Vishwas Reddy

Security Engineer

[John Wu @topjohnwu]

Oh, and the next-gen Magisk app has been brewing for a while......

[Vix @VixWizzer]

This book is all what I needed

[LiveOverflow 🔴 @LiveOverflow]

This vlog of Black Hat and DEF CON took way too much time to edit...

https://t.co/v5g98dT167

[🇷🇴 cristi @CristiVlad25]

HTTP Protocol Internals and Offensive Semantics

(11 sections, 98 lessons, ~294min)

The course is up. And it's free.
A few pointers👇for optimal experience.

https://t.co/JsmnKuuNLJ

[Tukaram Mundhe @Tukaram_IndIAS]

When a label lies, the consumer pays the price.

An expiry date is not just ink on a package.A nutrition label is not just information.They are promises made to the consumer.

When those promises are deliberately manipulated, it is not merely a violation of regulations, it is a breach of public trust.

Effective regulation is not about creating fear in the industry. It is about creating an ecosystem where honest businesses are protected, violations are detected, and citizens are not deceived

#TukaramMundhe #FoodSafety #Leadership #Inspairation #FDA #GenZ

https://t.co/fb7eSZZpPC

[John Wu @topjohnwu]

Update: You can now run Gemini 3.8 Flash in Antigravity CLI (agy) with your Gemini API key via agy-gyro v0.1.2!

agy uses a static model registry when configured to use Gemini API keys, meaning new model releases were blocked until a new CLI update drops. Version 0.1.2 introduces model redirection, letting you route requests to newly released models like gemini-3.8-flash immediately!

[GrapheneOS @GrapheneOS]

https://t.co/X0imidSWau

This article has a poor assessment of the value of MTE and the importance of protecting against memory corruption vulnerabilities. These attacks are not theoretical and are definitely not only highly targeted as is often portrayed. Exploits are being widely deployed and neither Apple or Google are reliable sources on how widely they're being used. Their consistently misleading claims on the prevalence of exploitation are based on twisting incredibly incomplete information to paint their products in the best possible light.

A developer without extensive expertise can develop working local and even remote for stock Pixels in weeks with the help of a frontier AI model. Pixel 11 cannot be considered AI ready devices when they're built for a world without the massive impact of AI models on security on the present. It's clearly going to improve over the next 7 years and the Pixel 11 is incredibly ill-prepared for it. Google isn't much of an AI company if they aren't going to build products capable of providing reasonable protection from AI accelerated exploits.

MTE isn't only for probabilistic protection. It provides deterministic protections. We dynamically exclude the adjacent tags for a slot and the previous tag used for the slot. We statically exclude 0 as a reserved tag for free data, metadata, etc. That's 100% reliable, not 15/16.

FEAT_MTE4 (EMTE) which was shipped by the iPhone 17 as part of their initial MTE support adds support for enforcing memory tags for untagged memory (FEAT_MTE_CANONICAL_TAGS). For userspace, it means untagged memory is treated as being tagged with the typically reserved 0 tag.

For Android and iOS, nearly all remote exploits involve memory corruption. MTE with FEAT_MTE4 and protection against side channels as the iPhone 17 has provided is the best available defense with a low cost. Pixels had MTE available long before iPhones and could have advanced it.

HWASan provides similar security to MTE for code compiled with it at the cost of around 100% CPU overhead and 25% memory overhead. Unlike MTE, it can't protect code not compiled with it. It does have the advantage of MTE not yet coming in an 8 bit form.

https://t.co/ADUu3lSpUm

Snapdragon 8 Elite Gen 5 has MTE, ~40% faster singlethreaded and ~80% faster multithreaded performance. Comparing HWASan on Tensor G6 to MTE on Snapdragon 8 Elite Gen 5 with negligible overhead would be fun. One way of looking at the Pixel 11 dropping MTE is that it's adding around 100% overhead for reasonably secure software. That's quite a performance loss for hardware which was already not providing competitive performance.

Pixel 11 adding post-quantum secure verified boot is not currently useful and likely won't be useful before the end-of-life of the Pixel 11. It isn't the same as key exchange where data can be captured now and decrypted later. Android's standard disk encryption has always been post-quantume secure. Adding this for verified boot is a forward looking improvement but it doesn't make up for losing MTE.

