Primary practice
Application security
We review source code and system designs, provide security assurance, and advise engineering teams on application security. Work ranges from focused code review to broader assessments and ongoing consulting.
Nautilus Research Sàrl · Geneva
Application security, technical training and systems research.
Our main work is source-code review, security assurance and application-security consulting. We also provide security and fuzzing training, reverse engineer hardware and firmware, and conduct research on mobile basebands.
What we doWhat we do
Four areas of work
Training
Security and fuzzing
We provide practical training in application security, code review and fuzzing, including the tools and methods used to find, reproduce and understand security issues.
Devices & firmware
Hardware hacking and reverse engineering
We analyse electronic devices and firmware, recover undocumented behaviour, inspect protocols and interfaces, and examine attack surfaces across hardware and software.
Research
Baseband and mobile systems
We conduct research on mobile basebands, radio protocols and the boundaries between modem hardware, firmware, operating systems and mobile networks.
Method
How we work
Each assignment begins with the scope, the security properties that need to hold and the threats that matter. We map the architecture and trust boundaries, then identify the components where a failure would have the greatest impact.
For application-security work, we combine manual source-code and architecture review with targeted static analysis, dynamic testing and fuzzing. For lower-level work, we use binaries, firmware, schematics, traces, packets and measurements. Findings are reproduced where possible and traced back to their root cause.
We report each issue with evidence, impact and remediation. Where useful, we review fixes and provide repeatable tests, fuzzing harnesses or development checks.