Dan Underwood

Dan Underwood

@underwood.digital

Security Engineering @ Apple, Ex-UK Gov The intersection of technology (device and national security), and liberal arts (public policy)

259 followers340 following31 posts

Dan Underwood
@underwood.digital

"Across all three requirements — semantic authenticity, resilience to compromise, and privacy preservation — we believe that Apple Reference Image sets a new standard for security in the industry." security.apple.com/blog/apple...

security.apple.comApple Reference Image: A New Approach for Verified Photography - Apple Security ResearchIntroducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee that a reference image is what it claims to be: a real photograph, captured by a real sensor in an iPhone camera, at a specific period in time.
Dan Underwood
@underwood.digital

I'm hiring for Apple's Secure Design team here in Cupertino - come join us in our mission in securing the features that Apple ships to its customers (such as Siri AI and encrypted RCS) and partner with some of the most talented people in the industry: jobs.apple.com/en-us/details/...

jobs.apple.comSecure Design Engineer, SEAR - Jobs - Careers at AppleApply for a Secure Design Engineer, SEAR job at Apple. Read about the role and find out if it’s right for you.
Dan Underwood
@underwood.digital

Later today at 3pm in Cupertino we have our online Privacy & Security Group Lab! Join and you'll be able to ask us your questions around all of the announcements at #WWDC26 and how you can protect your users. developer.apple.com/videos/pl...

developer.apple.comPrivacy and Security Group Lab - WWDC26 - Videos - Apple DeveloperJoin us online for a deep dive into WWDC26 with Apple engineers and designers to ask questions, get advice, and follow the discussion...
Dan Underwood
@underwood.digital

Agentic tools and features introduce new categories of security risks and vulnerabilities. My team, and one of our partner teams, has put together this superb #WWDC26 session to help developers mitigate these risks - using what we learned while securing Siri AI developer.apple.com/videos/pl...

developer.apple.comSecure your app: mitigate risks to agentic features - WWDC26 - Videos - Apple DeveloperExplore how to evaluate threats from indirect prompt injection, such as data exfiltration and unintended actions. Discover system...
Dan Underwood
@underwood.digital

"Now, we are collaborating with Google and NVIDIA to run new Apple Intelligence workloads on Google Cloud, extending our industry-leading PCC privacy commitments to third-party data centers for the first time." #WWDC26 security.apple.com/blog/expan...

security.apple.comExpanding Private Cloud Compute - Apple Security ResearchAlongside the next generation of Apple Intelligence, today we’re expanding Private Cloud Compute (PCC) beyond Apple’s data centers. When Apple introduced Private Cloud Compute in 2024, we defined a new frontier for private AI inference, extending the security and privacy of Apple devices into the cloud for those AI workloads more complex than on-device models can handle. Now, we are collaborating with Google and NVIDIA to run new Apple Intelligence workloads on Google Cloud Platform, extending our industry-leading PCC privacy commitments to third-party data centers for the first time.
Dan Underwood
@underwood.digital

Incredibly proud to have been part of this effort and collaboration to enable end-to-end encrypted messaging over RCS for users across the world in iOS 26.5. iMessage continues to offer the best security available to the most users at scale. www.apple.com/newsroom/2026/0...

apple.comEnd-to-end encrypted RCS messaging begins rolling out today in betaApple and Google collaborate with the GSMA to roll out end-to-end encrypted RCS messaging in beta, enhancing cross-platform communication security.
Dan Underwood
@underwood.digital

In case you missed it - here's six(!) hours of content from my incredible friends and colleagues today on protecting your apps from memory safety vulnerabilities. It was great to meet up with developers and talk about protecting users! www.youtube.com/live/UZeSyodA...

