Publications

RF Swift: a swifty toolbox for all wireless assessments

Spectrum 2024

Slides

Car Hacking: With and Without Wires for Tires

PraSec

Slides

Intercepting 2G Traffic on Windows with RF Swift

YouTube Channel

Connected cars: scary RF signals & possible RCEs

WarCon 2024

Slides (later)

Automotive Security

WarCon 2024

Slides

Link - slide 7

Link - slide 9

RF swift: a swifty tool for RF security assessments (

SSTIC 2024 - Rumps

Link

Automotive scary signals and potential RCE

DEFCON Paris

Slides

Shrinking Giants with HAROGIC: Testing the Latest Compact Spectrum Analyzers on a Budget!

YouTube channel

Attacking IoT Devices through 5G interface

PraSec 2023

Slides

Spectran V6 RTSA 2000X (1st review): the good, the bad and the ugly

YouTube channel

5G Attacks on IoT

ESIEA Secure Edition

Slides

Unlocking THE wideband on bladeRF 2.0<

YouTube channel

Flipper Zero: Want some good news?

YouTube channel

Flipper Zero: is this for you? Follow our 1st tests!

YouTube channel

RF Signal Hunting with Machine and Deep Learning

WarCon 2022 & Pass The Salt 2022

Slides

The Jupyter Notebook

Intruding 5G SA core networks from outside and inside

GSMA FASG#22

Slides

Exploitation Log4shell on car's charging stations

Penthertz' YouTube channel

A powerful Red Team & Pentest ToolBox with the GPD Pocket 3 laptop

Penthertz' YouTube channel

LoRaWAN's Protocol Stacks: The Forgotten Targets at Risk

Trend Micro's blog

Summary

Complete article

Examining Log4j Vulnerabilities in Connected Cars and Charging Stations

Trend Micro Blog

Article

5G Core SA Network intrusions

Penthertz' YouTube channel

Bug hunting in 5G-NR devices and networks

No Hat 2021

Slides

RF Bugs and their detection

GS Days 2021

Slides

Forced Entry: A Security Test for Automatic Garage Doors

Trend Micro Blog

Article

Detailled paper

RFID secrets with ICopy-X: iClass SE, secret of tags, teardown and more

Penthertz YouTube Channel

Hack RFID fast with ICopy-X during Red Team engagments

Penthertz YouTube Channel

Tackle rolling code with PandwaRF

Penthertz YouTube Channel

V2RF - Assessing car's RF communications

ASRG Webinar

RollD.O.R Attacks - Getting permanent accesses in garages

Penthertz YouTube Channel

Protecting LoRaWAN Hardware from Attacks in the Wild

Trend Micro blog

Article

Detailled paper

Gauging LoRaWAN Communication Security with LoraPWN

Trend Micro Blog

Article

Detailled paper

LoRaPWNing: Practical Radio Attacks on LoRaWAN

The Things Conference

Slides

Low Powered but High Risk: Evaluating Possible Attacks on LoRaWAN Devices

Trend Micro Blog

Article

Detailled paper

Deep dive into LoRa(WAN) RF and Hardware Security

OWASP Czech Meetup 2020

LORAPWNING - JAK ATAKOWAĆ I ZABEZPIECZAĆ PROTOKÓŁ LORAWAN

OMYHACK 2020

Link

Introduction to IoT hacking with SDR

Semana de INFormática (SINF) 2020

Slides

RF Shadow Plays

Slides

Smart grid (in)security

CiderSecCon 2020

Slides

Introduction to mobile network intrusions from a mobile phone

Link

TIBCO JasperReports Server XML Entity Expansion Vulnerability (CVE-2019-8986)

Document

V2G Injector: Whispering to cars and charging units through the Power-Line (extended version)

t2 infosec

Slides

Huawei ManageOne ServiceCenter ACL Bypass

Software-Defined Network

Document

TRF7970A forgotten features for HydraNFC

Paged Out! Issue #1

Article

The return of FAIFA and HomePlugPWN: Make Power-Line Communication hacks great again!

leHack 2019

Slides

V2G Injector: Whispering to cars and charging units through the Power-Line

SSTIC 2019

Slides

Paper

Modmobtools: Internals, updates and more

Troopers Telco Sec Day 2019

Slides

Modmob tools and tricks: Using cheap tools and tricks to attack mobile devices in practice

Troopers NGI 2019

Slides

Attacking mobile devices from GPRS to LTE

MISC magazine HS #19

Link

PentHertz: The use of radio attacks in red team and pentests

Security PWNing 2018

Slides

Modmobjam: Jam tomorrow, jam yesterday, but also jam today

SSTIC RUMP 2018

Slides

Modmobmap: The modest mobile networks mapping tool

BeeRump 2018

Slides

Missing XML Validation vulnerability in SAP Control Center and SAP Cockpit Framework

Link

Radio communication penetration testing

MISC Magazine HS #16

Link

Out-of-control cars!

SSTIC RUMP 2017

Link

IoT Hacking - the case of Intercoms (with little updates since 33C3)

OSSIR 2017

Slides

Intercoms Hackings, when frontdoors become backdoors (more detailed)

33c3

Slides

House intercoms attacks, when frontdoors become backdoors (including progresses on 3G intercoms)

Hack.lu 2012

Slides

House intercoms attacks, when frontdoors become backdoors

Nuit Du Hack 2012

Slides

Paper

Jamming attack recording

Mobile communications: practical attacks using cheap equipment

Business France 2016

Slides

CVE-2016-3513, CVE-2016-3514, CVE-2016-3515 and CVE-2016-3516 in Oracle ECB and COM products

CVE-2015-6409: Cisco Jabber STARTTLS Downgrade Vulnerability

Document

How to hack the Blackphone, the "NSA-Proof" smartphone

01net.com magazine

HomePlugAV PLC: Practical attacks and backdooring

NoSuchCon 2014

Slides

Paper

Fuzzing the GSM Protocol Stack

Hack.lu 2012

Slides

Applicative security in Linux

MISC #62

Link

Introduction to USRP: hardware, radio, digital processing, and GnuRadio

HackerzVoice

Slides