Mobile · firmware · hardware
ByteBack works on mobile device trust, firmware, and hardware. Most projects start with a specific trust decision and end with testing on real devices.
If a signal cannot be collected, that is different from a clean result. The system should say so.
Security services
Most projects begin with one question: what can the product safely trust about a phone or embedded device?
Mobile and backend
Architecture and implementation for products whose servers must decide whether to believe a phone or the software running on it.
Boards, boot chains, and TEEs
Security review and testing below the operating-system boundary, from board behavior through the boot chain.
Specialist recovery service
A narrow application of the same hardware practice: invasive key-material recovery on supported Trezor devices.
How the work is done
Write down what the system needs to know, how an attacker could lie about it, and what evidence is actually available.
Document the attack paths, failure states, and consequences before choosing controls.
Keep policy on the server, make the device return evidence, and represent missing signals honestly.
Test the actual implementation on real devices and record the result, including the gaps.
Experience
Fifteen years in mobile security, payment hardware, firmware, secure boot, attestation, and vulnerability research.
Named inventor on a U.S. patent for keeping card numbers and PIN entry apart. One design removes PAN data from the merchant device before requesting a PIN. Another separates them across trusted execution environments and payment components.
Mobile threat signals and payment hardware at Square, mobile red-team work at Visa, and low-level security work at Root Labs and SourceDNA, later acquired by Apple.
Independently found and fully exploited a pre-auth U-Boot NFS client overflow. The finding collided with a private report filed one month earlier; patches and the public exploit chain are upstream.
Voltage fault injection against STM32F2 read-out protection, with key-material extraction from Trezor One and Model T.
How engagements work
The exact scope depends on whether you need a design review, implementation help, or repeated testing.
Review the attack surface and trust boundaries, then produce a design the engineering team can implement.
Build the controls and the test tooling, then hand both to the engineering team.
Re-test shipped defenses as bypass techniques and operating-system behavior change.
About
Manizzle has spent fifteen years working on mobile security, payment hardware, firmware, and the systems that decide whether to trust a device.
This is a small practice. Manizzle scopes the work and does the engineering.
Contact
On Signal, send a short description of the product, the devices in scope, and the decision you are trying to make.
Continue on Signal