Maxwell Bland's Home Page (SDF Edition)
Publications - Github - Talks
About:
Systems and security researcher at Motorola (Lenovo), under the excellent guidance of Andrew Wheeler. Working on AOSP improvements, GrapheneOS bringup, as well as many other systems, code reviews, etc..
Education:
Doctorate at UIUC under the excellent guidance of Kirill Levchenko. (See privilege escalation / APT on a 737 Communication Management Unit, work on breaking redactions in TS, Epstien, etc., docs.)
Master's and Bachelor's at UCSD where I worked with the awesome Aaron Schulman. (See work on detecting credit card skimming devices and some exploits for blood gas analyzers.)
Research Areas:
Hardware and Software Protection Mechanisms
Empirical Security and Information Measurement
Static and Dynamic Program Analysis
Emails:
mbland@motorola.com
bland@sdf.org
Blog:
0: Reflections on Library Identification for Compiled and Minified APKs
Other:
If you are here wondering about a status update to the 2025 LSS Talk, I am still working on this and other efforts to solve exploits for good, but there's a big gap and a lot of work to be done to prevent everything from hardware glitching attacks to memory side channels, to RATs, and more.
Check out the KSPP for Linux-side and LLVM dev meeting for updates on this that are not my own. Recently, LKRG 1.0 was released as an experimental stopgap* for systems limited by institutional or (pseudo-ish-)monopolistic restrictions around OS customization, but has some key limitations. More direct protections exist, such as the clear implementation of ARM MTE application to cachelines available in GrapheneOS's hardened malloc implementation, which is also worth checking out and experimenting with. There are also interesting research projects like DARPA's CHERI.
However, a lot of SW/HW work (and new discoveries!) remain and are necessary to make contemporary systems safe and private enough for general use. Please reach out if you are looking for ways to get involved.
*They are planning a "Pro" edition: this I suppose this will be OK as long as the project remains open source and makes money through licensing.
Some other random things I've ported from my UIUC site are under /media
age Public key:
age1tzp8ww74dtfxxwr0qd8f235jtlp8klps5cmty4tgauzgqzrhnd3q97tfcs
Opinions subject to change, and do not necessarily reflect those of my employers or coworkers, past or present.
Hosted by the The SDF Public Access UNIX System
Last updated: 05-16-2026 (Reason: my UIUC page finally expired!)