A private, radio-isolated laboratory where we examine devices, recreate real incidents and test how well a vessel's architecture holds.
Explore the laboratoryA modern yacht is a small, connected organisation at sea. When an incident occurs, the questions are always the same: what was touched, how did they get in, and could it happen again. Our laboratory is set up to answer them.
We preserve evidence from the systems involved — bridge workstations, crew and guest networks, the satellite link, remote-access accounts — and rebuild the timeline. Where the data allows, we recreate the situation in the laboratory to confirm the path the attacker took, not just to suspect it.
We rebuild the essential parts of a vessel's architecture in the laboratory and simulate specific functions to see whether — and how well — they are protected: the remote-access path, the boundary between crew IT and operational systems, and the integrity of navigation data.
We do not claim to test every system on board. We focus on the few things an attacker would reach for first, simulate them in a controlled environment, and report exactly what held and what did not.
Our laboratory exists for one purpose: to understand what really happened on a device or a system — and to prove it. It is a private, radio-isolated environment where a phone, a computer or a piece of onboard equipment can be examined without any outside contact, so that nothing is altered and nothing leaves the room.
Inside it we can recreate a real situation: the same network conditions, the same connections, the same sequence of events. That is how we confirm how an incident happened rather than guess at it — and how we test whether a design will hold before it is trusted at sea.
We keep the scope deliberately narrow. The capabilities below are the ones we rely on in real investigations; we would rather do a few things with certainty than claim to cover everything.
We look for spyware first. Then we watch how the device actually behaves on a cellular network we control.
Detection of commercial and state-sponsored spyware through network behaviour analysis, indicator matching and command-and-control beacon detection.
Isolated cellular network using software-defined radio and an open-source cellular stack for controlled device testing. Full eNodeB, EPC core, and IMS stack.
Full HTTPS visibility through transparent proxy. Decrypt all application traffic to identify data exfiltration and suspicious API calls.
Dynamic instrumentation of Android and iOS apps to intercept API calls, network checks, and security mechanism bypasses.
Detect unauthorized data transfers including keylogger uploads, GPS beaconing, contact/photo exfiltration, and DNS tunneling attacks.
The threats we detect on a device, what kind of threat each one is, and how serious it is.
| What we detect | Type of threat | Severity |
|---|---|---|
| State-sponsored spywarePegasus, Predator, FinSpy, Candiru, Hermit | Targeted surveillance | Critical |
| Commercial stalkerwaremSpy, FlexiSPY, Spyic, Hoverwatch | Covert monitoring | Critical |
| Banking trojansCerberus, Anubis, SharkBot, TeaBot, FluBot | Financial theft | Critical |
| Remote access trojansAndroRAT, SpyNote, AhMyth | Remote control of the device | High |
| Command-and-control beaconingRegular interval callbacks, DGA domains | Active compromise | High |
| DNS tunnelingData hidden inside DNS queries | Data exfiltration | High |
| Silent data exfiltrationKeylogger uploads, GPS beaconing, contacts and photos | Data theft | High |
Systematic forensic methodology for mobile device and payment system investigations.
Device received in Faraday bag. Chain of custody initiated. Device placed in RF-isolated examination room. Forensic image acquired before network analysis.
Device connected to private LTE network. All traffic captured through transparent proxy. DNS queries, connection patterns, and data flows logged for 24-48 hours.
IOC matching against known spyware/malware databases. C2 beaconing analysis using statistical interval detection. DNS tunneling checks. Data exfiltration pattern analysis.
Runtime instrumentation for API call interception. Permission auditing. Network check behavior analysis. SSL traffic decryption for deep content inspection.
Complete forensic timeline generation. pcap files, screenshots, and database export. Technical report with chain-of-custody documentation using ISO/IEC 27037 methodology where relevant.
Physical-layer analysis of EMV smart card communications using RF capture hardware, oscilloscopes, and signal generators to detect cryptographic and protocol-level vulnerabilities.
Full ISO14443A/B RF sniffing between card and reader at the physical layer. Captures every APDU exchange and timing signal without active interference.
Digital oscilloscope captures ISO 7816 contact card signals at the T=0/T=1 protocol level, revealing timing side-channels and power analysis patterns.
RF signal generators inject controlled anomalies into contactless communication fields to test reader and card resilience against electromagnetic fault injection.
Automated generation of malformed and edge-case APDU command sequences to expose card firmware vulnerabilities, unexpected behaviors, and hidden commands.
Validate ARQC/TC cryptogram generation against known session keys, test for weak diversification algorithms, and detect static or predictable cryptographic outputs.
End-to-end contactless EMV transaction testing covering CVM limit enforcement, NoCVM bypass, relay distance attacks, and dual-interface card communication verification.
Our forensics laboratory is available for both emergency investigations and scheduled security assessments. Where relevant, evidence handling uses ISO/IEC 27037 as a methodology.