Research

Published research on wireless, mobile and embedded security

Most of what we find on engagements ends up in a talk, a paper or a tool. The papers, write-ups, recorded talks and tooling are public.

Papers
Publications

Conference and journal papers on mobile, radio and embedded security.

Read the papers
Write-ups
Blog

Findings from engagements and lab work, with enough detail to reproduce them.

Read the blog
Recordings
Videos

Talks and demos from the conferences where we speak.

Watch
Sessions
Webinars

One-hour live sessions on a single technology, archived afterwards.

See past sessions

Research areas

Subject areas we have published in, and the systems each one applies to.

All publications
AreaApplies to
5G security, NSA and SAHandsets, IoT modules, private networks, operator cores
Open RANDisaggregated radio access, management interfaces, vendor integration
Baseband fuzzingModems in phones, vehicles, routers and industrial gateways
Interception and mappingCoverage analysis, rogue infrastructure, subscriber exposure
Power-line communicationHomePlug AV, domestic PLC, electric vehicles and charging stations
RFID and physical accessBadge systems, gates, controllers, credential lifecycles
Wi-Fi and short-range radioEnterprise wireless, BLE devices, LoRa and proprietary links
Open source

RF Swift, our open-source SDR toolbox

A containerised SDR toolchain that sets up a working radio environment in one command. We wrote it for our own engagements, we teach with it, and it is open source.

Proxmark5 and Proxmark3 connected to a pocket laptop running two Proxmark client sessions

Latest from the blog

All posts
The MIFARE attacker playbook: what three papers and one Proxmark3 teach you
Red TeamApr 2026
The MIFARE attacker playbook: what three papers and one Proxmark3 teach you

An attacker's playbook built from three recent papers and a Proxmark3, covering keyspace-reduction and relay attacks against MIFARE Ultralight C/AES,…

The MIFARE attacker playbook: what three papers and one Proxmark3 teach you
The evolution of RH850 hacking: from a DIY to the Pico Glitcher v3
AutomotiveMar 2026
The evolution of RH850 hacking: from a DIY to the Pico Glitcher v3

How glitching attacks on the Renesas RH850 automotive microcontroller have evolved, from early DIY voltage-glitching rigs to validating the ID-code…

The evolution of RH850 hacking: from a DIY to the Pico Glitcher v3
Breaking STM32 readout protection: From UV light to CPU state tracing
IoTMar 2026
Breaking STM32 readout protection: From UV light to CPU state tracing

A survey of attacks that break STM32 readout protection (RDP), from chip decapsulation and UV light to cold-boot and CPU…

Breaking STM32 readout protection: From UV light to CPU state tracing

Talk to us about your project

We scope the work in a first call, then send a fixed-price proposal: intrusion tests, vulnerability research, fuzzing, test benches, trainings. Offices near Paris, Monday to Friday, 9:00 to 19:00.