Android, mobile and supply-chain security research.https://mikeystrauss.com/https://mikeystrauss.com/posts/max/https://mikeystrauss.com/posts/max/In 2025 Russia built itself a national messenger. It's called MAX, VK makes it, it ships preinstalled on phones sold in the country, and it's becoming how people chat, pay, and deal with the government.Sun, 08 Nov 2026 00:00:00 GMThttps://mikeystrauss.com/posts/a-one-tap-token-drain-in-unstoppable-wallet-and-the-20-bug-bounty-it-earned/https://mikeystrauss.com/posts/a-one-tap-token-drain-in-unstoppable-wallet-and-the-20-bug-bounty-it-earned/One tap on a real, shipping crypto wallet lets a stranger take the entire balance of one of your tokens. The wallet’s own makers confirmed the bug and said they’d remove it, then paid a twenty-dollar reward.Wed, 14 Oct 2026 13:09:49 GMThttps://mikeystrauss.com/posts/a-zero-day-in-androids-wi-fi-direct-any-app-can-steal-your-password-zero-permissions/https://mikeystrauss.com/posts/a-zero-day-in-androids-wi-fi-direct-any-app-can-steal-your-password-zero-permissions/Android’s Wi-Fi Direct service has a permission check any app can skip by setting one boolean flag on its own request. No permission, no prompt, and the framework hands back the live WPA2 password.Tue, 06 Oct 2026 14:31:45 GMThttps://mikeystrauss.com/posts/a-zero-day-screen-hijack-in-androids-tap-to-pay-the-grant-that-never-expires/https://mikeystrauss.com/posts/a-zero-day-screen-hijack-in-androids-tap-to-pay-the-grant-that-never-expires/We found this reading AOSP’s NFC stack source, then proved it end-to-end with a live PoC on a real device, validated against a true negative control so we weren’t just watching a test-harness artifact.Mon, 28 Sep 2026 12:49:45 GMThttps://mikeystrauss.com/posts/part-2-risks-and-vulnerabilities-in-hardware-systems/https://mikeystrauss.com/posts/part-2-risks-and-vulnerabilities-in-hardware-systems/Nine confirmed kernel-driver bugs on a current flagship phone, from a plug-in USB-C cable to component-level tampering, across six independent chip vendors.Mon, 14 Sep 2026 13:51:35 GMThttps://mikeystrauss.com/posts/a-zero-day-that-lets-any-app-rewrite-what-your-screen-reader-says/https://mikeystrauss.com/posts/a-zero-day-that-lets-any-app-rewrite-what-your-screen-reader-says/Android’s accessibility system exposes a Binder call that lets any app change the title and language another app’s window reports, including System UI’s own window. That is exactly what a screen reader like TalkBack announces to a blind or low-vision user.Mon, 07 Sep 2026 13:22:25 GMThttps://mikeystrauss.com/posts/your-dmv-can-trigger-an-out-of-bounds-read-inside-google-wallet/https://mikeystrauss.com/posts/your-dmv-can-trigger-an-out-of-bounds-read-inside-google-wallet/Google Wallet renders your driver’s-license portrait with a bundled JPEG2000 decoder whose compositing loop assumes every color plane is the size of the whole image. A real heap out-of-bounds read, confirmed against Google’s actual binary.Tue, 01 Sep 2026 13:54:53 GMThttps://mikeystrauss.com/posts/a-zero-day-in-androids-on-device-ai-any-app-can-open-a-door-to-gemini-nano/https://mikeystrauss.com/posts/a-zero-day-in-androids-on-device-ai-any-app-can-open-a-door-to-gemini-nano/Gemini Nano runs inside AICore behind a door meant only for Google’s own apps, but any app can declare one ordinary-looking permission that Android grants automatically at install. A brand-new, unsigned test app used it to get a live connection to the real service.Tue, 25 Aug 2026 13:55:40 GMThttps://mikeystrauss.com/posts/a-zero-day-in-googles-confidential-computing-your-phone-can-be-fooled-into-trusting-a-fake-enclave/https://mikeystrauss.com/posts/a-zero-day-in-googles-confidential-computing-your-phone-can-be-fooled-into-trusting-a-fake-enclave/A coding bug in Google’s Project Oak attestation verifier silently skips the check that binds the evidence to the real program, so a forged proof is accepted. We ran the real, unfixed code, handed it forged evidence, and it accepted it.Tue, 18 Aug 2026 14:03:33 GMThttps://mikeystrauss.com/posts/making-firmware-verifiable-not-just-signed/https://mikeystrauss.com/posts/making-firmware-verifiable-not-just-signed/Firmware is the first code that runs and the root of trust everything above it inherits. It is also the supply chain we can vouch for the least: why signatures and SBOM membership checks miss a same-GUID module swap, and how a