Natalie Silvanovich

Natalie Silvanovich is a Canadian security researcher who has worked since the mid-2010s on Google's Project Zero, the company's team dedicated to finding zero-day vulnerabilities in widely used software. Before joining Google, she began her career in security at BlackBerry, where she worked hands-on with mobile device internals and eventually became team lead of BlackBerry's Security Research Group, focusing on finding security issues in mobile software.

Silvanovich later moved to Google, first working in mobile security on the company's Android Security Team before joining Project Zero. Her early public research concentrated on browser and script-engine security, including a string of talks on Adobe Flash and ActionScript vulnerabilities and on bugs arising from ECMAScript and other script-engine standards, as well as a 2018 Black Hat talk on WebAssembly security.

Zero-Click Messaging and Video-Calling Research

Silvanovich became particularly known for research into 'interaction-less' or 'zero-click' vulnerabilities — bugs that can be triggered on a target device without any action by the victim. In August 2018 she disclosed critical vulnerabilities in several video-calling implementations, including WebRTC, PJSIP (used by WhatsApp), and Apple's proprietary FaceTime calling library, showing that a malicious incoming call could crash the target application or trigger a heap overflow without any interaction from the recipient.

The 2019 iMessage Research

Her most widely cited work is a large collaborative project with fellow Project Zero researcher Samuel Groß examining the 'fully remote attack surface' of the iPhone, covering SMS, MMS, visual voicemail, email, and iMessage. Published on the Project Zero blog in August 2019, the research found that iMessage's deserialization handling created an unexpectedly large attack surface. The project identified ten vulnerabilities across these remote messaging surfaces, including six affecting iMessage; Apple patched five of the six in the iOS 12.4 update released July 22, 2019. Several of these bugs could allow remote code execution on a target iPhone without the victim needing to do anything beyond receiving a message.

Later Research and Legacy

Silvanovich continued this line of work in subsequent years, presenting on remote eavesdropping vulnerabilities in mobile messaging and calling applications at Black Hat USA 2021, and researching mobile baseband security, including a 2023 REcon talk on hacking the Samsung 'Shannon' Exynos modem. Her work on interaction-less vulnerabilities in consumer messaging platforms has become a reference point in mobile and messaging-app security research.

Timeline

• 2015Presents 'Attacking ECMAScript Engines with Redefinition' at Black Hat USA as a Google Project Zero researcher.
• 2018-08Discloses critical interaction-less vulnerabilities in WebRTC, PJSIP (WhatsApp), and FaceTime.
• 2019-07-22Apple ships iOS 12.4, patching five of six interactionless iMessage vulnerabilities found by Silvanovich and Samuel Groß.
• 2019-08-07Publishes Project Zero blog post 'The Fully Remote Attack Surface of the iPhone.'
• 2019-08Presents 'Look, No Hands! The Remote, Interaction-less Attack Surface of the iPhone' at Black Hat USA.
• 2021-08Presents 'Can You Hear Me Now?' at Black Hat USA, on remote eavesdropping vulnerabilities in Signal, Google Duo, and other apps.
• 2023Presents 'How to Hack Shannon Baseband (from a Phone)' at REcon.