jiska 🦄:fairydust:

Security rants, sewing, food, traveling, top insights.

📺: https://youtube.com/@jiskac
🐦: https://twitter.com/naehrdine
📝: https://naehrdine.blogspot.com

Public Key

npub1sdqwcrek8zgshxl4qgtgysgnx3zs9lv496htt928yxccj2c5qt4skcmrnn

NIP-05 Address

jiska_at_chaos.social@momostr.pink

Profile Code

nprofile1qqsgxs8vpumr3ygtn06sy95zgyfng3gzlk2jat44j4rjrvvf9v2q96cprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt057zdh

Publishing to

relay.momostr.pink

Author Public Key

npub1sdqwcrek8zgshxl4qgtgysgnx3zs9lv496htt928yxccj2c5qt4skcmrnn

Show more details

Last Notes

2026-09-17 09:19:18 UTC

Are you a PostDoc and want to stay in academia? We just opened 10 tenure track professor positions. HPI is close to Berlin, with the campus located next to a beautiful lake. We have excellent students and friendly colleagues.
https://faculty-search.hpi.de/jobposting/8eb09271dedcce57550830b608b2526f970eb4383
https://assets.chaos.social/media_attachments/files/117/285/618/923/763/595/original/ee8b1ce07192043d.png

2026-09-04 11:23:39 UTC

Du interessierst dich für Anwendungssicherheit und wohnst in Karlsruhe oder der Umgebung? Dann schau doch am 23. September beim OWASP Diversity PreCon Day vorbei, einem Angebot für Frauen und queere Menschen. Über den Ticket-Shop vom German OWASP Day kannst du dich kostenlos für die PreCon anmelden.
Trainerinnen geben dort Workshops über Anwendungssicherheit allgemein, Bedrohungsanalysen, KI, bis hin zu einem Workshop von mir zur IoT-Firmwareanalyse.
Mehr Infos: https://god.owasp.de/2026
https://assets.chaos.social/media_attachments/files/117/212/486/588/155/104/original/48bd312aff9ad61c.png

2026-08-31 08:49:21 UTC

RE: https://grapheneos.social/@GrapheneOS/117179231167297908
Apple: "We had to work on MTE stability and security improvements for 5 years, but we finally ship it with the iPhone 17 and enable it by default."
Google: "We shipped MTE hardware for 3 years and only academics enabled this optional feature to demonstrate practical attacks against it, so we decided to no longer ship it on the latest Pixels."
#note1f8z…8pl6

2026-08-22 15:17:57 UTC

Want to learn firmware reverse engineering on an IoT device? I'll be giving a free, women-only workshop with BlackHoodie at Hexacon in Paris on October 15. #reverseengineering
https://blackhoodie.re/Hexacon2026/
https://assets.chaos.social/media_attachments/files/117/139/813/855/898/549/original/f55aae4961a29d54.png

2026-07-11 17:04:40 UTC

How do the closed-source parts of Apple's Private Cloud Compute work? We had a look at it 🍎👀
Paper: https://dl.acm.org/doi/abs/10.1145/3765613.3811691
Slides: https://hpi.de/fileadmin/user_upload/90_Research_Groups/classen/Documents/ACM_WiSec_26_PCC_Presentation.pdf

2026-06-28 13:56:41 UTC

Einfach TK-Pizza an euch selbst adressieren und nach 10 Minuten entnehmen. Jetzt direkt neben vielen Supermärkten verfügbar.
https://assets.chaos.social/media_attachments/files/116/828/071/037/249/296/original/b3de6154ef7289fc.png

2026-06-25 12:23:37 UTC

Zum Glück hab ich letzten Monat eine für 749€ bekommen... 💸
https://assets.chaos.social/media_attachments/files/116/810/721/128/370/872/original/fbd4df76b55d9ed3.png

2026-06-15 08:28:48 UTC

- reply

falls ihr im Apple-Ökosystem unterwegs seid, ggf. eine gebrauchte Apple Watch? Ansonsten scheint es noch eine Neuauflage von Pebble zu geben, aber kA wie gut die ist. Beides unterstützt lokale Speicherung der Daten.
Generell ein Problem bei den meisten Anbietern ist, dass die Daten an den Betreiber geschickt werden. Dh Google weiß dann, auch bei einem Kind, wie fit es ist. 🫠