build-time SBOM plus byte-level reconcile catches it.Mon, 10 Aug 2026 15:30:05 GMThttps://mikeystrauss.com/posts/inclusive-hacking-ride-on-cars-to-empower-children-with-disabilities/https://mikeystrauss.com/posts/inclusive-hacking-ride-on-cars-to-empower-children-with-disabilities/GoBabyGo IL investigates full-control wireless adaptations for ride-on cars, so children with disabilities can drive with whatever movement they have.Mon, 29 Sep 2025 14:44:21 GMThttps://mikeystrauss.com/posts/proactive-pipeline-security-applying-the-owasp-top-10-ci-cd-risks-with-scribe/https://mikeystrauss.com/posts/proactive-pipeline-security-applying-the-owasp-top-10-ci-cd-risks-with-scribe/How Scribe maps the OWASP Top 10 CI/CD Security Risks into a policy-as-code initiative, backed by signed evidence, that verifies your pipeline’s security posture on every build.Tue, 09 Sep 2025 08:48:43 GMThttps://mikeystrauss.com/posts/slsa-compliance-at-scale-provenance-generation-with-scribe/https://mikeystrauss.com/posts/slsa-compliance-at-scale-provenance-generation-with-scribe/Scribe’s Platforms CLI harvests existing CI logs, detects every image build, and emits in-toto SLSA provenance (unsigned for Level 1, signed for Level 2) from a single command, without changing your pipelines.Tue, 05 Aug 2025 17:55:02 GMThttps://mikeystrauss.com/posts/achieving-sp-800-190-continuous-container-compliance-with-scribe-security/https://mikeystrauss.com/posts/achieving-sp-800-190-continuous-container-compliance-with-scribe-security/The NIST SP 800-190 standard provides structured guidelines to secure containerized applications. This hands-on guide shows how to enforce them as signed, policy-as-code checks on every pull request and release.Mon, 30 Jun 2025 18:58:44 GMThttps://mikeystrauss.com/posts/adapting-cars-for-children-with-disabilities-the-gobabygo-core-build-kit/https://mikeystrauss.com/posts/adapting-cars-for-children-with-disabilities-the-gobabygo-core-build-kit/Introducing the GoBabyGo IL Core Build Kit: a streamlined, open-source toolkit for adapting electric ride-on cars for children with disabilities, covering push-button controls, seating and flexible mounts.Tue, 21 Jan 2025 19:57:32 GMThttps://mikeystrauss.com/posts/from-chaos-to-clarity-navigating-policy-engine-for-compliance/https://mikeystrauss.com/posts/from-chaos-to-clarity-navigating-policy-engine-for-compliance/Welcome back to the second part of our blog series, where we delve deeper into the potent capabilities of Valint. In this article, we’ll focus on Valint’s policy engine and its pivotal role in assuring compliance throughout your supply chain.Thu, 04 Apr 2024 16:57:18 GMThttps://mikeystrauss.com/posts/navigating-the-cve-maze-reflections-on-challenges-in-software-vulnerability-management/https://mikeystrauss.com/posts/navigating-the-cve-maze-reflections-on-challenges-in-software-vulnerability-management/One of the biggest issues with CVE scans today is false positives: vulnerabilities flagged in packages that are not actually in use. A look at package identification and scoping issues, and ways to reduce the noise.Mon, 12 Feb 2024 17:23:46 GMThttps://mikeystrauss.com/posts/cyclonedx-dependency-graphs/https://mikeystrauss.com/posts/cyclonedx-dependency-graphs/We’ve all heard a lot about SBOMs recently. We heard about their usefulness, their composition, and their requirements for security and regulation. This time I want to take the time to talk about a little less-known segment of the CycloneDX SBOM: the Dependency Graph.Wed, 13 Sep 2023 15:46:40 GMThttps://mikeystrauss.com/posts/from-chaos-to-clarity-how-to-secure-your-supply-chain-with-attestations/https://mikeystrauss.com/posts/from-chaos-to-clarity-how-to-secure-your-supply-chain-with-attestations/As everyone is getting progressively more aware, protecting your software supply chains should be a vital part of every organization’s cyber security strategy.Thu, 20 Apr 2023 13:22:30 GMThttps://mikeystrauss.com/posts/risks-and-vulnerabilities-in-hardware-systems-a-case-for-greater-awareness/https://mikeystrauss.com/posts/risks-and-vulnerabilities-in-hardware-systems-a-case-for-greater-awareness/Despite their potential to cause significant damage, many organisations still undervalue the importance of securing their hardware components. The case for taking hardware-based attacks more seriously, with driver bugs found in the Linux kernel.Sat, 25 Feb 2023 20:09:20 GMT