Ivn 🖤🖤🖤 (@ivMobAppSec) header
Ivn 🖤🖤🖤 (@ivMobAppSec) profile picture

GenAI Sec, Evals, AI containment, Mobile AppSec, Android & iOS RE & Crypto(graphy). opinions = own

/usr/local/bin
Joined May 2010
Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)Photo by Ivn 🖤🖤🖤 (@ivMobAppSec)
Ivn 🖤🖤🖤 retweeted
Once again, a hack starting with social engineering (interview / recruitment pretext) to convince a target to download malicious tools or steal credentials is used to kick off a major attack chain. This time 6+ billion (yep with a B) was stolen.
1
28
2
99
4,821
Did claude reset weekly usage at 5pm EST?
1
528
Ivn 🖤🖤🖤 retweeted
Also, if you're ready to put your Apple hacking skills to the test, join the #OBTS CTF on Nov. 19! 👩🏼‍💻🍎 Challenges for all skill levels, prizes up for grabs, and a fun chance to connect with fellow hackers! Spots are limited, so register now: forms.gle/65xQp5jqNWhv1UrL6
3
7
946
Ivn 🖤🖤🖤 retweeted
One new thing. When you signup for the next SPTM, TXM, SK and Exclaves training in March 2027 you immediately get access to our GLx Research Platform the day you sign up. antid0te.sg/glx-research-pla… antid0te.sg/training/sptm-tx…
2
5
83
8,318
Ivn 🖤🖤🖤 retweeted
Frida 17.25.0 is out, and it's a big one. Our out-of-process mapper, born on Darwin, is now cross-platform: agents are mapped straight into the target on Windows and Linux too, without a file on disk or a dlopen() in the target. Plus Efni, Idun, MTE on Darwin, and lots of fixes.
2
18
1
87
5,616
Ivn 🖤🖤🖤 retweeted
Hello!
8
36
3
1,117
102,919
Ivn 🖤🖤🖤 retweeted
We’re hiring in Basel, Switzerland. We are a fast paced AI Boutique building AI products with AI coding tools for enterprise use. A human will read your CV, we’re quite small so try your luck. No problem if you need to relocate, we want the best talent Roles: - Head of Engineering - Al Software Engineer - Data Engineer See them all at ekona.ai/careers#open-positi…
51
30
3
573
49,292
Ivn 🖤🖤🖤 retweeted
Zero-click attack on Telegram offensivecon.jp/speakers/202…
4
38
2
213
20,008
Ivn 🖤🖤🖤 retweeted
We're hiring a Senior SDK Engineer at @RevenueCat! We're looking for an experienced mobile engineer who's passionate about building great developer tools and SDKs. You'll help design, build, and ship features across our open-source iOS and Android SDKs, improve the developer experience, and shape the future of mobile monetization. If you love Kotlin, Swift, Jetpack Compose, or SwiftUI, enjoy solving challenging problems at scale, and want your work to impact thousands of apps and millions of users, we'd love to hear from you! 👉 Apply here: jobs.ashbyhq.com/revenuecat/…
9
23
174
14,661
Ivn 🖤🖤🖤 retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer. projectzero.google/2026/10/f…
13
109
7
445
41,926
Ivn 🖤🖤🖤 retweeted
Phreaking an iPhone
You can point an ultrasonic speaker at an iPhone from a few feet away, play an audio command that no human ear can hear, and the phone will wake up, open Safari, and dial a phone number. To everyone standing in the room, it sounds like dead silence. To the phone, it sounds like someone speaking directly into the microphone. Mobile operating systems use digital low-pass filters to delete all sound above 20,000 Hz, assuming inaudible frequencies can never reach the voice assistant. Yet this attack succeeds without exploiting a single line of software code. The flaw is not in the operating system. It is in the microscopic silicon plate inside the microphone itself. 1. The microscopic machine inside your microphone Inside modern smartphones, microphones are not miniature versions of studio microphones. They are micro-electro-mechanical systems (MEMS) chips smaller than a grain of rice. Inside the chip package sits a flexible silicon diaphragm suspended barely two micrometers above a rigid metal backplate. The two plates form a variable capacitor. When sound waves hit the silicon diaphragm, it flexes inward and outward, changing the electrical capacitance. An onboard preamplifier converts that movement into an electrical voltage. At normal room volumes, the silicon plate moves evenly: double the sound pressure, and the plate flexes twice as far. 2. The non-linear spring catch The flaw appears when sound waves hit the microphone at high pressure (above 90 dB SPL). If you broadcast an ultrasound carrier wave (say, 28,000 Hz) that has an audio command modulated on top of it, the microphone front-end cannot move symmetrically. The mechanical spring resistance of the silicon, the electrical pull between the plates, and the preamplifier circuit all reach their limits. Instead of flexing smoothly, the silicon plate bends slightly more inward than outward. This asymmetry acts like an old crystal radio receiver. Mathematically, a non-linear response squares the incoming wave. That squaring action strips the silent 28,000 Hz carrier away and leaves behind the original human voice command in the audible 300 Hz to 3,500 Hz range. By the time the analog-to-digital converter reads the signal, the ultrasound is already gone. It has physically transformed into ordinary low-frequency sound inside the microphone chamber. The phone digital filter never triggers because the audio reaching the software is already normal human voice. 