youtube.comFortify your app: Essential strategies to strengthen security | Meet with AppleLearn to bolster your app’s security and help protect user data in this online activity streaming from the Apple Developer Center Cupertino. Whether you’re hardening an existing app or starting a new project, you’ll learn directly from Apple engineers about how to reinforce your app from the ground up. Learn about the security challenges facing modern apps, and explore a comprehensive suite of tools and technologies designed to help safeguard user data. Discover how you can protect your C and C++ codebases with powerful features like Memory Integrity Enforcement, pointer authentication, and memory bounds safety. Find out how to adopt Swift for your most security-sensitive components, taking advantage of its inherent safety and modern abstractions to write secure, high-performance code. And get guidance on building a clear security roadmap for new and existing projects, from high-level strategy to hands-on implementation. Presentations: Enhance app security with Xcode Protect your app from memory safety vulnerabilities Implement performance-tuned Memory Integrity Enforcement Control flow integrity with Pointer Authentication Eliminate bounds safety vulnerabilities in C and C++ Find security bugs in Swift code with Sanitizers Write a security-sensitive component in Swift To explore additional sessions, appointments, and workshops, view the full schedule of Meet with Apple activities worldwide. https://apple.co/Meet-with-Apple More Apple Developer resources: Video sessions: https://apple.co/VideoSessions Documentation: https://apple.co/DeveloperDocs Forums: https://apple.co/DeveloperForums App: https://apple.co/DeveloperApp
Dan Underwood
@underwood.digital

"Following rigorous security testing and extensive evaluation by the German government, iPhone and iPad become the first consumer devices approved for use with classified information in NATO restricted environments" www.apple.com/newsroom/2026/0...

apple.comiPhone and iPad approved to handle classified NATO informationToday, Apple announced iPhone and iPad are the first and only consumer devices in compliance with information assurance requirements of NATO nations.
Dan Underwood
@underwood.digital

My peer team at Apple is hiring! If you're interested in securing cutting edge hardware and collaborating with incredibly skilled engineering teams to deliver great products that people love using then this role may be a good fit. jobs.apple.com/en-us/details/...

jobs.apple.comSecurity Reviewer, Secure Design Platform - Jobs - Careers at AppleApply for a Security Reviewer, Secure Design Platform job at Apple. Read about the role and find out if it’s right for you.
Dan Underwood
@underwood.digital

We're updating our bounty program with the top award now set at $2 million for zero-click remote exploit chains. In addition - there are increased awards for proximate wireless attacks, WebKit, and Gatekeeper security.apple.com/blog/apple...

security.apple.comA major evolution of Apple Security Bounty, with the industry's top awards for the most advanced research - Apple Security ResearchToday we’re announcing the next major chapter for Apple Security Bounty, featuring the industry’s highest rewards — up to $2 million and a maximum payout in excess of $5 million — expanded research categories, and a flag system for researchers to objectively demonstrate vulnerabilities and obtain accelerated awards.

Dan Underwood reposted

Avery Vine
@averyvine.com

Did you know that more than half of all iPhones around the world are being used in languages other than English? My team helps make that possible, and we're hiring! Our work is very dynamic and spans the entire localization pipeline, from internal tools to all our OSes. jobs.apple.com/en-us/detail

jobs.apple.comLocalization Software Engineer - Jobs - Careers at AppleApply for a Localization Software Engineer job at Apple. Read about the role and find out if it’s right for you.
Dan Underwood
@underwood.digital

iPhone 17, iPhone Air, and iPhone 17 Pro all support Memory Integrity Enforcement bringing a significant advancement in memory safety - including to developers as part of the Enhanced Security feature announced earlier this year at WWDC

security.apple.comBlog - Memory Integrity Enforcement: A complete vision for memory safety in Apple devices - Apple Security ResearchMemory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices — without compromising our best-in-class device performance. We believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems.
Dan Underwood
@underwood.digital

With iOS 26.0, we're introducing support for Wi-Fi Aware via AccessorySetupKit - this makes it easy for users to connect to and set up your accessories securely, and build peer to peer connectivity experiences with DeviceDiscoveryUI! https://developer.apple.com/videos/play/wwdc2025/228 #wwdc25

developer.apple.comSupercharge device connectivity with Wi-Fi Aware - WWDC25 - Videos - Apple DeveloperLearn how to create peer-to-peer network connections with Wi-Fi Aware. We'll also cover how to share videos in real time, transfer large...
Dan Underwood
@underwood.digital

