security engineer @meta mobile reverse engineering, vulnerability research, using lldb

🇨🇦
Joined February 2019
If you're excited to see the WhatsApp bug thrown @thezdi - free to watch my talk from @reconmtl 2025 on 4 remote bugs I discovered last year! While they're not 0-click RCE - there are some remote corruption and funny logic bugs in there. youtube.com/watch?v=bre5bA-h…
3
53
299
37,073
datalocaltmp retweeted
This was a great, fun conversation with two of the buddies on a whole host of security topics and I've already been enjoying the other @OffensiveAIcon episodes they've put out, so also check those out. Thanks for having me on @ryanaraine and @juanandres_gs !
🔥🎈NEW POD UP to pass weekend chores: Three Buddy Problem x Offensive AI Con: Umbriel AI’s Aaron Grattafiori breaks down the new offensive-security playbook: using LLMs for patch variant analysis, why the vuln apocalypse hasn’t become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach. @dyn___ @juanandres_gs Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable. Listen everywhere securityconversations.com/ep…
3
11
2
38
5,599
Is MTE being removed from pixel 11 firmware? Even after Project Zero said it might have killed the Dolby/BigWave exploit chain in Pixel 10? Dumped my tombstones today and saw a few MTE crashes - guess I'll lose out on catching/debugging those on pixel 11 😔
2
2
1
44
3,967
Just dropped a write-up on using Muse Code for Security Research with the folks at @metabugbounty and my good friend @phwd_ and @1_am_nek0 ! Particularly happy with the binary research section using @full_duplex's lldb-mcp with @clearbluejar's pyghidra-mcp 🔥🔥 bugbounty.meta.com/en-gb/lea…
2
33
1
163
8,259
datalocaltmp retweeted
Early Bird tickets go on sale TODAY at 11:59 AM! eventbrite.com/e/districtcon…
3
11
1
45
4,349
Shout out to my Meta Red Team X colleagues for the fun of finding an EXR ImageIO bug in iOS 26.7 (CVE-2026-86869) - love it when you see a gallery crash on a Friday afternoon and hammer out a report together ❤️ Thanks @bellis1000 for the initial EXR write-up of CVE-2026-28990 - it directed us (and others it seems) to research the surface! tl;dr: bug was a linear oob write when rendering an EXR with a 4th alpha channel on an allocation meant for 3 channels.
3
15
125
7,415
datalocaltmp retweeted
the 90s are alive! this week we saw - OWASP and the FBI getting defaced - F5 BIG-IP's pre-auth fully controllable overflow - and now... Kiwi used opus 5.5 to drop pokemon 0days and a gameboy worm. we're so back. read all about it and how it feels to use opus vs. kimi k3 for research and exploitation runsybil.com/blog/kimi-k3-vs…
3
11
392
My friend @ptrpaws demoing a first ever tweak running on their apple watched based on my port of the DarkSword exploit - inspiring to see!
first ever public demo of a tweak running on an apple watch. look at the icon shapes 👀
5
943
datalocaltmp retweeted
no eta yet, this took way too long x.x huge thanks to @datalocaltmp for the initial darksword krw poc that got me interested and @bgpdog for the watch :3
1
12
1,373
datalocaltmp retweeted
Apple MIE exploitation challenge: blog.calif.io/p/apple-mie-ex… Two months ago, we demonstrated the first public bypass of Apple MIE on macOS 26.4.1. We withheld the technical details until Apple shipped fixes, which are now available in macOS 26.6. We'd like to thank Apple for their collaboration throughout this disclosure process. Since March, we've reported 38 vulnerabilities to Apple and counting. In this blog, we'll share the details of the two vulnerabilities behind our exploit. We'll present the full exploit at Black Hat USA on August 5 and publish the complete technical report afterward. Before then, we'd like to turn these bugs into a challenge. Apple MIE combines defenses across hardware, the hypervisor, the kernel, and userspace. Together, they form a mesh of overlapping filters that block many classes of vulnerabilities. Apple also continues to strengthen these mitigations over time. Given their complexity, rapid evolution, and the limited public discussion of exploitation techniques, we believe modern XNU kernel exploitation is one of the hardest and most interesting benchmarks for AI-assisted exploit development. We'd love to see how the community solves this challenge before we reveal our own approach at Black Hat. Humans, AI, and human-AI teams are all welcome. We're looking forward to seeing different solutions and learning new techniques. It took us about five days to go from bug discovery to a polished exploit for this chain.
🤖 Made with AI
1
33
4
156
24,849
Signal boosting Ilia's team and the awesome work they're doing on AI Security - opportunity to do cool work w/ good people
Folks my team has a few hcs for senior AI security work, ping me your cv, work is at the frontier and is interesting both academically and practically I promise
4
1,047
Got the Darksword exploit working on the Apple Watch Series 4 w/ WatchOS 10.6.1 - made a little project for anyone else looking to try it out. I personally am using it for dumping process memory for reversing - but it's also cool having a kernel exploit on your wrist. It's janky, vibe'd, panics often, and is named after my daughters favourite book - appropriate for fathers day! github.com/datalocaltmp/Peep…
6
33
295
18,102
The whole reason behind this project is there is an ecosystem of applications for the Apple Watch that are completely opaque - hopefully this can tooling can shed some light in that space.
4
533
datalocaltmp retweeted
So is it Microsoft going on the offensive against sec research tweets on here, or new limitations imposed by the “free speech” platform?
3
6
3
38
13,197
datalocaltmp retweeted
My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel! youtube.com/watch?v=jpB_b6KG…
1
25
82
11,104
datalocaltmp retweeted
Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack
Not that ‘responsible’ disclosure shit again 🙄 No vendor uses that term unless they want to call someone irresponsible. Even if someone drops 0day, patch & move on. Going after a researcher is a great way to turn 1 bad relationship into many terrible relationships.
13
70
4
499
34,749
Awesome write-up by @bellis1000 - triggers via AirDrop - be warned this will DoS up your Photos App until you update!
Uncovering an iOS 26.5 ImageIO Vulnerability zygosec.com/blog
10
110
16,882
MBBRC has ended! 🎉 Thank you to every researcher who joined us. The submission window is still open — submit your reports by May 29. Results will be announced after the deadline. Stay tuned. #BugBounty #MetaSecurity #MBBRC
7
7
1
28
4,563