Platform Security Summit

Conference on composable software supply chain integrity and hardware-assisted platform security, with OpenEmbedded, OpenXT and other ecosystems

[GrapheneOS @GrapheneOS]

@PatrickHK2019 Devices with GrapheneOS installed will only have GrapheneOS. We'll use the firmware and drivers they provide but those can potentially be changed specifically for GrapheneOS based on our requirements. It would be simpler if the changes were mostly or fully shared though.

[GrapheneOS @GrapheneOS]

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

[Calif @calif_io]

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).

If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.

We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand the root cause and exploitation path.

Please upgrade your macOS boxes to 26.6.1.

Full technical writeup drops tomorrow.

[Satoshi Tanda @standa_t]

I like understanding how low-level technologies work and how they are used for platform security. I also enjoy building, breaking, and teaching these kinds of things. Check out my training class on them if you are interested: https://t.co/iHOeJvRJoI

[Xeno Kovah @XenoKovah]

The TPM classes at OST2 are a great way to learn about the most widely available hardware-backed security mechanism for the low-low price of $0 from the comfort of your own emulator :)

[Ryan M @Grimdoomer]

New blog post on reverse engineering and modifying HDD firmware. In this part I cover obtaining, analyzing, and modifying firmware, using backdoor commands to hot patch code in RAM, and using JTAG to debug a live HDD https://t.co/9vVt26JHxO

[Alex Ionescu @aionescu]

This information class was added only a few years ago.

In the age of trillion dollar spending on AI code reviews and security, codeQL, KASAN and more, the world’s leading operating system kernel still added code to increment an arbitrary user controlled pointer in a system call

[Platform Security Summit @platformsec]

Gatekeepers decided what platform security capabilities shipped.. [now] joined by open-source, specialized firms and manufacturers with AI-augmented teams. Can future supply chains configure platforms for device fleets, threat models and regulations at the speed customers expect?

[Lucas Siwy @coffee221b]

Really great read for those in software. And for product managers, discipline is still key as pointed out in the comments.

[Donncha Ó Cearbhaill @DonnchaC]

Excited to see @Google launch Intrusion Logging, the first purpose-built system to enable forensic investigations of advanced attacks on mobile.

@AmnestyTech has worked with @Android as a design partner, during the development of Intrusion Logging and Advanced Protection Mode

[Alex Rad @defendtheworld]

It is hard to understate how much more hardened Apple's Application-Processor-side of WiFi is than any other operating system out there. Between MIE and the XZM allocator there's some serious hardening on the latest iOS and iPhone 17. We spend a lot of time in wifi land and Apple's the gold standard here.

The first big thing to know about Apple's WiFi on iOS is that they removed attack surface from the kernel and brought it into userland with DriverKit (https://t.co/qJrIKJQMRM). The concept was initially formed by Simon Douglas while he was at NeXT, Inc working for Steve Jobs and brought to Mac in 2019 by Douglas and team. Most memory corruption can't get far by design and it should be exceedingly difficult to see another Ian Beer type wifi exploit (https://t.co/d7X7A42p6F)

This use after free bug occured in `wifid`, a root userland process on iOS and can be triggered without any user interaction.

[Linux Plumbers Conference 2026 @linuxplumbers]

CFP for LPC 2026 is open!

Important dates:
Thursday, April 23, 2026: Deadline to submit proposals to host a microconference
Sunday, June 28, 2026: Deadline to submit LPC Refereed Track Presentations Proposals and Kernel Summit Presentations Proposals.
https://t.co/o2ULatesd9

[James Morris 👾 @xjamesmorris]

📢 🐧 The schedule for Linux Security Summit North America (LSS-NA) 2026 is published!

➡️ https://t.co/ahEICJ6R9R 👀

LSS-NA 2026 will be held May 21-22 in Minneapolis, MN, co-located w/ OSS.

✏ Register: https://t.co/i2rpZ6d9tu

#linuxsecuritysummit #linux #infosec

[Ryan Naraine @ryanaraine]

If AI finds the zero-day, writes the exploit, and patches the code, who trains the next generation of security researchers? Chris St. Myers' "Cognitive Rust Belt" essay kicked off a debate we couldn't stop having.

Apple Podcasts
https://t.co/caiDEI1fpt

[Xeno Kovah @XenoKovah]

@ryanaraine I do. https://t.co/OWvx9J6tag, https://t.co/SW1s7VGtDa

[Ryan Naraine @ryanaraine]

This stirred a lot of thinking and emotion. I'd read it closely 👇🏽

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

Two weeks after the DarkSword iOS hacking tool was revealed, Apple is taking the rare step of pushing a security fix to older iOS 18 iPhones rather than just telling users to update to iOS 26, as it had previously done. (Which left millions vulnerable.) https://t.co/TiF6vusi4m

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[Mark Ermolov @_markel___]

This is made possible by executing arbitrary microcode on the DFX-locked system. And although this was a truly challenging task, we were able to do it after researching in details the interaction between PMC and PUNIT

[nedwill @NedWilliamson]

The marginal effects here mean we are getting some amazing data about the types of bugs that were most exposed to AI, and once these waves of fixes go in and if things taper we’ll see the ongoing bug stream as a frontier capability signal.

[MG @_MG_]

The “foreign routers ban” is being enforced at the FCC certification stage. If you don’t know what that means, here’s a quick explainer:

Once you (the manufacturer) have FINALIZED your new hardware design, you produce a few units and send them off to a specialized lab to test the radio emissions from your device. If everything goes perfectly (no test failures), 2-3 months later you will have a FCC certification. Then you have to apply the FCC label to your product.

Without the completed FCC cert, you cannot legally market, import, or sell in the USA. So, mass production typically doesn’t start until after the cert happens, unless you are very confident that you will one-shot the lab tests without any hardware revisions. Else, you’d be stuck with tons of hardware you can’t sell.

This FCC change will be especially painful to anyone who was about to get their new device certified. The requirement to have an on-shoring plan is probably going to be the most significant hurdle for manufacturers.

If this ban included all current routers (it doesn’t), it would have been way more painful. Not just from the consumer side with supply impact. But imagine every existing router having to go through a 3+ month process with labs that would be instantly booked with backlog for years. Sure, some sort of leaned down re-cert process would have been more probable, but you get the point.