Gabriele

Digregorio

also known as Io_no

I'm a Computer Engineer with a strong interest in cybersecurity and a PhD candidate at Politecnico di Milano. Currently, I'm also a Security Research Intern at IBM Research GmbH.
I play with the Tower of Hanoi and mhackeroni CTF teams, working on binary/rev categories and supporting misc/ML when needed. I am also a maintainer of the libdebug project.

Want to get in touch? Email me at gabriele.digregorio[at]polimi.it

CTFs

As a Player

Member of mhackeroni since 2022.
Winners of Hack-A-Sat 4, the world's first CTF in space by the Air Force Research Laboratory.
Participated in DEF CON 31, 32, and 33 Finals.

Visit mhackeroni

Member of Tower of Hanoi since 2021.
Team treasurer since 2024.

Visit Tower of Hanoi

As an Organizer

With mhackeroni, co-organizer of Ctrl+Space CTF with challenges running on satellites orbiting Earth, in collaboration with ESA and D-Orbit.
The finals were hosted in person at ESA's ESTEC during the 3S Conference.

Visit Ctrl+Space

With Tower of Hanoi, co-organizer of ToH CTF 2025.

Visit ToH CTF

libdebug

Maintainer of libdebug, an open-source Python library to debug binary executables, your own way.

Visit libdebug

Bug Hunting

So far, I've found vulnerabilities in Keras, Google Messages (on Wear OS), Android, skops, and Redis, which I reported through responsible disclosure to the respective vendors. Some were severe enough to earn bounties and get tracked as public CVE advisories.

My findings have also been picked up by media such as Forbes, Android Authority, and Android Police.

Curious about my bug hunting? I've published some of the reports I can ethically make public on GitHub.

View Bug Reports

Writeups

Vulnerability

CVE-2025-12080 - Intent Abuse in Google Messages for Wear OS for Silent Message Sending

23 October 2025

CVE-2025-12080, which I discovered in March 2025 and for which I was later awarded a bounty by the Google Mobile VRP.

Vulnerability CTF

CVE-2025-9905 - Arbitrary Code Execution on Keras (once again) via Legacy Files

23 October 2025

CVE-2025-9905, which I discovered in June 2025. Exploiting this vulnerability was also the intended solution to the Intended Behaviour challenge I authored for ToH CTF 2025.

Vulnerability CTF

CVE-2025-1550 - Arbitrary Code Execution on Keras

20 July 2025

CVE-2025-1550, which I discovered at the end of 2024 and for which I was later awarded a bounty by the Google OSS VRP. Exploiting this vulnerability was also the intended solution to the Unintended Behaviour challenge I authored for ToH CTF 2025.

Vulnerability

Don't Trust the Open Link Button in Android Notifications

11 June 2025

Certain characters can cause a mismatch between the link shown in an Android notification and the one opened via the 'Open link' button, potentially tricking users into phishing sites or triggering deep links.

CTF