Have a Master's thesis or PhD research topic and want to know if it's a good one? That's what I'll usually tell my students:
• Choose something that will keep you motivated for at least 6 months.
• The research topic should be defined in a way that even if you just achieve 50% of your initial goal, you'd still have something to write and pass.
• Think about if there's a new skill you want to learn for your next job and how to integrate it into the thesis topic.

I'll be giving my inaugural lecture at HPI on November 26, 4pm. Want to join in person? Register below. There will be waffles 🧇 and unicorns.

https://hpi.de/en/registration/2026/inaugural-lecture-by-prof-dr-jiska/

Are you a PostDoc and want to stay in academia? We just opened 10 tenure track professor positions. HPI is close to Berlin, with the campus located next to a beautiful lake. We have excellent students and friendly colleagues.

https://faculty-search.hpi.de/jobposting/8eb09271dedcce57550830b608b2526f970eb4383

With Siri Recap, Apple sends everything people say to Private Cloud Compute. Apple Reference Image extends this and also sends your photos to PCC.

https://security.apple.com/blog/apple-reference-image/

Henri Jäger-Menn made huge progress in reverse engineering and reimplementing Apple's proprietary Low-Latency WiFi on Linux. The #mrmcd26 recording is already online: https://talks.mrmcd.net/2026/talk/3R8PSJ/

Siri Recap privacy features will prevent that a restroom visit 💩 will be transcribed. The information it won't strip are who one interacted with and which decisions were made. While the former might be embarrassing, the latter is why at-risk users get hacked. With this sensitive data being recorded across many devices, it'll be only a matter of time until governments request Apple to turn of end-to-end encryption of Siri Recap in iCloud.

Apple shared details on how Siri Recap works, a new feature where your Apple Watch can listen to your surroundings 24/7 and take notes.

TL;DR: "security" and "privacy" mentioned a lot of times, and it seems like local processing at first sight. However, towards the end of the processing chain, the data is sent to third parties (via PCC, which is no longer running on Apple's hardware) and synced across all of your devices.

Source: https://www.apple.com/privacy/docs/Audio_Intelligence_Privacy_Overview_Sep_2026.pdf

Did you know you can run macOS binaries on iOS? It mostly needs rewriting architecture information and adjusting library paths within the Mach-O. However, some binaries also depend on proprietary libraries in the DYLD shared cache. I automated this process, including DYLD shared cache library extraction and replacement, allowing many macOS command line tools to run on iOS. #reverseengineering

https://github.com/mowisec/macos-to-ios/

Du interessierst dich für Anwendungssicherheit und wohnst in Karlsruhe oder der Umgebung? Dann schau doch am 23. September beim OWASP Diversity PreCon Day vorbei, einem Angebot für Frauen und queere Menschen. Über den Ticket-Shop vom German OWASP Day kannst du dich kostenlos für die PreCon anmelden.

Trainerinnen geben dort Workshops über Anwendungssicherheit allgemein, Bedrohungsanalysen, KI, bis hin zu einem Workshop von mir zur IoT-Firmwareanalyse.

Mehr Infos: https://god.owasp.de/2026

RE: https://grapheneos.social/@GrapheneOS/117179231167297908

Apple: "We had to work on MTE stability and security improvements for 5 years, but we finally ship it with the iPhone 17 and enable it by default."

Google: "We shipped MTE hardware for 3 years and only academics enabled this optional feature to demonstrate practical attacks against it, so we decided to no longer ship it on the latest Pixels."

https://www.ardmediathek.de/video/Y3JpZDovL2JyLmRlL2Jyb2FkY2FzdC9GMjAyNVdPMDE4MjY5QTA

Want to learn firmware reverse engineering on an IoT device? I'll be giving a free, women-only workshop with BlackHoodie at Hexacon in Paris on October 15. #reverseengineering

https://blackhoodie.re/Hexacon2026/

How do the closed-source parts of Apple's Private Cloud Compute work? We had a look at it 🍎👀

Paper: https://dl.acm.org/doi/abs/10.1145/3765613.3811691
Slides: https://hpi.de/fileadmin/user_upload/90_Research_Groups/classen/Documents/ACM_WiSec_26_PCC_Presentation.pdf

Einfach TK-Pizza an euch selbst adressieren und nach 10 Minuten entnehmen. Jetzt direkt neben vielen Supermärkten verfügbar.

Zum Glück hab ich letzten Monat eine für 749€ bekommen... 💸

Was wollen wir trinken, sieben Tage lang?

🎉🎉🎉
https://www.dfg.de/de/aktuelles/neuigkeiten-themen/pressemitteilungen/2026/pressemitteilung-nr-06

Jamf analyzed an iOS Predator implant that disables rendering of the green and orange dots to hide microphone & camera recording by the spyware. It hooks methods inside SpringBoard and mediaserverd. Apple abandoned mediaserverd in iOS 18, and simple user-space hooking shouldn't work on any modern iPhone due to Exclaves. But Forbes now relates that research to iOS 26.2 and 26.3 updates 🤔🤦‍♀️

https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/
https://www.forbes.com/sites/kateoflahertyuk/2026/02/20/how-apple-iphone-spyware-can-bypass--orange-and-green-dot-indicators/

Google's Pixel 10 supports Apple's AirDrop protocol. Curious about how they did this? Let's take a look! #reverseengineering

https://youtu.be/qBsNoa0FOPw

Ich bin nicht bei der Telekom, ich bin ...

(Dass das ein Freitextfeld ist auf Anbieterseite einfach so sinnlos.)