Vulnerability Research
In-depth research on a target you choose: protocol fuzzing, baseband analysis and CVE-grade findings, fully documented and disclosed the way you decide.
- You want depth on one target rather than breadth
- A protocol or component has never been properly studied
- You can fund weeks of work, not days
- You want to keep the tools afterwards
How it runs
We keep you informed throughout. Important findings are shared as soon as we have them.
Scoping
The target, the depth, how you want findings disclosed, and the stages, with a go / no-go decision between each.
Analysis
Reverse engineering and instrumentation until we understand the target well enough to attack it.
Attack
Fuzzing, protocol abuse, and exploit development when a finding justifies it.
Disclosure
A full write-up, the proof-of-concept tools, and coordinated disclosure or CVE publication, as you decide.
Deliverables
A report your engineers can act on, a summary your management can read, and everything needed to reproduce each finding.
- Technical write-up
- The research in enough detail to reproduce and to act on
- Proof-of-concept tooling
- Documented and yours to use; full ownership by agreement
- Disclosure support
- Coordinated with vendors or kept private, your call
- CVE publication
- Where the finding warrants it and you agree
| Target | What that involves |
|---|---|
| Baseband and modems | Firmware in phones, vehicles, routers and gateways |
| Proprietary radio | Undocumented protocols, reversed and attacked |
| Protocol stacks | Fuzzing harnesses driven from the radio side |
| Mobile core | Signalling, interfaces and subscriber-side exposure |
Frequently asked questions
Who owns the findings?
You control them. Findings about your product are your confidential information: you decide whether, how and when they are disclosed, and we will never disclose anything about your product without your written agreement. Penthertz only asks to be credited for the technical work, as is normal in the research community. The write-up and proof-of-concept tooling come with the right to use them for your own needs, while our tools and the generic techniques we develop, such as RF Swift, stay ours. If you need full ownership of what we develop for you, a transfer of rights can be agreed and priced in the proposal. If you want a coordinated disclosure with an affected vendor, we can run that process for you, from first contact to CVE. If you would rather keep the finding private, it stays private.
Can you guarantee a CVE?
No, and we are upfront about that from the start. Penthertz commits to the research effort, the time, the people and the method, not to a predetermined result, because whether a reported issue becomes a CVE depends on what actually exists in the target and on the vendor's response. We tell you honestly what we expect to find and report progress as we go, so there are no surprises. Our published work is mostly about the techniques used to find vulnerabilities rather than about specific vendors, alongside a few CVEs of our own; we sell the work and the rigour, never a guaranteed outcome.
Talk to us about your project
We scope the work in a first call, then send a fixed-price proposal. We can put a mutual NDA in place before discussing details.