Writing

Engineering·November 9, 2026·3 min read

How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and kept authorization on the backend.

Engineering·November 7, 2026·2 min read

The trust failure I examined in Android toll-fraud reporting is the confirmation step: an OTP does not protect a purchase if malicious software on the same device can intercept or submit it. Microsoft documented Android toll-fraud workflows in which malware tried to subscribe victim

Engineering·November 7, 2026·2 min read

In reviewing the Joker/Bread campaigns, I focused on the separation between an app doing its advertised job and subscription activity the owner never authorized. Google's 2020 report on Bread—often called Joker—documented that exact billing-fraud problem. The family kept adapting as defenses a

Engineering·November 7, 2026·2 min read

Triada challenges an app-centric mobile threat model in an important way. Google's Android security team described a malware family that moved from rooting attempts into compromised system images. The malicious cod

Engineering·November 7, 2026·2 min read

The entry point I focused on in FluBot was the delivery-text lure, because the later banking and contact-abuse behavior depended on the permissions granted after that initial deception. But FluBot used exactly that: convince someone to follow a delivery or voicemail lure, install a malicious Android application, and grant it un

Engineering·November 6, 2026·3 min read

What requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization.

Engineering·November 6, 2026·4 min read

A valid App Attest or Play Integrity result cannot authorize a user. I walk through the server decisions separately and test them with synthetic inputs.

Engineering·November 6, 2026·3 min read

Avoid orphaned jobs and stale UI state by understanding cooperative cancellation, scopes, and background work.

Engineering·November 6, 2026·4 min read

Model sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass.