Blog
Yang Lee — mobile security research & engineering. Prague / Taipei.
Frida lets attackers intercept method calls and modify return values in real time. If you're building apps that handle payments, healthcare, or authentication — your threat model needs to include runtime instrumentation attacks.
Most mobile apps are structured well — clean layers, nice abstractions. That helps teams ship. It does not answer the security question. The real boundary is trusted vs untrusted, and the client should never be the final place where trust is decided.
Short-lived secret bytes should not hang around longer than necessary. SecretMemory is a small Swift Package that makes the secure path the easy path for login forms, one-time tokens, and crypto material.
Checks inside the app are valuable signals, but not a source of absolute trust. The real question is where trust lives when the app can no longer trust itself.
A career pivot from iOS developer to security engineer — how building apps for 12 years turned out to be the best preparation for figuring out exactly where they break.
Memory Integrity Enforcement on A19 hardware brings hardware memory tagging to iPhone. Use-after-free and buffer overflow bugs go from 'maybe exploitable' to 'crash on contact.'
Most mobile security advice assumes a generic adversary. Real attackers fall into distinct tiers — from nation-state mercenary spyware to opportunistic credential harvesters. Here's how to model the threat correctly.
A modern smartphone is a network of specialized processors, each with its own attack surface. Baseband, Secure Enclave, NPU, Wi-Fi/Bluetooth controller — here's the hardware attack surface most people ignore.