Ariel Koren - security research, AI systems, product architecture, and secure systems design.
A write-side fuzzing campaign against libpng18's APNG re-encode path found a per-frame buffer lifecycle bug causing both a memory leak and a width-dependent heap buffer overflow. The overflow carries 100% attacker-controlled bytes, scales linearly with canvas width to a per-row ceiling of approximately 4 MB at libpng's default user-width limit, and was characterized in a no-ASAN glibc test build…
A verified heap out-of-bounds write in Skia's SkOTUtils::RenameFont via the public GDI font API on Windows - reported, reproduced, declined won't-fix.
AI made execution cheap and direction the bottleneck. Slop is not a model problem - it is what happens to amplified output when nobody owns the direction.
A systems-design writeup of Anvil: how AI agents do the research glue work while schemas, sanitizers, reachability, and an evidence ladder keep the claims honest.
A language model predicts; an agent acts. Why agent authority belongs in a deterministic enforcement layer outside the model - not in the model itself.
A founder write-up on OmniBoard, the board game console I shelved when 20 flexible color e-ink cards drove the BOM north of $600. What I built, what killed it.
A single afternoon of fuzzing against libheif 1.21.2 produced two memory-safety bugs in the same function. The first is a NULL pointer dereference on a malformed grid dimg reference - deterministic denial of service on any consumer that calls heif_decode_image or heif_image_handle_decode_image_tile. The second is a uint32 underflow in the inverse-rotation tile arithmetic that feeds a debug-only…
Walkthrough of a maliciously crafted Office document that evaded every static engine on VirusTotal - and what the engines were missing.
A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer. The same input crashed both products at matching call-site offsets. Reported to the Microsoft Security Response Center on January 30, 2020. Microsoft published the fix on June 9, 2020 as the Microsoft Office Remote Code Execution Vulnerability, graded…
Walkthrough and exploit for Level 06 of the Fusion exploitation series. Race conditions, integer overflow, stack overrun.
Solution for Level 05 of the Fusion series. Heap spraying, info leak, and ASLR bypass.
Deep technical dive into the Nymaim banking trojan: anti-analysis tricks, control-flow obfuscation, and the parts that fight back.
Reverse-engineering walkthrough of Ursnif: process injection, sandbox evasion, traffic obfuscation, and a bug in the malware's own DGA.