Watch This Space: A security research blog.
Joined August 2024
- Tweets 1,667
- Following 539
- Followers 602
- Likes 7,932
66 Photos and videos
Pinned Tweet
Feb 16
New blog post. This is a fun one: wts.dev/posts/chatgpt-atlas-…
thanks to @theo for connecting me with the OpenAI team, and thanks to @zemnmez for working with me on this (even though it wasn't patched)
13
1,422
May 30
50% of this tweet is not supported by the actual context I've seen. I hate misinformation.
May 29
🚨APPLE ADVERTISES $2 MILLION FOR FINDING SECURITY BUGS.. THEN CALLS YOUR DISCOVERY A "DUPLICATE".. PATCHES IT SILENTLY.. GIVES YOU NOTHING.. AND BANS YOUR APPLE ID IF YOU COMPLAIN..
Two researchers found a critical macOS vulnerability that let attackers steal passwords, encrypted chats, and Safari data through Archive Utility.. Submitted it October 2025..
Apple took 5 months.. Patched it with zero credit.. Zero CVE.. Zero bounty..
Their reason.. "You were not the first person to report this issue"..
That's the duplicate loophole.. Apple claims an internal engineer found it first.. But researchers can't verify that.. Apple controls the tracking system.. No audit.. No appeals..
The researcher said it felt like "doing charity work for a $3 trillion company"..
Another researcher found apps could access your entire photo library even after you turned off access in settings.. Apple's own page lists that at $50,000.. They reported it.. Apple went silent.. Patched it quietly.. Said it was a duplicate.. $0..
When the researcher blogged about it.. Apple permanently banned their 12-year-old Apple ID..
Apple's brand new Passwords app in iOS 18 was sending data over unencrypted HTTP.. A credential manager transmitting password reset links in plaintext.. Any attacker on the same WiFi could intercept them..
Researchers reported it.. Apple let it sit 3 months.. Patched it quietly.. Said it "didn't meet the impact criteria"..
Then there's the FaceTime disaster..
A 14-year-old discovered you could eavesdrop on anyone's iPhone.. Start a FaceTime call.. Add your own number before they answer.. Their microphone turns on.. If they hit the volume button.. Their camera activates too..
His mother spent a week trying to tell Apple.. Emails.. Faxes.. Social media.. Support told her to pay $99 for a developer account to file a bug report..
Apple did nothing until the exploit went viral and millions started eavesdropping on each other.. Then they panicked.. Took FaceTime offline globally.. Congress sent formal letters to Tim Cook demanding answers..
Then there's the researcher who got so fed up being ignored that they hacked Apple's own internal daily security call..
They'd reported a zero-click iMessage vulnerability.. Apple stonewalled them.. So they found another flaw.. Used it to infiltrate the internal FaceTime call where Apple engineers discuss bugs.. And dropped a screenshot proving the exploit live..
The team securing 2.35 billion devices couldn't secure their own meeting..
Apple's response.. A threatening legal letter..
Not a bounty.. A legal threat..
This is why the exploit black market thrives..
A zero-click iPhone exploit sells for $1.5 to $2.5 million on the gray market.. Guaranteed payment.. No bureaucracy.. No "duplicate" risk..
Submitting to Apple means NDAs.. 6-12 months of waiting.. Risk of $0.. Risk of your Apple ID being banned if you speak up..
Those gray market exploits end up with mercenary spyware vendors like NSO Group.. Deployed against journalists and human rights lawyers worldwide..
Apple pushes researchers toward the black market.. Then spends billions defending against the exploits those researchers could have sold them for a fraction of the price..
2.35 billion devices.. And the company would rather send lawyers than pay what they owe.
4
3
55
8,252
May 27
Apple finally published this. I found a bug in `awdd` that exposed `AWDMetadata.bin` and their response was to straight-up remove the daemon entirely. Very interesting!
3
3
48
4,351
May 26
This is why I think filesystem security needs more work put into it. macOS is far ahead of the game, but even it has its issues. Restrictions are a tricky thing, but maybe everything running on your machine shouldn't all put files where they can be accessed by every other thing.
