About
Hi frens, my name is Zach. A lot of people also know me as Mox!
By day I'm a Senior Tactical Response Analyst at Huntress, which mostly means jumping in when something has gone wrong and figuring out what happened. fieldnotes is where the rest of my curiosity goes: taking things apart to see how they actually work, and writing down what I find.
Most of what's here started as notes for myself, written for the version of me who was stuck on the same problem six months earlier and would have loved a clear explanation. That covers mobile and API security, reverse engineering, radios and old hardware, and whatever Linux is doing to me this week. If it's useful to you too, even better.
The posts tagged findings are real vulnerability research, reported privately to the people who could fix it before a word went public. A few principles I hold myself to:
Fixing beats flexing. The goal is getting the bug patched, not scoring points. Writeups here explain what went wrong and why it matters, and they stop short of handing anyone a working exploit kit. Not to mention doing that would make my day job busy lol.
Privacy is engineered, not labeled. A lot of what I poke at comes down to one question: does the system actually protect the people using it, or does it only say it does?
Show your work. The writeups I learned the most from were the ones I could follow from start to finish, so that's what I try to write.
These are notes, not gospel. If I got something wrong, I want to hear about it.
Everything here is personal work, done on my own time. Opinions are mine and don't represent Huntress.
Get in touch
I'm always happy to talk shop. The best way to reach me is boop@fieldnotes.wtf, and you can find my code on GitHub.
Reporting a vulnerability
If you've found a security issue in something I run or built, this site included, please email security@fieldnotes.wtf instead of opening a public issue. The details live in security.txt. My PGP key is here if you'd like to encrypt.
If you work on a product I've written about and want to talk about a post, that address works too.
Much love, <3
Publications
Anna Pham and Zach Rogers