We've launched support for developers to build their own security hardened extensions, distribute apps using Pointer Authentication, and access a range of other security mitigations: https://developer.apple.com/documentation/xcode/enabling-enhanced-security-for-your-app #wwdc25

developer.apple.comEnabling enhanced security for your app | Apple Developer DocumentationDetect out-of-bounds memory access, use of freed memory, and other potential vulnerabilities.
Dan Underwood
@underwood.digital

This is a hugely important update for CryptoKit - make sure you check out the session to learn more about what you do (and don’t) need to do as an App Developer to protect against quantum computers.

Frederic Jacobs@fredericjacobs.com

🆕⚛️🔐 Starting with iOS 26, CryptoKit gets support for quantum-secure cryptography with algorithms such as ML-KEM, ML-DSA and HPKE with X-Wing: developer.apple.com/documentatio...

developer.apple.comApple CryptoKit | Apple Developer DocumentationPerform cryptographic operations securely and efficiently.

Dan Underwood reposted

Ricky Mondello
@rmondello.com

New post on the Swift blog: we re-wrote the Password Monitoring service for Apple Passwords in Swift and saw huge improvements in memory use and throughput. Some of the details here still blow my mind; it's a fun read. https://www.swift.org/blog/swift-at-apple-migrating-the-password-monitoring-servi

swift.orgSwift at Apple: migrating the Password Monitoring service from JavaSwift is heavily used in production for building cloud services at Apple, with incredible results. Last year, the Password Monitoring service was rewritten in Swift, handling multiple billions of requests per day from devices all over the world. In comparison with the previous Java service, the updated backend delivers a 40% increase in performance, along with improved scalability, security, and availability.

Dan Underwood reposted

MacRumors.com
@macrumors.bsky.social

Apple's Mac Site Features Fictional 'Lumon Terminal Pro'

macrumors.comApple's Mac Site Features Fictional 'Lumon Terminal Pro'Apple is going all out with promotions for the popular Severance Apple TV+ show today, and as of right now, you'll find a new "Lumon Terminal Pro" listed on Apple's Mac site. The Lumon Terminal Pro is designed to look similar to the machines that Severance employees like Mark S. and Helly R. use for macrodata refinement. The Terminal features a blue keyboard, a small display with wide bezels, and a trackball for navigation purposes. Unfortunately, you can't actually buy a Lumon Terminal Pro, though it would undoubtedly sell well to Severance fans. Apple's page links to the company's actual Macs, and to a behind the scenes editing video that Apple shared this morning. The second season of Severance wrapped up last Thursday, so the entire series is now available to stream on ‌Apple TV‌+. Apple renewed Severance for season three, and Severance director Ben Stiller has promised that it won't take another three years for us to get another season.Tag: Apple TV Plus This article, "Apple's Mac Site Features Fictional 'Lumon Terminal Pro'" first appeared on MacRumors.com Discuss this article in our forums
Dan Underwood
@underwood.digital

Do you want to work on designing the security of the latest Apple products and features that will be used by over a billion users? Our team is hiring for engineers to help provide security leadership! https://jobs.apple.com/en-us/details/200582891/security-reviewer-secure-design

jobs.apple.comSecurity Reviewer, Secure Design - Careers at AppleApply for a Security Reviewer, Secure Design job at Apple. Read about the role and find out if it’s right for you.
Dan Underwood
@underwood.digital

Despite increasing legislation, and a low minimum bar for compliance, it’s incredible (albeit not surprising) how many device manufacturers and software vendors still struggle to provide that bare minimum to allow researchers to report security vulnerabilities

David Rogers@drogersuk.bsky.social

Here's our annual report into the state of vulnerability disclosure in the IoT space - a good window into how poor product security is overall:

You are up to date.