2026-03-27 15:54:21 UTC

🎉🎉🎉
https://www.dfg.de/de/aktuelles/neuigkeiten-themen/pressemitteilungen/2026/pressemitteilung-nr-06
https://assets.chaos.social/media_attachments/files/116/301/942/534/184/269/original/3bd6a936f9ad4dc7.png

2026-02-07 15:06:38 UTC

In this video, I'm analyzing a really confusing dialog on macOS. Let's dig a bit deeper into what it should do and what it's actually doing. #reverseengineering
https://youtu.be/P7hYg2GpsTk
https://assets.chaos.social/media_attachments/files/116/029/950/331/345/179/original/111133f99a17d499.png

2025-12-30 01:02:46 UTC

Ok bomer #39c3
https://assets.chaos.social/media_attachments/files/115/805/815/939/121/444/original/bc37efebc7a2eeeb.png

2025-12-28 10:45:04 UTC

Want to know how Apple's Low Latency WiFi works?
Today, 3:40pm CET, Hall 1, #39c3.
More details: https://events.ccc.de/congress/2025/hub/event/detail/cracking-open-what-makes-apple-s-low-latency-wifi-so-fast
Stream: https://streaming.media.ccc.de/39c3/one

2025-11-26 11:36:15 UTC

Using a Pixel with GrapheneOS that features Inactivity Reboot, MTE, and more? — You must be a drug dealer. 🚨
Using an iPhone 17, which now also ships with EMTE, Inactivity Reboot, SPTM, TXM, Conclaves, ...? — Oh, just the average Apple fangirl/boy who gets a new device every year due to camera improvements. ✅
GrapheneOS released some innovative mitigations prior to Apple. Yet, it needs Big Tech to apply such ideas and make phones more secure at scale.
https://www.golem.de/news/grapheneos-verlaesst-ovh-frankreich-ist-kein-sicheres-land-fuer-privacy-projekte-2511-202570.html
https://assets.chaos.social/media_attachments/files/115/615/739/935/034/114/original/9244601a259bf57d.png

2025-09-10 19:50:51 UTC

Want to learn reverse engineering? There'll be a free, women*-only, 4-day BlackHoodie workshop from October 6th to 9th in Paris!
Topics:
• Linux memory forensics 🕵️‍♀️ (by Sonia)
• Web app and mobile app pentesting 🕸️📱 (by Paula)
• iOS reversing 🍎 (by me)
Places usually go quickly! Use this link to register - you can even select only the days with the topics that interest you and skip others.
https://blackhoodie.re/Hexacon2025/
#ios #reverseengineering #blackhoodie

2025-08-01 09:00:47 UTC

My first day with a fancy new title 👩‍🏫🎉
https://assets.chaos.social/media_attachments/files/114/952/687/828/561/661/original/f596eed21139c0cc.jpg

2025-07-29 15:58:37 UTC

Ever wanted to do practical security research on platforms like iOS and Android? Obsessed with digging through system internals, tearing apart proprietary firmware and hardware or breaking down wireless protocols? Maybe you've spent weekends battling in CTFs?
✨📱 🐞💥 🔬 🛰️
I'm growing my team at Hasso Plattner Institute and am looking for a PhD student or Postdoc. It's a full-time, paid position in a supportive academic environment with a focus on impactful, real-world systems security research.

2025-07-11 14:23:10 UTC

The Apple Watch has a closed down ecosystem, only compatible with the iPhone. [@trusted_device](https://infosec.exchange/@trusted_device ) reverse engineered its interfaces and opened it up for compatibility with Android! ✨ WatchWitch ✨ allows you using your Apple Watch ⌚ on Android devices, interpreting your health data, answering messages on the Watch and more.
Demo video: https://www.youtube.com/watch?v=dHz8NHMhtLY
Read the full paper: https://arxiv.org/abs/2507.07210
https://assets.chaos.social/media_attachments/files/114/835/045/435/430/944/original/beec05f961a6f52f.png

2025-04-11 15:34:17 UTC

Peak messenger security: won't decrypt your own messages 🔒
https://assets.chaos.social/media_attachments/files/114/320/056/277/667/555/original/4a9afecb16c738b3.png

2025-03-20 10:28:43 UTC

"Liebe Fahrgäste die vor dem Wagen 1 stehen. Dieser Zug ist kein Adventskalender, Sie dürfen auch die anderen Türen benutzen!" // @npub19k4…r3g6