Titan M3 may have improved security in other ways but it's hard for them to show that without finally following through on their commitment to open sourcing the firmware and hardware for it. Titan M based on OpenTitan is not the same as them open sourcing it.

Google could add back Pixel support to AOSP in a day and could quickly follow through on their commitment to open sourcing the Titan M. Their commitment was not moving to it being based on OpenTitan but rather open sourcing the firmware for the Titan M1 and both firmware+hardware for the Titan M2. They committed to 7 years of updates for the Pixel 9a and that includes AOSP updates since it was sold as an AOSP reference device. They cannot retroactively restore MTE support on the Pixel 11, but they can address these things and come out looking much better than they currently do.

Google made a huge mistake with the removal of MTE instead of improving it to match or exceed the iPhone 17. Pixel 11 is incredibly ill-prepared for the age of AI models changing the security landscape. It's a huge downgrade for overall security from the Pixel 10 and it cannot be fixed until the Pixel 12. Google hopefully has time to get MTE added back for the Pixel 12. They're doing an increasingly poor job shipping the rapidly growing number of security patches and need far better systemic security protections simply to defend well against the already known vulnerabilities let alone the unknown ones. They should stop laying off so many engineers and should start taking the impact of AI on security seriously considering how much they brand themselves as an AI company.

[Kiren Rijiju @KirenRijiju]

We never mocked when other people & nations suffered due to devastating earthquake, deadly floods & catastrophic natural disasters.
Be Human, Respect Others, Love All

[Tim Cook @tim_cook]

Sending lots of love to the Apple community on my last day as CEO. My title changes tomorrow, but the love I have for the Apple community never will. Thank you for being a constant source of inspiration. My gratitude is endless, and I’m excited for the next chapter!

[GrapheneOS @GrapheneOS]

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

[spencer @techspence]

I love it when everyone says Entra is MORE secure than Active Directory. All I need to do is point to this. Yeah now what...

https://t.co/KqyRq3FsvJ

[etn. @etnshow]

JUST IN: South Korea plans to give its entire population free access to generative AI services, the first major state-led offering treating the technology akin to a public utility, per WSJ.

[FBI Director Kash Patel @FBIDirectorKash]

This FBI has brought back two high-value targets from Nigeria to the United States to face justice for alleged sextortion crimes targeting minors.

🔺 Adebola Festus Adekunle and Mudasiru Afeez Olawale were arrested in Nigeria in 2023 and are now on U.S. soil.

🔺 The charges include sexual exploitation of minors, coercion and enticement, extortion, distribution and production of child sexual abuse material, and other offenses.

🔺 One of these alleged schemes resulted in the death of a child.

They were overseas for three years. Now they’re back on U.S. soil to answer for the charges against them.

-DKP🇺🇸

[John Wu @topjohnwu]

Introducing agy-gyro!

Antigravity CLI recently enabled Gemini API key support, however the experience using it is less than ideal: if you hit a rate limit (429) or a temporary server overload (503) error, AGY CLI does not implement any internal retry mechanism and will abruptly terminate session execution.

To workaround this issue, I vibe coded a local proxy server that transparently catches those errors and retries requests with exponential backoff, following official guidelines.

Hopefully this would be useful for those that prefer Google's official Antigravity harness when using Gemini models over pay-as-you-go API keys!

https://t.co/vt5Oz2lqgZ

[LiveOverflow 🔴 @LiveOverflow]

2-3h for the v8 exploit to work.
But I am 4-5 days into trying to understand how it works lol.

Future security jobs: just understanding what the AI did

[Greg Brockman @gdb]

An open letter for a global surge in cyber defense, signed by over 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle. https://t.co/uKXPS8LdAU

[Sam Altman @sama]

this is a critically important moment for cyber defense with AI; there is not much time to act.

we are happy if you want to work with us or any of our competitors or partners, but please take this moment seriously.

only an urgent and intense collective response will work.

[vxdb @vxdb]

TeamPCP actually got cooked bro

[nopnop @__nopnop]

Just published the writeup for my RCE in Google Cloud Application Integration, found last year - before this whole AI vulnpocalypse.
https://t.co/lDVlPDrvRc

[Tim Cook @tim_cook]

The new Mac mini is here. Small in size. Big on performance. From everyday productivity to all things AI, it can help you do it all.