Episode

EP 127 — Maddie

01 November 2022 Official episode · Official transcript

bug hunter research

Maddie Stone discusses Android malware analysis, reverse engineering, actively exploited zero-days, Google Project Zero, Pegasus, and efforts to make exploit development harder.

Topics: software reliability and software engineering, reverse engineering and disassembly, Android malware analysis, APK files and native libraries, Java, C, and C++ compiled code, obfuscation and anti-analysis, anti-debugging and runtime environment checks, zero-day vulnerabilities and actively exploited exploits, commercial surveillance spyware, vulnerability disclosure deadlines, proof-of-concept exploit development, WebKit patch regression, watering hole attacks, exploit chains, fingerprinting scripts, patch diff and git blame analysis, use-after-free and buffer-overflow vulnerability classes, variant analysis, public versus private state-of-the-art, spyware forensics and exploit detection

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (48)

Claims (22)

Qualified statements from this episode, not graph facts.

Mariner 1 INVOLVES NASA

The Mariner 1 mission was developed and operated as part of NASA's space program.

Explicit Confidence 96% · Jack Rhysider EP 127 Details

“In the 1960s, NASA developed the Mariner Space Program.”

Jack Rhysider · offsets 1111–1166

“That was the end of the Mariner 1 spacecraft”

Jack Rhysider · offsets 2131–2175

Mariner 1 LEADS_TO software engineering

The software failure that destroyed Mariner 1 helped prompt software engineering becoming a formal discipline.

Explicit Confidence 94% · Jack Rhysider EP 127 Details

“This software bug didn’t just crash a spaceship, but it launched a whole new field of study”

Jack Rhysider · offsets 3934–4025

Maddie Stone MEMBER_OF Applied Physics Laboratory

Maddie worked at the Applied Physics Laboratory for her first four-and-a-half years after college.

Explicit Confidence 98% · Maddie Stone EP 127 Details

“That’s where I ended up for the first four-and-a-half years”

Maddie Stone · offsets 5643–5702

Maddie Stone USES Reverse engineering

Maddie worked on reverse-engineering firmware and hardware at the Applied Physics Laboratory.

Explicit Confidence 98% · Maddie Stone EP 127 Details

“working on reverse-engineering of firmware and hardware”

Maddie Stone · offsets 5718–5773

Maddie Stone USES Assembly language

Maddie studied and taught Assembly language and created projects for the course.

Explicit Confidence 97% · Maddie Stone EP 127 Details

“I had actually listed that that was my favorite language”

Maddie Stone · offsets 6443–6499

“I became the teaching assistant for that course”

Maddie Stone · offsets 6670–6717

GinMaster AFFECTS Android

GinMaster infects Android phones and tablets, steals private data, and can give attackers access to the device.

Explicit Confidence 98% · Jack Rhysider EP 127 Details

“millions of Android devices infected by this”

Jack Rhysider · offsets 11677–11721

“it can steal user data, take control of the device”

Jack Rhysider · offsets 12761–12811

Chamois DISCOVERED_BY Maddie Stone

Maddie investigated and identified Chamois as a sophisticated malware family and botnet.

Explicit Confidence 96% · Maddie Stone EP 127 Details

“one of the biggest malware families that I was not expecting”

Maddie Stone · offsets 15326–15386

“it became clear that it was this botnet and this family of malware”

Maddie Stone · offsets 16306–16372

Chamois USES anti-analysis

Chamois performed extensive anti-analysis checks to determine whether it was being examined by a security researcher.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“doing an incredible amount of anti-analysis”

Maddie Stone · offsets 15859–15902

Chamois USES anti-debugging

Chamois performed extensive anti-debugging checks.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“as well as doing an incredible amount of anti-analysis and anti-debugging checks”

Maddie Stone · offsets 15848–15928

Chamois USES Java Native Interface

The malware's presentation covered Java Native Interface manipulations.