2025-03-09 12:30:32 UTC

Tarlogic found a "backdoor" im the ESP32 chips: https://social.lansky.name/@hn100/114127956134801350
Broadcom and Cypress chips have the same HCI "backdoor" allowing to write to the Bluetooth chip's RAM. This feature is used for firmware patches.
We didn't request CVEs for that 9 years ago. Instead, we built the InternalBlue Bluetooth research framework: https://github.com/seemoo-lab/internalblue

2024-12-30 17:20:30 UTC

What has been seen cannot be unseen 🥬 #38c3
https://assets.chaos.social/media_attachments/files/113/742/918/157/528/153/original/23ef18a1e0a768b6.png

2024-12-27 21:25:38 UTC

I will give two lightning talks at #38c3 🎉 Both on day 3, stage Huff, around 11:30am.
Detecting Fake Base Stations with CellGuard on iOS 📶
https://cfp.cccv.de/38c3-lightningtalks/talk/8RRHKT/
iOS Inactivity Reboot 📲
https://cfp.cccv.de/38c3-lightningtalks/talk/B83MXJ/

2024-11-17 21:44:28 UTC

How does the new iOS inactivity reboot work? What does it protect from?
I reverse engineered the kernel extension and the secure enclave processor, where this feature is implemented.
https://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html
https://assets.chaos.social/media_attachments/files/113/500/474/590/254/215/original/0d6d71c7609c7b3f.png

2024-11-15 10:01:57 UTC

- reply

While inactivity reboot makes it more challenging for law enforcement to get data from devices of criminals, this won't lock them out completely. Three days is still plenty of time when coordinating steps with professional analysts.
On iOS 18.2 setup, users are now asked if they'd like to enable Stolen Device Protection, a feature previously hidden deep in the Settings menu. It prevents thieves from getting access to your phone&accounts with only the PIN by prompting for biometrics more often.

2024-11-15 10:00:51 UTC

See the latest iOS inactivity reboot in action! 🔒
iOS 18 comes with improved anti-theft measures. Three days w/o unlock, the iPhone will reboot, preventing thieves from getting your data.
Inactivity reboot puts your iPhone into "Before First Unlock" state, effectively locking encryption keys in the Secure Enclave Processor. Even if thieves leave your iPhone powered on for a long time, they won't be able to unlock it with cheaper, outdated forensic tooling. (1/2)
https://assets.chaos.social/media_attachments/files/113/486/381/056/860/112/original/778ccd3fa72d4f4a.mp4

2024-11-09 02:15:31 UTC

- reply

There's a new article with more details on when the new inactivity reboot is triggered on iOS 18:
https://www.404media.co/apple-quietly-introduced-iphone-reboot-code-which-is-locking-out-cops/
This is a cheap & great mitigation! While most people won't have their phone forensically analyzed, many more will have their devices stolen. It protects user data in both cases.

2024-11-08 14:51:25 UTC

Apple added a feature called "inactivity reboot" in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device. So if you don't unlock your iPhone for a while... it will reboot!
In the news: "Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out"
https://www.404media.co/police-freak-out-at-iphones-mysteriously-rebooting-themselves-locking-cops-out/
iOS version diffs to see yourself:
https://github.com/search?q=repo%3Ablacktop%2Fipsw-diffs%20inactivity_reboot&type=code
https://assets.chaos.social/media_attachments/files/113/447/879/997/360/645/original/1b2076f1b9b3f274.png
https://assets.chaos.social/media_attachments/files/113/447/882/635/202/341/original/498b97c6f5e67495.png
https://assets.chaos.social/media_attachments/files/113/447/883/800/116/938/original/1e2903133e17ce3f.png

2024-11-02 15:30:13 UTC

Hotdog or not hotdog?? 🌭
Let's take a look into a machine learning app that can detect hotdogs. How does it work? Can we change it into a pizza detector 🍕 app?
https://youtu.be/e2kosWm2vag
#reverseengineering #reversingshorts
https://assets.chaos.social/media_attachments/files/113/414/070/474/720/897/original/1d5c902d2d1323d1.png

2024-08-29 17:57:08 UTC

Are you living near Paris, female*, and want to learn reverse engineering for free? 📱👩‍💻 There'll be a 4-day @npub1dgj…wlqq training at Hexacon!
I'll be giving the training on two days, teaching iOS and Android reversing basics. Register now: https://reversing.training/hc24
#reverseengineering #paris #womenintech