// CVEs
CVSS 8.4
HIGH
Remote Code Execution / Arbitrary File Read / NTLM Hash Capture as SYSTEM
CVSS 7.8
HIGH
Dylib injection
- Discovered a dylib injection vulnerability in JetBrains Toolbox for macOS (< 1.28), leading to TCC permissions abuse. Write-up
// Publications
Behavioral Detection Using Apple Endpoint Security Framework
Authors: Dimitrie-Toma Furdui, Radu-Marian Portase, Andrei-Marius Muntea, Adrian-Viorel Coleșa
View Abstract:
Traditional endpoint security on macOS has relied on third-party kernel extensions, which Apple is increasingly restricting. Apple's Endpoint Security (ES) framework offers a supported alternative by providing user-space access to security-relevant events, such as process execution and file activity, and by allowing or denying certain operations. This paper assesses whether ES telemetry is sufficient for building an Endpoint Detection and Response (EDR) system. We introduce a prototype user-space EDR that correlates ES events into process and process-tree activity, applies a points-based heuristic engine, and supports translating a subset of macOS Sigma rules into ES-compatible detections. Detection coverage is evaluated using Atomic Red Team. With Sigma-derived rules and custom heuristics, the prototype detects 95.13 % of the evaluated macOS Atomic Red Team tests, demonstrating that ES can enable practical behavioral detection without third-party kernel extensions.// Certifications
- Mach Injection
- Dylib Injection
- XPC Exploitation
- Sandbox Escape
- Privilege Escalation
- TCC Bypass
- ARM64 Assembly
- Reverse Engineering
- Stack-Based Buffer Overflows
- Return-Oriented Programming (ROP)
- Format String Specifier Attacks
- ASLR/DEP Bypasses
- WinDbg
- IDA Pro
- x86 Assembly
- Active Directory Exploitation
- Antivirus Evasion
- Lateral Movement
- Process Injection
- SQL Server Exploitation
- AppLocker/CLM Bypass
- Network Penetration Testing
- Web Application Exploitation
- Active Directory Exploitation
- Privilege Escalation
- Web Application Exploitation
- Active Directory Security
- Privilege Escalation
- Pivoting & Tunneling
- Network Penetration Testing
- Digital Forensics
- IDS/IPS Usage
- Incident Handling
- Malware Analysis
- SOC Operations
- Elastic Stack
- Splunk
// Achievements
Member, > r0/dev/null CTF Team
1st place at World Wide CTF 2025, 3rd place at N0PSctf 2025 and D-CTF 2025. Focused on binary exploitation and reverse engineering challenges.
Co-organizer and Challenge Author, Null CTF 2025
Co-organized Null CTF 2025 with > r0/dev/null for 1000+ teams, authoring 7 challenges and running the infrastructure.
Co-organizer, IoT Hunt 2025
Co-organized IoT Hunt, a CTF-style treasure hunt at DefCamp 2025, where 100+ participants exploited real routers, smart cameras, lightbulbs and locks.
Captain, Technical University of Cluj-Napoca CTF Team (2023-2025)
Recruited and trained students for competitions, leading the team to 4th place at Hack The Box University CTF 2023 (300+ registered teams).
// Projects
Some projects are undergoing a major refactoring and will be publicly available on GitHub soon
MiniHV (Hypervisor (Intel VT-x))
ES-EDR-Behavior (macOS Behavioral EDR)
ES-EDR-Inject (macOS Process Injection-based EDR)
Ghost & Sorcery (Hack The Box Machine Author)
MiniOS (Operating System)
UBB Schedule (UBB University Timetable)
// Experience
Jun. 2021 - Present
- Developing the anti-exploit module across the kernel driver and user-mode filter, shipped in Bitdefender's consumer and GravityZone products.
- Refining antivirus detection capabilities, contributing to Bitdefender's perfect 15/15 score at AV-Comparatives ATP 2025.
- Built a new ROP chain detection and improved 5+ existing privilege escalation detections against new techniques.
- Authored 30+ n-day exploit PoCs from minimal public details, including Windows DWM and Microsoft Exchange, to validate EDR detections.
C++
x86/ARM Assembly
Kernel Drivers
Malware Analysis
Oct. 2026 - Present
- Teaching Penetration Testing to 50+ students, addressing web exploitation, buffer overflows and privilege escalation.
- Co-authoring a penetration testing book for a full course redesign, modernizing labs and adding Active Directory and Entra ID modules.
Penetration Testing
Curriculum Design
Mar. 2026 - Present
- Co-organized a CTF for 100+ students within the Google.org Cybersecurity Seminars initiative.
CTF Challenge Design
Oct. 2025 - Feb. 2026
- Taught x86 Assembly fundamentals and CPU internals to 80+ undergraduate students, covering memory management, register manipulation, and instruction set architecture.
- Designed and graded technical assignments requiring students to identify code issues and implement algorithms in x86 assembly.
x86 Assembly
CPU Internals
Sep. 2020 - Sep. 2022
Penetration Tester, Software Developer @ Institute of Advanced Research in Artificial Intelligence (IARAI)
- Introduced security reviews into the release procedures, catching 10+ issues before production deployment.
- Built and maintained the organization's competition website (10,000+ participants), test infrastructure, and internal DevOps tooling.
- Co-organized 4 NeurIPS competitions (Traffic4Cast, Weather4Cast, Science4Cast, Landslide4Sense) with 7000+ submissions.
White-Box Security Assessments
PHP
React
Nov. 2020 - Jul. 2023
- Co-founded a startup building an event management platform for organizers, with event discovery for participants.
- Built the iOS, Android and web apps and shipped them to the App Store and Google Play.
- Secured the platform through in-house penetration testing before launch.
White-Box Pentesting
Swift
Kotlin
Flutter
Next.js
// Education
2025 - Present
- Research topic: Hypervisor-Based Methods for Detecting Exploits
Hypervisor Development
Binary Exploitation
Malware Analysis
2023 - 2025
Windows Driver Development
OS Development
Hypervisor Development
Malware Analysis
Forensic Analysis and Incident Response
Penetration Testing
Network Security
2020 - 2023
Operating Systems
Cybersecurity
x86 Assembly