Models & agents
Prompt controls, tool use, memory, retrieval, orchestration.
Offensive security research & consulting
Follow the attack surface.
From prompt injection to memory corruption, we investigate the seams where systems fail — across LLMs, applications, cloud, mobile, embedded platforms, and hardware-backed products.
Comsecuris treats modern systems as connected attack surfaces, not isolated service lines.
Prompt injection
Memory corruption
Applications & APIs
Business logic, authz, state, protocol assumptions, integrations.
Cloud & identity
Isolation boundaries, control planes, secrets, tenancy, trust.
Platforms & mobile
Kernels, sandboxes, drivers, basebands, IPC, runtime edges.
Embedded & hardware
Boot chains, firmware, TEEs, radios, SoCs, buses, custom silicon.
ATTACKERS DO NOT RESPECT ORG CHARTS
Approach
Evidence over reassurance
Orientation
Adversarial
Input
Black boxes welcome
Output
Research, proof, action
Range
One investigation, many layers.
We follow the path an attacker would actually take: through context, software, infrastructure, protocols, and low-level system boundaries.
Break the model around the model.
We assess LLM and agent systems across the boundaries that turn model output into product behavior: instructions, retrieval, memory, tools, identities, and the application logic around them.
- Prompt injectionControl drift
- Tool abuseExecution leverage
- RAG attacksContext poisoning
- Agent workflowsBoundary confusion
Break the assumptions underneath.
Applications, cloud systems, mobile platforms, firmware, hardware, and cryptographic implementations are part of the same surface when the objective is real compromise.
- Apps & APIsLogic, auth, state
- Cloud & identityIsolation, tenancy, trust
- Mobile & kernelsSandbox, IPC, drivers
- Embedded & hardwareBoot, firmware, TEEs
Method
Evidence, not checkbox assurance.
We reconstruct systems, develop tooling, validate exploitability, and turn offensive findings into engineering decisions. The objective is not volume of findings; it is clarity about what can actually be reached, controlled, or broken.
Frame the real surface
Map assets, trust boundaries, interfaces, and attacker incentives across the complete product.
Build the missing visibility
Create harnesses, instrumentation, debuggers, emulators, or analysis workflows when off-the-shelf methods are insufficient.
Demonstrate impact
Find vulnerabilities, prove reachability, and show what a determined adversary can actually achieve.
Transfer the insight
Deliver root cause, remediation priorities, technical artifacts, and knowledge your team can reuse.
Contact
Bring us the surface you actually need to trust.
Tell us what you are building, where the unknowns are, and what it would mean for an attacker to be right.
contact@comsecuris.com2013 · IEEE S&PTrawling for Tor Hidden Services: Detection, Measurement, Deanonymization↗2012 · USENIX WOOTBaseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks↗2010 · USENIX WOOTA Framework for Automated Architecture-Independent Gadget Search↗
Full archive21 entries
21 entries
Chronological archive
Papers, book contributions, and presentations ordered by year, newest first.
2016
Breaking Band — reverse engineering and exploiting the shannon baseband
Nico Golde, Daniel Komaromy
Recon 20162015
Assessing and Exploiting Bignum Vulnerabilities
Ralf-Philipp Weinmann
Black Hat USA 20152014
Modeling and Discovering Vulnerabilities with Code Property Graphs
Fabian Yamaguchi, Nico Golde, Daniel Arp, Konrad Rieck
IEEE Symposium on Security and Privacy (S&P 2014)2014
Concurrency: A problem and opportunity in the exploitation of memory corruptions
Ralf-Philipp Weinmann
CanSecWest 20142013
Let Me Answer That For You: Exploiting Broadcast Information in Cellular Networks
Nico Golde, Kevin Redon, Jean-Pierre Seifert
USENIX Security Symposium (2013)2013
Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization
Alex Biryukov, Ivan Pustogarov, Ralf-Philipp Weinmann
IEEE Symposium on Security and Privacy (S&P 2013)2013
Baseband exploitation in 2013: Hexagon challenges
Ralf-Philipp Weinmann
PacSec 20132012
Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks
Ralf-Philipp Weinmann
6th USENIX Workshop on Offensive Technologies (WOOT 2012)2012
New Privacy Issues in Mobile Telephony: Fix and Verification
Myrto Arapinis, Loretta Mancini, Eike Ritter, Mark Ryan, Nico Golde, Kevin Redon, Ravishankar Borgaonkar
ACM Conference on Computer and Communications Security (ACM CCS 2012)2012
Weaponizing Femtocells: The effect of Rogue Devices on Mobile Telecommunication
Nico Golde, Kevin Redon, Ravishankar Borgaonkar
Annual Network & Distributed System Security Symposium (NDSS 2012)2012
The iOS Hacker’s Handbook
Charlie Miller, Dion Blazakis, Dino DaiZovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philipp Weinmann
Wiley · The iOS Hacker’s Handbook2012
Let Me Answer That for You — adventures in mobile paging
Nico Golde
29th Chaos Communication Congress (29C3/2012)2012
Security issues with SUPL implementations
Ralf-Philipp Weinmann
Black Hat USA 20122011
SMS of Death: From Analyzing to Attacking Mobile Phones on a Large Scale
Collin Mulliner, Nico Golde, Jean-Pierre Seifert
USENIX Security Symposium (2011)2011
Femtocells: A Poisonous Needle in the Operator’s Hay Stack
Nico Golde, Kevin Redon
Black Hat USA 20112011
SMS-o-Death: from analyzing to attacking mobile phones on a large scale
Nico Golde, Collin Mulliner
27th Chaos Communication Congress (27C3/2010); CanSecWest 20112010
A Framework for Automated Architecture-Independent Gadget Search
Thomas Dullien, Tim Kornau, Ralf-Philipp Weinmann
4th USENIX Workshop on Offensive Technologies (WOOT 2010)2010
All Your Baseband Are Belong To Us
Ralf-Philipp Weinmann
DeepSec 20102010
The Hidden Nemesis — Backdooring Embedded Controllers
Ralf-Philipp Weinmann
27th Chaos Communication Congress (27C3/2010)2009
Attacks on the DECT Authentication Mechanisms
Stefan Lucks, Andreas Schuler, Erik Tews, Ralf-Philipp Weinmann, Matthias Wenzel
Topics in Cryptology — CT-RSA 20092007
Breaking 104 Bit WEP in Less Than 60 Seconds
Erik Tews, Ralf-Philipp Weinmann, Andrei Pyshkin
Information Security Applications: 8th International Workshop (WISA 2007)