Security Researcher / Engineer. Hunting for weird bugs and building things.
Joined December 2008
- Tweets2.8K
- Following936
- Followers7K
- Likes2.6K
Pinned Tweet
My Office RCE, CVE-2017-0199, won the Pwnie Award for Best Client-Side Bug! I'm speechless, thank you @PwnieAwards!
Photo Credit: @dalmoz_
Ryan Hanson retweeted
As soon as I heard @calif_io and @brucedang talking about FORCEDENTRY++ I had to add it to ELEGANTBOUNCER:
This weekend I had Codex rewrite the iOS Gravity tweak to work with the code execution primitive of my chain so I could have a fun demo like @calif_io
Luckily it survived the 27.2 update. No this isn't a full jailbreak, just a powerful sandbox escape.
The best part of Apple bugs is they are often times cross-platform due to the amount of shared code. I bet their chain works on visionOS too.
Ryan Hanson retweeted
I just remembered why Brotli looked vaguely familiar: I worked on it at Google. I even co-authored an RFC [1]. Hopefully they haven't found my bugdoor 😅
Joking aside, CRIME [2] led me to work on things like Brotli and HPACK, the header compression scheme used in HTTP/2.
That was the magic of working at Google. They operated at such a huge scale that a few weeks of your work could become part of a widely used Internet standard. One of my fondest memories is helping audit QUIC and writing little bits of crypto code for it.
Before I left Google, a teammate on the Tink [3] team told me he believed Tink would last 50 years, outliving everyone on the team. Tink is now in its 10th year. 40 more to go!
I also learned that breaking things is fun, but lasting contribution often comes from building things that make the Internet faster and safer.
That same belief shapes much of our work at Calif. People know us for our offensive security research, but we've also done a lot of security engineering to harden systems and mitigate attacks, from large-scale Rust migrations to fast sandboxing or reducing zero-click attack surface in mobile apps.
We'll be sharing some of that work soon. Stay tuned!
[1] rfc-editor.org/rfc/rfc9841.t…
[2] en.wikipedia.org/wiki/CRIME
[3] github.com/tink-crypto
Ryan Hanson retweeted
The @UnpromptedAU videos came out recently. Check out my ramble about AI assisted exploit development unprompted.au/videos/ai-assi…
Ryan Hanson retweeted
Team work makes the dream work <3
We wanted to do something a bit different than using LLM's to generate all the pieces from exploit, writeup and art. We decided on a human created comic to offset the LLM usage in our release, that tells the tale with some exaggerated scenarios inspired from a few movies.
If you liked the art (or want your own exploit story/comic..) check out her work at ibiscraft.art
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
Ryan Hanson retweeted
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
Ryan Hanson retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Ryan Hanson retweeted
Working as a consultant for over a decade, the engagements I look back on as most successful were those where we could provide configuration or code changes to defeature a system to the point that we were confident in a full attack surface coverage (of what was left).
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Ryan Hanson retweeted
Calif was founded with a mission to make the Internet a more secure place for everyone. In the last few months, we have been seeing significant advances in AI model capabilities, especially in the domain of offensive security research. In addition to publishing our research and learnings, we wondered what else we could do to help defenders.
While large corporations and government agencies have the dedicated budget and human resources for incident response and forensics, there are non-profit organizations –- collectively known as civil society organizations –- investigating digital threats affecting vulnerable groups and they are funded entirely by volunteers. In order to perform their job, the civil society researchers may need to extract data from mobile devices for forensic purposes, reverse engineer malware, and conduct similar security tasks. This work can be challenging given the restricted environments on some mobile devices.
We understand these technical challenges and will offer our research services and capabilities to these organizations, free of charge. We support them and their mission.
If you represent such an organization and need assistance, contact us at [email protected].
Ryan Hanson retweeted
You can see an iPhone get popped and still understand there’s nuance. I think Apple devices are some of the most expensive to attack. Exploiting them doesn’t make other devices more secure. AI is changing the economics but they’re still there. It hasn’t erased the mitigations.
Ryan Hanson retweeted
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
calif.io/research/big-fish
I love the notebook art style of these slides, they look so good
I put my @UnpromptedAU slides up at justdionysus.github.io/slide… — a bit of reflection on exploit development in the age of AI. My TL;DR is keep pushing to understand complex things, be honest with your own understanding, and use AI as a power tool to increase pace and depth.
Ryan Hanson retweeted
I’m really excited to dump out my brain this Saturday. I’ll be trying to explain my view of exploit development, mitigations, and how the process creates an interesting challenge for LLMs (and humans!) using some examples from our recent XNU research. Please say hi if you attend.
You asked. We organised.
Virtual tickets for unprompted.au 2026 are now live!!
Can’t make it to Sydney? Join remotely for two days of deep technical AI x Cybersecurity research, weird model behaviour and sharp minds pushing at the edges.
events.humanitix.com/unpromp…
If new frontier model training stopped today, I wouldn't complain. The capabilities and performance are already undeniably valuable. Majority of users don't need the intelligence improvements. Model improvements on token efficiency, speed, and user experience is what we need.
Ryan Hanson retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
