QuarksLab

QuarksLab QuarksLab is a Paris-based cybersecurity research laboratory known for work in information security, reverse engineering, cryptography, malware analysis, and vulnerability research. The lab publishes technical reports, develops open-source tooling, and participates in incident response and coordinated disclosure with vendors and institutions such as Microsoft, Google, Apple Inc., Amazon (company), and Cisco Systems. QuarksLab researchers have appeared at prominent conferences including Black Hat USA, DEF CON, RSA Conference, CanSecWest, and Usenix events.

History

QuarksLab emerged during the 2010s from a core of French and international researchers active in forums and competitions tied to Capture The Flag, Pwn2Own, and academic workshops at École Polytechnique, INRIA, CNRS, and École Normale Supérieure. Early activities involved coordinated analysis of exploits disclosed in the wake of incidents involving Stuxnet, Duqu, Equation Group, and high-profile APT campaigns such as Operation Aurora and APT28. The lab expanded its remit to include applied cryptanalysis inspired by breakthroughs around SHA-1 collision, ROCA vulnerability, and post-quantum discussions shaped by events at NIST processes. Founders and senior staff previously collaborated with teams from ANSSI, ENISA, and private firms like Kaspersky Lab, FireEye, CrowdStrike, and Symantec.

Research and Projects

QuarksLab conducts research spanning exploit development, firmware analysis, and cryptographic assessment. Projects have included static and dynamic analysis of threats linked to groups analogous to Fancy Bear, Sandworm, and Lazarus Group, alongside defensive work addressing supply chain incidents similar to SolarWinds hack and NotPetya. The lab has published work on side-channel attacks reminiscent of studies following Bleichenbacher attack and ROCA, and contributed practical findings relevant to secure enclave discussions at Intel and ARM Holdings platforms. QuarksLab outputs often intersect with research communities at Massachusetts Institute of Technology, Stanford University, Carnegie Mellon University, University of Cambridge, and ETH Zurich.

Technologies and Tools

QuarksLab develops tooling for binary analysis, instrumentation, and automated exploit generation. Toolchains produced by the lab complement projects like Ghidra, Radare2, Binary Ninja, and IDA Pro; they address firmware ecosystems found in products from Samsung Electronics, Huawei, Xiaomi, and embedded vendors such as STMicroelectronics and NXP Semiconductors. The lab’s tooling integrates techniques popularized by researchers associated with Tavis Ormandy, Charlie Miller, Dawn Song, Ralph Holz, and groups connected to Project Zero. Work on cryptographic primitives reflects standards discussions at IETF, ISO/IEC, and contributions that echo efforts by teams around OpenSSL, LibreSSL, and BoringSSL.

Collaborations and Partnerships

QuarksLab routinely partners with technology companies, academic labs, and international agencies. Collaborators have included corporate security teams at Facebook, Twitter, Slack, and cloud providers like Google Cloud Platform and Microsoft Azure. The lab engages with academic partners at institutions such as Imperial College London, Princeton University, University of Oxford, and Tsinghua University for joint publications and student mentorship. In incident response and disclosure, QuarksLab interacts with vendors and authorities comparable to US-CERT, Europol, and national CERTs including CERT-FR; it also participates in standards and coordination forums involving OWASP and FIRST.

Impact and Recognition

Research from QuarksLab has influenced vendor patches, advisories, and vulnerability databases maintained by CVE Program, MITRE Corporation, and major vendors like Adobe Systems, Oracle Corporation, and VMware. Presentations at Black Hat Europe, SANS Institute briefings, and peer-reviewed venues have been cited alongside contributions from labs such as Google Project Zero, Microsoft Security Response Center, and Kaspersky ICS CERT. Individual researchers affiliated with the lab have received invitations to speak at events hosted by DEF CON Groups, Chaos Computer Club, and national cybersecurity symposia sponsored by entities like NATO and OSCE. The lab’s open-source releases and methodological write-ups are used in curricula at universities including McGill University and University of Toronto and inform training programs run by private firms such as SANS Institute and consulting groups like Deloitte and Accenture.

Category:Cybersecurity research organizations