SHAHEENBASHEER
13+ years of building and breaking mobile apps. I find the attack vectors, prove them with working PoCs, then ship the fix inside the product — hardening enterprise, defence-grade and FDA/HIPAA-regulated apps so that secure is the default.
Between dev, offence & research
OFFENSIVE MOBILE
Pentesting and vuln research on iOS/Android security libraries incl. BlackBerry Dynamics — bypasses demonstrated with live PoCs, then mitigated.
REVERSE ENGINEERING
Frida, IDA Pro and Hopper; Mach-O analysis and ARM64 assembly to hook, patch and defeat client-side controls.
SECURE BY DESIGN
Jailbreak/root detection, runtime integrity, anti-tamper, anti-debug, dylib-injection prevention, device attestation, biometric auth flows.
PLATFORM DEPTH
Secure Enclave, keychain & data-protection classes, FS encryption and key derivation, code signing, entitlements, ASLR / PAC / PPL.
SECURE PIPELINES
Two-phase secure build systems, signing-key management and mobile CI/CD across Jenkins, CircleCI, CodeMagic and Firebase.
COMPLIANCE
FIPS 140-3, NIST 800-53, HIPAA & FDA, GDPR and Privacy by Design, Secure SDLC.
Where I've shipped & broken things
BLACKBERRY
SEP 2023 – DEC 2023 · CANADA- Pentested iOS/Android security libraries (incl. BB Dynamics); built bypass PoCs with Frida and runtime hooking, then delivered mitigations with a live demo to engineering.
- Developed dylib-injection prevention, library whitelisting and Mach-O load restriction — shipped in libraries used across Fortune 500 enterprises.
- Validated jailbreak/root detection against real attacker tooling; rooted iOS 15+ across device models and built a repeatable lab via DFU, restore mode and SHSH blob downgrades.
MYANT
JUN 2023 – OCT 2024 · CANADA- Found a critical bootloader vulnerability in firmware signing on nRF51-based medical devices, plus misconfigurations in the companion iOS and Android apps — strengthening FDA/HIPAA posture.
- Owned mobile DevOps (App Store Connect, TestFlight, Play Console, Firebase): CI/CD, automated certificate & provisioning management, secured signing keys across environments.
DARKMATTER LLC
DEC 2020 – FEB 2021 · ABU DHABI- Built an advanced iOS security library from threat models: __TEXT / __DATA segment protection and custom Mach-O handling; proprietary "try4" techniques adopted company-wide.
- Engineered a two-phase secure build system; benchmarked 90+ SAST tools, resolved 400+ issues in two weeks to a zero-issue baseline. PoCs validated by TVLabs.
- Authored a 200-page iOS security guide adopted by 200+ engineers; led delivery across UX, QA and backend.
SAP LABS
DEC 2019 – MAY 2020 · INDIA- Built CrossTab for the SAP BI mobile app (millions of users) — lag-free scrolling over 10M+ rows, with integrated data-protection controls.
SAP GLOBAL DELIVERY / EXTENTIA
JUN 2014 – JUN 2015 · INDIA- Led end-to-end development of Lufthansa Flight Buddy for pilots and crew; continuous delivery with Jenkins, Maven and Perforce.
M-SQUARED SOFTWARE
DEC 2011 – DEC 2013 · INDIA- Led Olympus Dictation for iPhone with low-level encrypted audio (DSS/DS2) and real-time voice detection.
- Built HIPAA-compliant medical apps (TCAS, SmartDM) protecting patient health data.
Selected security work
BB DYNAMICS: JAILBREAK, ROOT & TAMPER DETECTION
Attacked and hardened jailbreak/root detection, runtime integrity and anti-tamper for enterprise apps — fewer false negatives, no performance hit.
TRY4 RUNTIME VM INTEGRITY CHECKER
Embeds __TEXT segment hashes at compile time and validates runtime memory to catch debuggers, dylib injection, method hooking and control-flow tampering.
PRE-MAIN SECURITY INIT
Anti-debug and integrity checks before main() via constructor attributes and __mod_init_func, relocated into a custom Mach-O section with jumps to resist patching.
$ otool -l Target.app/Target | grep -A3 __TEXT segname __TEXT vmaddr 0x0000000100000000 vmsize 0x0000000000124000 $ ./try4 --verify --segment __TEXT --segment __DATA [*] compile-time hash a3f1…9c2e [*] runtime hash a3f1…9c2e MATCH [*] ptrace / sysctl no debugger attached [*] dyld image list FridaGadget.dylib detected → TERMINATE // tamper attempt blocked before main()_
Research & writing
NEURO-SYMBOLIC RL FOR ADAPTIVE CYBER DECEPTION
Co-authored. Combines symbolic reasoning with reinforcement learning to build high-fidelity deception environments that hold up against active attackers.
iOS HARDENING: RUNTIME VM INTEGRITY CHECK
Reviewed and validated by a leading OWASP researcher and creator of DVIA; covers runtime protection and integrity verification on iOS.
ABALONE iOS SECURITY GUIDE
Current and emerging mobile threats with mitigations — adopted company-wide as the primary secure-development reference.
Toolkit
REVERSE ENGINEERING
SECURITY TESTING
AUTH, CRYPTO & STORAGE
iOS INTERNALS
LANGUAGES
BUILD & DEVOPS
CONESTOGA COLLEGE
Graduate Certificate, Mobile Solutions Development (2-yr) · 3.83 GPA · Co-op Student of the Year
UNIVERSITY OF KERALA
BTech, Computer Science · Merit
OFF THE CLOCK
Hardware hacking with Flipper Zero (BLE, Sub-GHz, IR, RFID, NFC) · iOS & Mach-O hardening experiments · designing and 3D-printing research tools on a Bambu Lab P1S · regular CTFs with multiple podium finishes.