Android, mobile and supply-chain security research.https://mikey-blog-site.pages.dev/https://mikey-blog-site.pages.dev/posts/a-one-tap-token-drain-in-unstoppable-wallet-and-the-20-bug-bounty-it-earned/https://mikey-blog-site.pages.dev/posts/a-one-tap-token-drain-in-unstoppable-wallet-and-the-20-bug-bounty-it-earned/A self-custody crypto wallet is an app that holds your keys — the secrets that control your money on a blockchain. You don’t “log in” to move funds. Instead the wallet signs things with your key. A siWed, 14 Oct 2026 13:09:49 GMThttps://mikey-blog-site.pages.dev/posts/a-zero-day-in-androids-wi-fi-direct-any-app-can-steal-your-password-zero-permissions/https://mikey-blog-site.pages.dev/posts/a-zero-day-in-androids-wi-fi-direct-any-app-can-steal-your-password-zero-permissions/Any app can flip one flag and read your live Wi-Fi Direct password — zero permissions, no prompt.Tue, 06 Oct 2026 14:31:45 GMThttps://mikey-blog-site.pages.dev/posts/a-zero-day-screen-hijack-in-androids-tap-to-pay-the-grant-that-never-expires/https://mikey-blog-site.pages.dev/posts/a-zero-day-screen-hijack-in-androids-tap-to-pay-the-grant-that-never-expires/By Mikey Strauss, Dani Levenfeld & Tal Dim — Oats SolutionsMon, 28 Sep 2026 12:49:45 GMThttps://mikey-blog-site.pages.dev/posts/part-2-risks-and-vulnerabilities-in-hardware-systems/https://mikey-blog-site.pages.dev/posts/part-2-risks-and-vulnerabilities-in-hardware-systems/Nine confirmed kernel-driver bugs on a current flagship phone — from a nameplug-in USB-C cable to component-level tampering, across six independent chip vendors.Mon, 14 Sep 2026 13:51:35 GMThttps://mikey-blog-site.pages.dev/posts/a-zero-day-that-lets-any-app-rewrite-what-your-screen-reader-says/https://mikey-blog-site.pages.dev/posts/a-zero-day-that-lets-any-app-rewrite-what-your-screen-reader-says/By Mikey Strauss, Dani Levenfeld & Tal Dim — Oats SolutionsMon, 07 Sep 2026 13:22:25 GMThttps://mikey-blog-site.pages.dev/posts/your-dmv-can-trigger-a-out-of-bounds-read-inside-google-wallet/https://mikey-blog-site.pages.dev/posts/your-dmv-can-trigger-a-out-of-bounds-read-inside-google-wallet/By Mikey Strauss, Dani Levenfeld & Tal Dim — Oats SolutionsTue, 01 Sep 2026 13:54:53 GMThttps://mikey-blog-site.pages.dev/posts/a-zero-day-in-androids-on-device-ai-any-app-can-open-a-door-to-gemini-nano/https://mikey-blog-site.pages.dev/posts/a-zero-day-in-androids-on-device-ai-any-app-can-open-a-door-to-gemini-nano/By Mikey Strauss, Dani Levenfeld & Tal Dim — Oats SolutionsTue, 25 Aug 2026 13:55:40 GMThttps://mikey-blog-site.pages.dev/posts/a-zero-day-in-googles-confidential-computing-your-phone-can-be-fooled-into-trusting-a-fake/https://mikey-blog-site.pages.dev/posts/a-zero-day-in-googles-confidential-computing-your-phone-can-be-fooled-into-trusting-a-fake/We found this reading Google’s own open-source verification code, then built a real, working proof against the exact vulnerable version — not just a theoretical read of a diff. We also used Runzee , OTue, 18 Aug 2026 14:03:33 GMThttps://mikey-blog-site.pages.dev/posts/making-firmware-verifiable-not-just-signed/https://mikey-blog-site.pages.dev/posts/making-firmware-verifiable-not-just-signed/Every server, laptop, phone, switch, and baseboard management controller boots on firmware. It’s the first code that runs and the root of trust everything above it inherits. It is also the supply chaiMon, 10 Aug 2026 15:30:05 GMThttps://mikey-blog-site.pages.dev/posts/inclusive-hacking-ride-on-cars-to-empower-children-with-disabilities/https://mikey-blog-site.pages.dev/posts/inclusive-hacking-ride-on-cars-to-empower-children-with-disabilities/GitHub Repository: https://github.com/houdini91/go-baby-go-remote Special Thanks: Yitzhak Gershon for their guidance and Ouri Lipner for providing a HackRF.Mon, 29 Sep 2025 14:44:21 GMT