Research write-ups and notes from engagements
Written for people who want to reproduce the work: enough detail to do it, including what did not work.
An attacker's playbook built from three recent papers and a Proxmark3, covering keyspace-reduction and relay attacks against MIFARE Ultralight C/AES, NTAG DNA…
How glitching attacks on the Renesas RH850 automotive microcontroller have evolved, from early DIY voltage-glitching rigs to validating the ID-code debug bypass…
A survey of attacks that break STM32 readout protection (RDP), from chip decapsulation and UV light to cold-boot and CPU state tracing,…
A low-cost fault-injection technique that uses a roughly $10 Raspberry Pi Pico to mock bus traffic and glitch microcontrollers, as a cheap…
A roundup of recent vulnerabilities across Unitree robots, chaining BLE Wi-Fi configuration flaws, firmware-update weaknesses and DDS inter-process communication issues into remote…
Notes on the AirSnitch paper (NDSS 2026) showing that Wi-Fi client isolation is not properly standardized and can be bypassed, with an…
A walkthrough of the BLERP research (NDSS 2026) on Bluetooth Low Energy re-pairing: six flaws, four of them new, that let an…
A quick look at PCB Tracer, a tool for mapping pins, power rails and components over a high-resolution board photo for reverse…
A short pointer to a browser-based 3D hardware simulator for prototyping simple electronics (LED projects for now), handy while Arduino's future looks…
![[CVE-2026-0714] TPM-sniffing LUKS Keys on an Embedded Device](https://penthertz.com/downloads/ms_3405-1280x900.jpg)
How LUKS disk-encryption keys can be sniffed from the SPI bus between a CPU and its TPM on an embedded Linux device…
Two years ago, communications in the telecommunication industry have sparked significant concern regarding the ease with which Open RAN could potentially be…
Our LoRaWAN security series has so far outlined multiple security flaws, vulnerability issues, and entry vectors that attackers have been known to…
5G installations are becoming more present in our lives and will introduce significant changes regarding the traffic demand growing with time. The…
Since its disclosure on Dec. 9, a vast number of articles have been written on the remote code execution (RCE) vulnerability in…
The first line of defense for most homes is a version of the classic lock-and-key system used to secure all possible passages…
LoRaWAN technology allows organizations to deploy the internet of things solutions at a much lower cost than existing cellular infrastructure solutions. Because…
The deployment of internet of things (IoT) devices allows large-scale operations and wide-ranging services in smart cities, industrial facilities, and connected agricultural…
Embedded (E)GPRS/EDGE, 3G, 4G, and 5G modules are commonly used for a lot of purposes. Indeed, we can find them in connected…
The beginning of this year is particularly tough for everyone socially and economically. As a circumstance, many habits changed, and businesses moved…
With packet service, mobile user equipment speaks IP, and that opens a path from a plain phone into operator networks. This walks…
When assessing LoRa devices' security, like any other RF technology, we must deal with unknown radio parameters and data/payloads we need to…
How to get onto the endpoints behind M2M mobile devices when the usual paths are closed: attracting the target over the air…