Explicit Confidence 97% · Maddie Stone EP 127 Details

“some of the JNI or Java native interface manipulations”

Maddie Stone · offsets 19370–19430

Google Project Zero OPERATED_BY Google

Project Zero is described as a team within Google.

Explicit Confidence 98% · Jack Rhysider EP 127 Details

“This is a very talented team within Google”

Jack Rhysider · offsets 18553–18595

Maddie Stone MEMBER_OF Google Project Zero

Maddie accepted the role and joined Google Project Zero.

Explicit Confidence 99% · Jack Rhysider EP 127 Details

“So, she took the job and joined Google Project Zero.”

Jack Rhysider · offsets 20929–20981

Pegasus ATTRIBUTED_TO NSO

Pegasus is described as spyware used by NSO; Jack also identifies NSO as the company behind and selling it.

Explicit Confidence 99% · Jack Rhysider EP 127 Details

“Pegasus is the spyware used by NSO”

Jack Rhysider · offsets 23240–23274

“Pegasus is the spyware used by NSO, which is a company based in Israel”

Jack Rhysider · offsets 23240–23310

Pegasus USES Android exploit used in the Pegasus chain

An Android exploit was used by NSO in the delivery chain for Pegasus.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“NSO had this Android exploit that they were using to target Android users in their delivery of Pegasus”

Maddie Stone · offsets 21594–21696

proof-of-concept exploit DEVELOPED_BY Maddie Stone

Maddie partnered with Jann Horn to write a proof-of-concept demonstrating exploitation of the Android vulnerability and its usefulness in the Pegasus chain.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“I partnered up with Jann Horn to write a proof-of-concept”

Maddie Stone · offsets 22612–22669

proof-of-concept exploit DEVELOPED_BY Jann Horn

Jann Horn partnered with Maddie Stone to write a proof-of-concept exploit for the Android vulnerability.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“I partnered up with Jann Horn to write a proof-of-concept”

Maddie Stone · offsets 22612–22669

North Korean hackers TARGETS Google Project Zero

According to Google Threat Analysis Group, North Korean hackers targeted security researchers, including researchers from Project Zero, in an attempt to steal zero-day exploits.

Attributed Confidence 98% · Maddie Stone EP 127 Details

“Google TAG, the Threat Analysis Group, discovered that North Korean hackers were targeting security researchers, including security researchers from Project Zero”

Maddie Stone · offsets 26189–26350

Safari USES WebKit

Safari uses WebKit as its browser engine.

Explicit Confidence 99% · Jack Rhysider EP 127 Details

“WebKit product. This is the browser engine that Apple’s Safari browser uses”

Jack Rhysider · offsets 27872–27948

Chrome USES WebKit

Chrome was built on top of WebKit at the time the original bug was reported, before splitting off in 2014.

Explicit Confidence 98% · Maddie Stone EP 127 Details

“Chrome was still built on top of WebKit as their browser engine”

Maddie Stone · offsets 29223–29286

zombie bug AFFECTS WebKit

The zombie bug was a vulnerability in WebKit that had been fixed, reintroduced, and later exploited in the wild before being patched again.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“this was a zombie bug and that it had actually been originally fixed back in 2013”

Maddie Stone · offsets 28520–28601

“here we were in 2022 with the bug exploited in the wild and patched again”

Maddie Stone · offsets 28696–28769

zombie bug DISCOVERED_BY Sergei Glazunov

Sergei Glazunov was the original reporter of the bug in January 2013.

Explicit Confidence 99% · Maddie Stone EP 127 Details

“my teammate Sergei Glazunov was actually the original reporter of the bug back in January 2013”

Maddie Stone · offsets 29070–29164

Maddie Stone USES variant analysis

Maddie and her team perform variant analysis to prevent attackers from reusing variants of previously public vulnerabilities.

Explicit Confidence 98% · Maddie Stone EP 127 Details

“We complete variant analysis before the attackers are able to”

Maddie Stone · offsets 40073–40134

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:47:25.656655+00:00