About
I'm Mikey Strauss. I started out as a security researcher, and that is still the way I look at things, but most of my career has been spent building.
The part of the work I love most is the very beginning: a problem nobody has quite defined yet, the research to understand it, the design, and the slow push to something that runs in production. So I've often been the first engineer, or one of the first, on a team. I tend to take a very technical view of anything and everything.
That path has gone through embedded security and firmware, Wi-Fi drivers at Intel, secure boot and hardware on custom boards, a software supply-chain platform at Scribe, and now Runzee at Oats Solutions, an eBPF-based platform for watching what Android apps really do on a real device. The building and the research feed each other. I make tools to answer hard questions, and then use them to find real bugs.
The write-ups here come from that. They cover vulnerabilities in shipping software: some accepted as novel through Google's VRP, including a Project Oak attestation bypass and a heap out-of-bounds read in Google Wallet's JPEG2000 path, others triaged as duplicates or outside program scope. Every finding here was reported to the affected vendor or maintainers before it was published. Recent ones are joint work with my colleagues Dani Levenfeld and Tal Dim.
I'm a maker at heart, with a soft spot for building clever things that serve no purpose at all. The useful exception is Go Baby Go, where I help adapt ride-on cars for kids with disabilities.
Focus areas
- Android internals
- Mobile wallets & payments
- Reverse engineering
- eBPF & runtime instrumentation
- Firmware / UEFI
- Software supply chain
- Embedded security
Work
- 2025 – nowOats Solutions, founding engineer and principal security researcher
Architected and built Runzee, an eBPF-based dynamic analysis platform for Android that observes real app behavior on-device, without source code or repackaging.
- 2021 – 2025Scribe Security, first hire, team lead and principal engineer
Created Valint, the policy engine and CLI for software supply-chain evidence: SBOMs, signing and verification with Sigstore, in-toto attestations and policy-as-code.
- 2020 – 2021Resilience Cyber Security, senior lead developer (freelance)
Took a product from zero to one: research, design and development on The Update Framework, in-toto and Sigstore.
- 2018 – 2020Kazuar Advanced Technologies, fourth hire and technical lead
Embedded security research and design: Linux internals, drivers, firmware and boot, SoC, FPGA and TPM on custom boards. Co-inventor on a patent application (US 18/575,144).
- 2017 – 2018Sitaro, security researcher and developer
Bootstrap team: IoT vulnerability research with full exploitation demos, and the core product in C and C++.
- 2016 – 2017Intel, Wi-Fi core development engineer
Large-scale C/C++ on Intel's Wi-Fi core software.
- 2011 – 2016Matzov
Vulnerability and security research.
Selected writing
All posts →
If You Wanted to Watch a Country
We pulled MAX apart and read the code: the surveillance machine you could build on top of it, and how little of it we had to make up.
Your DMV Can Trigger an Out-of-Bounds Read Inside Google Wallet
One ordinary photo from your driver’s-license issuer, and Google Wallet reads past its buffer.
A Zero-Day in Google’s Confidential Computing: Your Phone Can Be Fooled Into Trusting a Fake Enclave
A forged proof passes Google’s enclave attestation: the check binding it to the real program is silently skipped.
A one-tap token drain in Unstoppable Wallet, and the $20 bug bounty it earned
One blind tap empties a token in this crypto wallet: confirmed by its own makers, since fixed, and settled with a $20 bug-bounty payout.
Talks & community
- 2026The Weak Supply Chain We All Depend On: a UEFI firmware use case. Zealot Labs, August 2026.
- 2025Go Baby Go: adapting ride-on cars for children with disabilities
Open source
GitHub →- 2026uefi-supply-chain: a firmware supply-chain verification gate for OVMF/edk2. Generate, attest, then gate on policy, shown with cosign + OPA and with Valint.
- 2025go-baby-go-remote and go-baby-go-core: accessible remote controls and a core build kit for adapted ride-on cars.
Contact
Email [email protected]. Happy to talk about Android, wallet or firmware research, disclosure coordination, or roles. Disclosure contact is also published in security.txt.