Publications
Talks, papers, CVEs and tools
Papers, conference talks and the tools released with them. Filter by area or browse the full list. Nothing is behind a form.
Citing us
Cite the venue and the year as printed. For a preprint or a dataset that is not linked here, write to us and we will send it.
Request a paper Tools on GitHubRF Swift: a reproducible SDR environment
The design of the containerised toolbox behind our assessments and courses, and why reproducibility matters more than features here.
CVE-2025-12357: International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints
Breaking signal with RF Swift
RF Swift: a swifty toolbox for all wireless assessments
Car Hacking: With and Without Wires for Tires
Intercepting 2G Traffic on Windows with RF Swift
Connected cars: scary RF signals & possible RCEs
RF Swift: a swifty tool for RF security assessments
Automotive Security
Shrinking Giants with HAROGIC: Testing the Latest Compact Spectrum Analyzers on a Budget!
Attacking IoT Devices through 5G interface
Spectran V6 RTSA 2000X (1st review): the good, the bad and the ugly
5G Attacks on IoT
Unlocking the wideband on bladeRF 2.0
Flipper Zero: Want some good news?
Flipper Zero: is this for you? Follow our 1st tests!
RF Signal Hunting with Machine and Deep Learning
Intruding 5G SA core networks from outside and inside
Exploitation Log4shell on car’s charging stations
A powerful Red Team & Pentest ToolBox with the GPD Pocket 3 laptop
LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk
Examining Log4j Vulnerabilities in Connected Cars and Charging Stations
5G Core SA Network intrusions
RF Bugs and their detection
Forced Entry: A Security Test for Automatic Garage Doors
RFID secrets with ICopy-X: iClass SE, secret of tags, teardown and more
Hack RFID fast with ICopy-X during Red Team engagements
Tackle rolling code with PandwaRF
RollD.O.R Attacks – Getting permanent accesses in garages
V2RF – Assessing car’s RF communications
Protecting LoRaWAN Hardware from Attacks in the Wild
Gauging LoRaWAN Communication Security with LoraPWN
Low Powered but High Risk: Evaluating Possible Attacks on LoRaWAN Devices
Deep dive into LoRa(WAN) RF and Hardware Security
LORAPWNING – JAK ATAKOWAĆ I ZABEZPIECZAĆ PROTOKÓŁ LORAWAN
Introduction to IoT hacking with SDR
RF Shadow Plays
Smart grid (in)security
Introduction to mobile network intrusions from a mobile phone
TIBCO JasperReports Server XML Entity Expansion Vulnerability (CVE-2019-8986)
V2G Injector: Whispering to cars and charging units through the Power-Line (extended version)
Huawei ManageOne ServiceCenter ACL Bypass
TRF7970A forgotten features for HydraNFC
The return of FAIFA and HomePlugPWN: Make Power-Line Communication hacks great again!
Modmobtools: Internals, updates and more
Modmob tools and tricks: Using cheap tools and tricks to attack mobile devices in practice
Attacking mobile devices from GPRS to LTE
PentHertz: The use of radio attacks in red team and pentests
Modmobjam: Jam tomorrow, jam yesterday, but also jam today
Modmobmap: The modest mobile networks mapping tool
Missing XML Validation vulnerability in SAP Control Center and SAP Cockpit Framework
Radio communication penetration testing
Out-of-control cars!
IoT Hacking – the case of Intercoms (with little updates since 33C3)
Intercoms Hackings, when frontdoors become backdoors (more detailed)
House intercoms attacks, when frontdoors become backdoors (including progresses on 3G intercoms)
House intercoms attacks, when frontdoors become backdoors
Mobile communications: practical attacks using cheap equipment
CVE-2016-3513, CVE-2016-3514, CVE-2016-3515 and CVE-2016-3516 in Oracle ECB and COM products
CVE-2015-6409: Cisco Jabber STARTTLS Downgrade Vulnerability
How to hack the Blackphone, the “NSA-Proof” smartphone
Fuzzing the GSM Protocol Stack
Applicative security in Linux
Introduction to USRP: hardware, radio, digital processing, and GnuRadio
Talk to us about your project
We scope the work in a first call, then send a fixed-price proposal: intrusion tests, vulnerability research, fuzzing, test benches, trainings. Offices near Paris, Monday to Friday, 9:00 to 19:00.