Pinned Tweet
Seizing the moment to share my macOS/iOS fuzzing training! Hands-on and practical. Feel free to reach out. retweets appreciated! 💥🍏 #iOS #macOS #fuzzing #infosec powerofcommunity.net/2025/tr…
𝗖𝗩𝗘-𝟮𝟬𝟮𝟱-𝟮𝟳𝟬𝟲𝟮 is one of my favorite Linux kernel vulnerabilities that we have discovered/exploited together with my brilliant former colleague @slava_moskvin_ docs.qualcomm.com/product/pu…
Heading to Seoul for the @POC_Crew conference. see you all soon! Ping me if you’re around, I’m always up for a good chat about fun stuff 😄✈️
2
25
iOS exploits and mitigations these days.
Best fuzzing blog post I read in recent years! Mandatory reading for anyone interested in fuzzing whether you use MacOS or not. So many good references to other projects for people to study!
r00tkitsmm.github.io/fuzzing… TL;DR I Implemented a super reliable macOS kernel binary rewriting to instrument any KEXT or XNU at BB or edge level.
1
40
1
232
To be clear, 5 CVEs + one Additional recognition.
9
Just found out this bug could have been used to sidestep MTE :) will try to prepare a presentation or a blog post.
𝗖𝗩𝗘-𝟮𝟬𝟮𝟱-𝟮𝟳𝟬𝟲𝟮 is one of my favorite Linux kernel vulnerabilities that we have discovered/exploited together with my brilliant former colleague @slava_moskvin_ docs.qualcomm.com/product/pu…
2
6
105
Amazing lineup, who else is coming to Seoul?
[#POC2025 NOTICE] 20 Years. Reborn. The brand evolved - The mission remains. Welcome to a new era of POC. ⏰ Date: November 13–14, 2025 📍 Venue: Four Seasons Hotel, Seoul, South Korea 🇰🇷 🎤 CFP: June 5 – September 30 🧑‍💻 Training: June 5 – September 30 🎟️ Registration: September 1 – October 31 More info 👉 powerofcommunity.net
1
7
This is so good of Apple: "we will provide a thousand iPhone 17 devices to civil society organizations who can get them into the hands of at-risk users."
1
27
Time to stop hacking and playing #GhostofYotei
1
8
Jann Horn, Google Project Zero 👀 iOS/macOS googleprojectzero.blogspot.c…
8
67
Meysam retweeted
🎉The CODE BLUE 2025 timetable is now live! From consumer device hacking and state-sponsored threat actors to legal insights into the “Cyber Response Capability Enhancement Act” by international scholars ― don’t miss this year’s powerful lineup👇📝 codeblue.jp/en/program/time-…
1
5
I still have no idea how or where to download the macOS KDK for build 25A354. Has Apple released it?
3
Meysam retweeted
Yes, I didn’t mean to refute any claims, I was just sharing blog posts I enjoyed reading, especially around the introduction of MTE. On the other side, it’s also clearly documented in the P0 blog that coprocessors can be leveraged to sidestep MTE. googleprojectzero.blogspot.c…
1
2
13
Another XPU/GPU exploit shows the kernel could be compromised even with 𝐌𝐓𝐄, by mapping a GPU address to any physical address. Attackers can overwrite kernel code/data & gain execution great blog by @benhawkes, loved rereading it one more time. googleprojectzero.blogspot.c…
MTE won't stop exploiting vulnerabilities/CVEs like MacDirtyCow or CVE-2022-46689. It’s a VM page-permission race (TOCTOU), not a spatial/temporal memory bug. project-zero.issues.chromium… github.com/zhuowei/MacDirtyC…
Meysam retweeted
DynaDbg v0.0.2 with the debugger implementation will be released soon(for macOS/iOS). Technical documentation: github.com/DoranekoSystems/D…
5
34
2
204
Meysam retweeted
The new Rowhammer attack paper against SK Hynix DDR5 modules is very impressive! LPE to root in over 100 seconds, or disclosing RSA keys for SSH from adjacent VM, among other vectors. If the SK Hynix brand doesn't ring a bell, some models of ADATA, G.SKILL, Corsair, Dell, Lenovo and even some Cisco OEM modules are based on Hynix chips. Finding exact list of affected OEM vendors and module modules is a bit tricky. As part of the research effort Google has also partnered with Antmicro to build dedicated Rowhammer testing rig, which is also open-source! github.com/antmicro/rowhamme… Paper: comsec.ethz.ch/research/dram… Google blog: security.googleblog.com/2025… PoC: github.com/comsec-group/phoe…
Today, we present with *Phoenix*: 🔥 two new Rowhammer patterns + ⏱️ self-correcting refresh sync + 🔨 PC bit flips on all tested SK Hynix DDR5 DIMMs. More information: comsec.ethz.ch/phoenix #Rowhammer #DDR5 #DRAM #HardwareSecurity #ETHZurich #COMSEC
MTE won't stop exploiting vulnerabilities/CVEs like MacDirtyCow or CVE-2022-46689. It’s a VM page-permission race (TOCTOU), not a spatial/temporal memory bug. project-zero.issues.chromium… github.com/zhuowei/MacDirtyC…
Another CVE/exploit that might have worked regardless of MTE :) → github.com/asahilina/agx-exp… it hijacks Apple GPU firmware → GPU gains full RAM R/W. MTE only guards CPU loads/stores, GPU DMA is outside of its scope.
2
17
1
127
Want to learn more about this bug? Check out Ian's epic #OBTS v6 talk on it: "Abusing iPhone Co-Processors for Privilege Escalation" objectivebythesea.org/v5/tal…
I’ve brought you a real iOS MTE bypass retrospectively: the overflow happens inside the co-processor (no MTE), then abuses trusted RPCs to gain kernel R/W — sidestepping MTE on the AP entirely. googleprojectzero.blogspot.c…
1
9
1
70