Marco Grassi

Background

Marco Grassi is a security researcher whose public work centers on vulnerability research and exploitation for mobile and desktop operating systems, including Android, iOS, macOS, and cellular baseband firmware. Early in his career he was a member of the NowSecure Research and Development team, where he worked on reverse engineering, penetration testing, and vulnerability research for mobile operating systems and mobile security products. During this period he presented on Android security topics, including a talk on the "Current State of Privilege Escalation on Android" at the HITB GSEC conference in Singapore in 2015.

Keen Team and Keen Security Lab

Grassi later joined Keen Team, which subsequently became Tencent's Keen Security Lab (KeenLab), working as a security researcher focused primarily on Android, iOS, macOS, and OS sandbox escapes. Keen Security Lab was among the most consistently successful teams competing in the Pwn2Own contest series during the mid-to-late 2010s, and Grassi was credited as a contributor on several of the team's results. He was one of the main contributors to Keen Team's Desktop Pwn2Own 2016 entry, which achieved a Safari browser exploit chained with a sandbox escape to root privileges, part of the effort that earned the team the overall "Master of Pwn" title at that event. At Mobile Pwn2Own in Tokyo in 2016, he contributed to work targeting iOS that helped the team win the "Mobile Master of Pwn" title.

Pwn2Own 2017 and baseband research

At Desktop Pwn2Own 2017, Grassi was credited with a VMware guest-to-host escape, exploiting the hypervisor's virtual machine isolation boundary. At Mobile Pwn2Own 2017, he was credited with a baseband remote code execution exploit and a WiFi-based exploit against iOS, contributing to the Keen Lab team's third "Master of Pwn" title. Baseband exploitation, targeting the low-level cellular modem firmware that runs semi-independently of a phone's main operating system, was and remains a comparatively under-researched and difficult area of mobile security, and Grassi's public talks (including presentations on baseband exploitation at Black Hat USA in 2018 and on 5G baseband remote code execution at Black Hat USA in 2021) contributed to broader industry understanding of this attack surface.

Other credited vulnerability research

Grassi has been publicly credited in vendor security bulletins for reporting vulnerabilities, including Android kernel and privilege-escalation issues acknowledged in Android Security Bulletins (for example bulletins referencing CVE-2016-2443 and CVE-2016-6828, credited to Grassi via Keen Lab of Tencent), as well as earlier reported issues in Blackphone's PrivatOS. He has also been recognized on the Honor Roll of FireEye's FLARE reverse-engineering challenge series.

Speaking and public research

Grassi has spoken at numerous international security conferences, including Black Hat USA, Black Hat Asia, DEF CON, CanSecWest, Infiltrate, ZeroNights, Codegate, Hack In The Box (HITB), ShakaCon, OffensiveCon, and the Mobile Security Conference (MOSEC). His talks have covered topics such as Android privilege escalation, smartphone baseband exploitation, and modern mobile OS sandbox and platform security.

Legacy and significance

Grassi's career illustrates the professionalization of mobile and platform exploitation research through public competitions such as Pwn2Own, where results are independently verified by contest organizers (Trend Micro's Zero Day Initiative) and vendors before public credit and payout. His work across Android, iOS, macOS, VMware, and cellular baseband firmware reflects the breadth of technical skill increasingly required of top-tier offensive security researchers, and his contributions as part of Tencent's Keen Security Lab are part of the historical record of that lab's multi-year run of Pwn2Own successes.

Timeline

• 2015-10Presented "Current State of Privilege Escalation on Android" at HITB GSEC Singapore while a member of the NowSecure R&D team.
• 2016As part of Keen Team, credited with an Android kernel/privilege-escalation vulnerability referenced in Android Security Bulletins (including issues tied to CVE-2016-2443 and CVE-2016-6828).
• 2016-03Contributed to Keen Team's Desktop Pwn2Own entry achieving a Safari exploit chained with a sandbox escape to root, part of the team's overall Master of Pwn win.
• 2016-10Contributed to Keen Team's iOS work at Mobile Pwn2Own in Tokyo, helping the team win the Mobile Master of Pwn title.
• 2017Credited with a VMware guest-to-host hypervisor escape at Desktop Pwn2Own 2017.
• 2017Credited with a baseband remote code execution exploit and a WiFi-based iOS exploit at Mobile Pwn2Own 2017, contributing to Keen Lab's third Master of Pwn title.
• 2018-08Presented "Exploitation of a Modern Smartphone Baseband" at Black Hat USA 2018 as a Senior Security Researcher at Tencent Keen Security Lab.
• 2021-08Presented "Over the Air Baseband Exploit: Gaining Remote Code Execution on 5G Smartphones" at Black Hat USA 2021.