Tim Willis

Long time listener, infrequent tweeter. Head of Exploitation and Offensive Research at Google. Views are my own.

[Samuel Groß @5aelo]

Some personal news: I'm thrilled to be moving back to Project Zero! Specifically I'll be joining the Big Sleep project to find vulnerabilities in JavaScript engines. We've already found and reported our first vulnerability in V8 last week: https://t.co/QQEgvIGgHp

[Ivan Fratric 💙💛 @ifsecure]

If you've been keeping track on the Big Sleep bug tracker at https://t.co/TeYPpUANyW you might have noticed it lists more bugs now compared to last week. Including a "High impact issue in V8" :)

[Tim Willis @itswillis]

That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)

https://t.co/Atc6toEdAj

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

Today @Google Project Zero announced a new trial policy: Reporting Transparency. We’ll now share when we report a security vuln to a vendor within 1 week including products + deadlines. Goal: shrink the patch gap + drive faster, safer updates for users: https://t.co/BHW2NnCb6I

[Tim Willis @itswillis]

Great to see this live!

Let's see how the trial pans out 🍿👀

[Natalie Silvanovich @natashenka]

While most vendors ship timely patches for vulnerabilities reported by Project Zero, they don’t always reach users. Today, we’re announcing Reporting Transparency, a new policy to encourage downstream fixes

https://t.co/ktussY1I65

[Tim Willis @itswillis]

Part 7 (!) of @j00ru's Windows Registry adventure is now live:
https://t.co/tD7yv0P8GY

"I will describe the various areas that are important in the context of low-level security research... all possible entry points to attack the registry... and the primitives they generate"🙌

[Tim Willis @itswillis]

For those that won't be in Germany next weekend to see @dillon_franke live, this is the next best thing!

(post also includes Dillon's fuzzing harness and tools Dillon built along the way) 🎉

[Dillon Franke @dillon_franke]

Thrilled to announce my new Project Zero blog post is LIVE! 🎉 I detail my knowledge-driven fuzzing process to find sandbox escape vulnerabilities in CoreAudio on MacOS.

I'll talk about this and the exploitation process next week @offensive_con!

https://t.co/9Oj2AaxbRk

[Tim Willis @itswillis]

...and now, introducing Part 6 of @j00ru's work on the Windows Registry:

https://t.co/tryr9HyL0V

📖👀

[Tim Willis @itswillis]

Part 5 of @j00ru's Windows Registry Adventure is out!

https://t.co/gMRLzReeC9

Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️

[Tim Willis @itswillis]

@i41nbeer's dive into BLASTPASS, over a year in the making:
https://t.co/c6lUVnz2kn

"This is the second in-the-wild NSO exploit which relied on simply renaming a file extension to access a parser in an unexpected context which shouldn't have been allowed."

[Ian Beer @i41nbeer]

My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp -
https://t.co/H4m8MBwoWN

[Tim Willis @itswillis]

Two new posts from @tiraniddo today:

https://t.co/StB2knG8FO on reviving a memory trapping primitive from his 2021 post.

https://t.co/sbKodaJMe9 where he shares a bug class and demonstrates how you can get a COM object trapped in a more privileged process.

Happy Reading! 📚

[Tim Willis @itswillis]

@B_Shamshirsaz base salary is listed on the job ad 👍

[Tim Willis @itswillis]

It doesn't happen very often, but Project Zero is hiring!

https://t.co/bA3FT6ZbzH

Please share with anyone you think would be awesome for the role 🎉

Looking for at least one person. DMs open if you want to reach out about the role.

The team: https://t.co/YBitHNpEWr

[Tim Willis @itswillis]

@B_Shamshirsaz ideally looking for that rare human that can do 0day vuln research on top-shelf products, perhaps some exploit dev as well... mixed with someone who can stay humble and share knowledge to help vuln reserach/software devs/colleagues.

I lead a team of them - looking for 1 more!🦄

[Tim Willis @itswillis]

@jackfromeast @sajjadium Unfortunately not for 2025 (northern hemisphere summer) at this stage - I'll shout out if that changes

[Tim Willis @itswillis]

Part 5 of @j00ru's Windows Registry Adventure is out!

https://t.co/gMRLzReeC9

Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️

[Dillon Franke @dillon_franke]

Great to see Apple quickly patch the MacOS sandbox escape/privilege escalation vulnerability I reported to them. Big thanks to @NedWilliamson, @i41nbeer, and @i41nbeer for all the help :) I'm working on a blog post and hope to release it soon!!

[Seth Jenkins @__sethJenkins]

My blog post is now live alongside @amnesty 's joint release, providing remarkable insight into an ITW exploitation campaign!
https://t.co/O3niXxtT6O

Turns out that you can find out quite a bit with just some kernel stacktraces ;)

From Amnesty:
https://t.co/4CeJynhwZ6

[Tim Willis @itswillis]

If you've ever wondered if one can determine a vuln from just the kernel panic logs, @__sethJenkins (feat. @tehjh & @benoitsevens) have something to share: https://t.co/6ovPlKKI46

Great to collaborate with @amnesty, find vulns and get them fixed: https://t.co/ar40S54mh1

[Tim Willis @itswillis]

Finding 0day is not the most impactful thing that Project Zero does 😲 — it's sharing knowledge 🧠. One part of that sharing is our tooling work to help other devs and reserachers.

Today's installment, @tiraniddo's updated https://t.co/nLl1d6hr37👍

Blog: https://t.co/pD0bF2Ax7P

[Tim Willis @itswillis]

@ifsecure's latest blog + tooling on Apple kernel extension fuzzing (including with shoutouts to other projects in this space). Sharing is caring ❤️

[Ivan Fratric 💙💛 @ifsecure]

The blog post (+tooling) on my Apple kernel extension fuzzing technique that I used to find several AppleAVD AV1 decoder bugs is now public at https://t.co/vjbmlmBZ7U