov - Dec 2011

• Reverse-engineered Carrier IQ, hidden software on millions of phones that could log keystrokes and text messages, and published the research with a video showing it in action.
• Carrier IQ sent a legal threat over the research. The EFF stepped in and the company withdrew it with an apology. Sens. Al Franken and Richard Blumenthal followed with letters, and the FTC and FCC took a closer look.

HTC Loggers, CVE-2011-3975Sep - Oct 2011

• Found that an HTC update let any app with internet access read location, phone numbers and texts on HTC Android phones. Wrote the proof of concept and advisory, with validation from Artem Russakovskii and Justin Case.
• HTC confirmed the flaw and pushed out a fix, and F-Secure added a detection signature for it (Exploit:Android/HtcLoggers.A).

Police surveillance public records2020

• Filed public-records requests with six Massachusetts police departments about drones, Amazon Ring, BriefCam and license-plate readers, and contributed the results to the EFF Atlas of Surveillance.
• Raw DJI flight logs showed a police drone flown over a protest. The FAA called the flight "somewhat careless" and counseled the operator.
• Won a Supervisor of Records appeal (SPR20/1513) and uncovered Chicopee's undisclosed Ring agreement.
• Harvard Law School's Cyberlaw Clinic analyzed the case pro bono.