Phil Stokes

527 Followers
107 Following
104 Posts
macOS security researcher, technical writer, editor, #lufc fan. Opinions my own. I do not speak for my employer, or they for me. 😎

I made a thing called Wellness Ping because someone I care about went silent and it took too long for anyone to notice.

You get regular check-ins via email. If you don't respond, your emergency contacts get notified.

Built it for anyone who might go missing and needs someone to notice: activists, journalists, researchers, solo folks.

I paid for premium hosting (high-reliability VPS in Sweden) and a quality email provider because uptime actually matters for something like this. Also paying extra for minimal data retention (7 days email activity, working toward zero content storage).

Free forever (as long as I'm alive) and open source.

https://wellness-p.ing

Wellness Ping

Fresh from #SentinelLABS: our story on how #dprk threat actors try to leverage threat intel platforms and leak their own secrets. 🕵️‍♂️🤦‍♂️
https://s1.ai/nk-ops
https://s1.ai/readup
🐚 Adware loaders are always the most complex! Props to @syrion89.bsky.social for helping me pull apart all these different bins and figuring out what they had in common and how to attribute and detect them. 🦾 #adware #malware #macOS #security
@sentinelone.com @sentinellabs.bsky.social
ReaderUpdate Reforged | Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

A widespread campaign with binaries written in different source languages, ReaderUpdate presents unique challenges for detection and analysis.

SentinelOne
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed #macOS #malware #DPRK #apt
https://s1.ai/Ferret
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

DPRK 'Contagious Interview' campaign continues to target Mac users with new variants of FERRET malware and GitHub devs with repo spam.

SentinelOne

If you're interested in leveraging AI and open source tools (radare2) to reverse engineering (mobile) apps, check out this excellent article by @pancake from @NowSecure . Abstract and repo/blog links ⬇️

➡️ Abstract: This post covers a novel approach for recovering application source code, leveraging AI language models to transform pseudo-disassembly into high-level source code. This method is able to handle complex abstractions introduced in high-level languages SwiftUI or Dart and generates output in popular programming languages like Swift, C#, Kotlin, Java, Python or even Bash.

➡️ Repo: https://github.com/radareorg/r2ai/blob/master/README.md

➡️ Blog: https://www.nowsecure.com/blog/2025/01/29/decompiling-apps-with-ai-language-models/

#radare2

r2ai/README.md at master · radareorg/r2ai

local language model for radare2. Contribute to radareorg/r2ai development by creating an account on GitHub.

GitHub
r2ai/decai at master · radareorg/r2ai

local language model for radare2. Contribute to radareorg/r2ai development by creating an account on GitHub.

GitHub
BlueSky. I think they did it. You can find me over there from now on. https://bsky.app/profile/philofishal.bsky.social
Bluesky

Bluesky Social

You can download the slides of my #radare2 training at #nn2024 https://radare.org/get/r2learn-nn2024.pdf

For those who asked for the cheatsheets: https://github.com/radareorg/radare2-cheatsheets

#XProtect v5274 has dropped. Interestingly, the only changes are name changes. The rules remain the same but 3 previously obscured hex named rules for #Bundlore #adware are now given more meaningful names. 👏 #apple #malware #security
Image
macOS Sequoia | What’s New in Privacy and Security for Enterprise?

Monday September 16th saw Apple release the newest version of its Mac operating system, macOS 15 Sequoia, and SentinelOne was delighted to announce support for this version of macOS on the day of release.

SentinelOne