Mickey Jin
@patch1t
Followers
5K
Following
3K
Media
38
Statuses
288
Exploring the world with my sword of debugger : )
Joined August 2013
As promised, I just dropped a dozen new sandbox escape vulnerabilities at #POC2024 If you missed the talk, here is the blog post: https://t.co/zTcENNrZun Slides: https://t.co/sWztf0ygM4 Enjoy and find your own bugs 😎
github.com
Mickey's Blogs. Contribute to jhftss/jhftss.github.io development by creating an account on GitHub.
Actually, 15+ new sandbox escape vulnerabilities discovered. All of them are simple logic issues. You may find your own sandbox 0-days by yourself after listening to this talk!🔥🔥🔥
12
144
494
A really thorough overview of the research:
github.com
Contribute to trailofbits/exploits development by creating an account on GitHub.
0
11
37
The slidedeck to our talk, Crash One: A Starbucks Story - CVE-2025-24277, with @gergely_kalman from @hexacon_fr and @objective_see #OBTS is available from the link below. It was a macOS vulnerability impacting the crash reporting process where we could achieve LPE and sandbox
1
26
85
Excited to share our research on ChillyHell, a modular macOS backdoor targeting officials in Ukraine. Check out our write-up for more details. https://t.co/RakC7KEQAU
jamf.com
Discover its origin, how it compromises macOS and more importantly, how the JTL detected this malicious threat to keep Jamf customers safe.
2
11
32
For those missing the talk, Blog: https://t.co/XBvFMbsfi0 Slides:
github.com
Mickey's Blogs. Contribute to jhftss/jhftss.github.io development by creating an account on GitHub.
6
42
166
A tiny timing flaw in Apple’s core file-copy APIs can put millions of devices at risk 📂🍏 Despite warnings, Apple thought it was “too hard to exploit”—until Mickey Jin developed an exploit that steals secrets in privileged services 👉 https://t.co/aygSUbH82F
#NullconBerlin2025
0
10
45
Thank you @helpnetsecurity to mention us 👍 awesome research by @tsunek0h
#macOS #applesecurity #NullconBerlin2025
https://t.co/RuYmmZRmc4
helpnetsecurity.com
Today at Nullcon Berlin, a researcher disclosed a macOS vulnerability (CVE-2025-24204) that allowed attackers to read the memory of any process, even with
1
3
15
🚨 New blog post: ELEGANTBOUNCER - Catch iOS 0-click exploits without having the samples. Features iOS backup forensics & messaging app scanning for iMessage, WhatsApp, Signal, Telegram & Viber attachments. 🔗 Link ->
8
64
205
🍏 #AppleDevelopers use NSFileManager thinking it’s safe — but @patch1t found a race condition once thought “impossible to exploit.” At #NullconBerlin2025, he’ll show how it works, why CVE-2024-54566 failed, and Apple’s final fix. 👉 https://t.co/aygSUbH82F
#iOS #applesecurity
1
3
24
Brief info and POC for this week's Apple 0click iOS 18.6.1 RCE bug CVE-2025-43300 https://t.co/EL3qg56N8X
16
225
800
We released our Fuzzilli-based V8 Sandbox fuzzer: https://t.co/eVkR1bl76n It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
github.com
This is a basic fuzzer for the V8 Sandbox. It uses the memory corruption API to implement a random-but-deterministic (given a seed) traversal through the V8 heap object graph and corrupts some obje...
2
74
292
Launch constraints are annoying as a security researcher. What if you didn't have to worry about them? https://t.co/GOZjFhe87g
wts.dev
A security research blog.
5
9
41
So CVE-2025-43268 was indeed my vuln in cryptexctl, but @0x3C3E found it first, kudos to him. Here's the "exploit", which makes sudo try and load an unsigned dylib from the current directory: /S*/L*/S*/u*/b*/c*.r* exec $PWD/ sudo ls
1
6
39
📢 Just dropped: the full #OBTS v8 talk lineup! https://t.co/WnHCvCdWqm And for the first time we'll have 3 full days of presentations! 🤩 Congrats to the selected speakers and mahalo to all who submitted. With ~100 submissions, selecting the final talks was a daunting task! 😫
objectivebythesea.org
Conference Talks
2
26
62
I lightly mentioned CVE-2025-31235, a double-free I found in coreaudiod/CoreAudio, during my OffensiveCon presentation last month. It's been derestricted now, so enjoy my writeup which includes a PoC and dtrace script to help understand the vulnerability!
3
43
200
My "Finding Vulnerabilities in Apple Packages at Scale" talk is up on YT 🎉
All talks from #SecurityFest are now published on YouTube for your enjoyment. Grab some popcorn and binge watch!
2
11
55
Woah, @WangTielei talk “Sending Me Your IOUserClients: A Bypass to Immovable Ports” at @deepsec_cc was insanely good! I enjoyed it! Super clever new discovery. feels awesome to see other researchers referencing my past work.
0
8
47
Stoked for Jaron Bradley's soon to be released 2nd-book: "Threat Hunting macOS" 😍📚 (And was honored to write its forward). Jaron is an outstanding researcher, speaker, trainer, & friend, and this book will become an essential macOS security resource. https://t.co/1XpmC1VbNU
linkedin.com
I will soon be opening pre-orders for my new book, along with the first two chapters for free via audiobook recordings. I've realized that the first two chapters aren't overly technical, and work...
1
8
53
