Detection Engineering on Matt Suiche

ELEGANTBOUNCER: When You Can't Get the Samples but Still Need to Catch the Threat

Sun, 24 Aug 2025 00:00:00 +0000

The Genesis: When Signatures Aren’t Enough 🔗

In the world of mobile security research, there’s a recurring frustration that keeps many of us up at night: the most sophisticated exploits - the ones that really matter - are rarely shared. When Citizen Lab and Google TAG discover NSO Group’s latest 0-click exploits targeting journalists and activists, we get brilliant technical writeups, CVE numbers, and patches. What we don’t get? The actual samples.

This isn’t a criticism - there are excellent reasons for limiting access to weaponized exploits. But it creates a fundamental problem: How do you protect against threats you’ve never seen?

Researching BLASTPASS: Detecting the exploit inside a WebP file - Part 1

Wed, 27 Sep 2023 12:00:00 +0200

Introduction 🔗

Once again compression algorithms are showing us that they are ruling the internet. My initial encounter with compression algorithms was in the year 2007, while reversing the Windows hibernation file to reimplement the now well-known Microsoft LZXpress which I discovered later was used in most Microsoft products until today. This journey continues today, with the scrutiny of the vulnerability CVE-2023-4863 located within the open-source Libwebp library, affecting Chromium-based browsers such as such Mozilla, Chrome, and Edge but also messaging applications such as iMessage.

Researching FORCEDENTRY: Detecting the Exploit With No Samples

Mon, 19 Dec 2022 12:00:00 +0200

Earlier this month, I reached out to my friend Valentina and told her I wanted to learn about macOS/iOS exploitation, so she recommended taking a look at the CVE-2021-30860 vulnerability, also known as FORCEDENTRY, and the prior work her friend Jeffrey Hofmann posted on Twitter.

One year ago, Google Project Zero published an analysis of the NSO iMessage-based zero-click exploit caught in-the-wild by Citizen Lab and was dubbed as “one of the most technically sophisticated exploits we’ve ever seen” by the Google Project Zero team.