May 26
Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks?
It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts.
This is what happened in the recent Nx Console supply-chain compromise, which led to GitHub’s internal source code being leaked.
2
1
9
2,613
May 19
krebsonsecurity.com/2026/05/…
A contractor made a public GitHub repo with the name `Private-CISA`. I find that detail a bit humorous, even though this definitely was/is a serious situation.
1
1
341
May 14
> We didn’t build the chain alone. Mythos Preview helped[...]
This is still memory corruption, and I might still be holding onto logic bugs as less reachable by AI. But I'm growing less and less sure.
Great work! Scary work, but great work!
Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.
Full story: open.substack.com/pub/calif/…
1
3
692
May 12
I genuinely hope this isn't prophetic.
2
283
May 8
As a security person, this caught my attention, and not exactly in a good way.
1
110
Watch This Space retweeted
Apr 30
"Copy Fail exploits a kernel logic flaw where corrupted page‑cache data is never marked dirty, leaving disk files unchanged while the in‑memory version is silently altered. Because the page cache is what processes read, an unprivileged user can corrupt a setuid binary’s cached page and gain root. The shared cache also lets the attack cross container boundaries. The bug, surfaced through AI‑assisted analysis of crypto‑subsystem behavior, is portable, tiny, race‑free, and stealthy, unlike Dirty Cow or Dirty Pipe. It works across major distros and architectures and forms the basis for both local privilege escalation and Kubernetes container escapes."
Thank you for the coverage @securityaffairs
#Copy #Fail: New #Linux bug enables #Root via page‑cache corruption
securityaffairs.com/191519/h…
#securityaffairs #hacking
@xint_official
1
3
11
2,513
Apr 30
This might be an unpopular take (and I haven't read too far into this), but I feel like focus of copy.fail being a "root LPE with no race" is the most uninteresting angle one can take on this vulnerability.
CrackArmor is already comparable on that front. /1
1
775
Apr 30
The page cache corruption vulnerability is vastly more interesting to me, and I wouldn't be surprised if more research finds additional ways to abuse it besides a simple root LPE. /end
133
Watch This Space retweeted
because macOS:
- has fewer native frameworks that are more difficult to build ugly software with (WinUI is pretty but no one uses it and the rest are hideous)
- handles frameless windows more gracefully (proper rounding/borders/shadows, allows real window controls to be placed where the app requests for them to be)
- has developers who actually give a fuck
7
5
263
5,303
Watch This Space retweeted
Apr 28
This is good!
55
28
1,589
95,183
Apr 28
Holy crap. This is... good? I'll have to take a look, but I'm actually extremely happy about this at first glance.
1
276
Watch This Space retweeted
Apr 20
Holy frick, that was sooner than I thought.
7
6
111
3,711
Apr 18
on mythos: it can't find bugs that don't exist. to claim it can hack *everything* implies everything has (severe) bugs. if that's true, that's terrifying.
1
4
255
Apr 18
(essentially) no software is bug-free. but how prevalent undiscovered severe bugs that could cause catastrophic damage are is an open question. mythos, and models like it, will probably answer that question.
101
MAD Bugs: Even "cat readme.txt" is not safe, by @calif_io
cat readme.txt and you're pwned baby
We'd like to acknowledge @OpenAI for partnering with us on this project.
open.substack.com/pub/calif/…
5
42
217
37,956
Spying on everybody's Discord attachments with HTTP desync
tmctmt.com/posts/http-desync…
46
197
2,502
579,647
Apr 15
Got an Apple Security Bounty reward earlier this month... and now paid most of it away in taxes.
8
405
Apr 15
youtube.com/watch?v=PPJ6NJkm…
Great coverage, @veritasium ! As a security researcher, I'm surprised at how transparent you were in explaining the exploit (while also, of course, not fully sharing the code). Often times, security concepts are oversimplified, but I think this wasn't.
2
2
292