Personal notes in systems security
Murtaza Izzee is a security engineer and researcher working across mobile platforms, firmware, hardware trust, and low-level systems.
If the bottom layer lies, every abstraction above it inherits the lie.
Selected research
Independently found a pre-auth buffer overflow in U-Boot's NFS client — pointer hijack, NFS state-machine takeover, shellcode delivery, full chain and public PoC. It collided with a private report filed a month earlier, so the CVE went to the other reporter.
Patches are upstream, including a second negative-length bug in nfs_read_reply() found on the way.
Voltage fault injection to bypass RDP2 read-out protection on STM32F2; extracted seeds off bootrom startup. Trezor One and Model T.
Named inventor on a U.S. patent covering device integrity and trusted-execution isolation for payment systems.
Public talk
Bugcrowd LevelUp 0x03
Code and experiments
A real, dated census of SDK code detected in 320 public mobile app binaries. Presence only—not use, configuration, effectiveness, or market share.
Explore the artifact ↗ 02 / GITHUBPublic code spanning binary analysis, low-level systems, mobile platforms, and security research.
github.com/manizzle ↗ 03 / AI SYSTEMSPublic multi-model orchestration work with evidence-oriented routing, checkpointed queues, bounded execution, and independent criterion-level verification.
Open the repository ↗Writing
The longer record: compiler-assisted binary packing, ELF disinfection, static analysis, and years of competitive-security notes.
Open the Saramena blogExtending CodeQL with automatic query generation and the ideas behind the experiment.
Detecting anomalous load segments and recovering the original entry point from PT_NOTE-infected ELF binaries.
A compiler-assisted, function-by-function packing design built with LLVM and libbfd to frustrate static analysis.
An older archive of challenge solutions, exploit notes, and team research.
About
Murtaza Izzee is a security engineer whose work has crossed mobile threat signals, payment-terminal hardware, firmware, secure boot, attestation, trusted execution, offensive research, and verification-gated AI systems.
M.S. Information Security, NYU Tandon. Founding security engineer at SourceDNA (YC S15), acquired by Apple.