3. What researchers actually proved (DolphinAttack) In 2017, researchers at Zhejiang University published DolphinAttack, demonstrating this hardware flaw across Siri, Google Now, and Alexa. They successfully forced phones to initiate FaceTime calls, navigate to malicious websites, turn on airplane mode, and unlock smart doors paired to the device. Later research expanded this into attacking through solid tables, using the furniture itself as a physical acoustic conductor. 4. Why this fails in the wild (The physical friction) Demonstrating this in an acoustic laboratory is straightforward. Pulling it off in a crowded coffee shop runs into strict physical limits: First, air absorbs high-frequency sound rapidly. Bass travels through concrete walls, but 30,000 Hz ultrasound loses roughly 1 to 1.5 decibels of power per meter in normal room air. In the original DolphinAttack paper, the effective range was limited between a few centimeters and 1.75 meters. Reaching across an entire room requires a heavy array of high-voltage transducers. Second, ultrasonic emitters act like laser pointers. High-frequency sound travels in narrow beams of 15 to 20 degrees. If you fail to aim directly at the phone one-millimeter microphone port, sound pressure drops below the 90 dB threshold needed to bend the plate. Third, modern phones are waterproof. Devices with IP68 ratings place a hydrophobic Gore-Tex mesh over the microphone hole. The mesh lets air equalize while stopping water, but it acts like a dense acoustic muffler against ultrasonic frequencies, absorbing another 14 dB of signal strength. Finally, voice assistants use personal voice training. If Siri or Google Assistant is set to only respond to the device owner, a generic synthesized ultrasonic command is ignored unless the attacker models the owner vocal pitch. 5. How modern hardware catches it Defending against inaudible voice injection requires catching the acoustic mismatch before speech recognition executes: * Multi-microphone cross-checks: Modern smartphones carry three or four microphones positioned on the bottom, top, and camera bump. When a real human speaks, their voice reaches all microphones with natural arrival delays. A narrow ultrasonic beam hitting one microphone port creates an unnatural phase imbalance across the device. * Harmonic distortion analysis: When a microphone is driven into non-linear demodulation, it does not produce a clean voice recording. It leaves distinct distortion products and second-order harmonics. Software filters can analyze the spectrum and mute the assistant if they detect the signature of mechanical demodulation. * Acoustic damping barriers: Microphone manufacturers can install physical acoustic damping layers inside the chip housing that attenuate frequencies above 22,000 Hz before the sound wave ever reaches the silicon diaphragm. Inaudible voice injection works because digital security models assume analog sensors behave linearly. When sound waves push silicon past its linear limits, the hardware itself executes operations the operating system never authorized.
23
159
7
2,242
116,726
Ivn 🖤🖤🖤 retweeted
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO. Read more: anthropic.com/news/s1-sec Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
1,356
2,379
2,440
18,279
9,564,185
Ivn 🖤🖤🖤 retweeted
Update: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root nitter.gq/dguido/status/21131291…
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation. eliastaylor.com/noexploit/
39
105
20
678
109,815
Ivn 🖤🖤🖤 retweeted
Just in case it wasn’t clear: we popped the iPhone Duo on release day, adding a much needed feature, inspired by the php2shell hacker @lcfr_hax! What else there to hack? Wrong answers only.
79
85
10
1,031
116,478
Ivn 🖤🖤🖤 retweeted
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
65
568
94
3,097
472,546
Ivn 🖤🖤🖤 retweeted
Thread 🧵 1/ NEW REPORT: Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how the same data fueling this advertising ecosystem is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.” Read the report: citizenlab.ca/research/how-d…
19
356
42
556
82,427