Tobias Lindqvist
Hardware security researcher — firmware & radio
I take apart devices that were not meant to come apart: meters, medical pumps, car key fobs, the odd industrial controller. Mostly firmware extraction, fault injection and protocol work. Half the job is soldering and the other half is waiting for a fuzzer, so I have learned to be patient about both.
- uptime:
- 13y active
- roles:
- 5 × Experience
- shipped:
- 5 × Projects
Experience
Fjord LabsPrincipal Researcher, Embedded Security
- Lead the hardware team — four researchers, one very well-equipped bench.
- Published 31 advisories in three years, 19 with vendor-shipped firmware fixes.
- Built the lab's fault-injection rig from a glitcher, a stage and a lot of bad first attempts; it now runs unattended overnight.
- Testify occasionally as a technical expert, which is far less exciting than it sounds.
Nordkant SecuritySenior Security Consultant
- Firmware and RF assessments for utilities, medical device makers and two automotive suppliers.
- Wrote the firm's embedded methodology after our third engagement quietly reinvented the same checklist.
- Roughly 60 assessments. The finding that mattered most was almost always an unauthenticated debug interface.
Grenland ConsultingHardware Test Engineer
- Compliance and durability testing for industrial control hardware — the certification side, not the attack side.
- Spent three years learning exactly how these devices are built and signed off, which is why I now know where to look.
- Learned to write a report a non-engineer will actually act on. That skill has outlived every tool I used then.
Vindra InstrumentFirmware Engineer
- Wrote C for battery-powered flow meters — the other side of the desk.
- Being the person who has to ship the fix made me a considerably more useful person to report a bug to.
Vindra InstrumentTest Engineer
Production test fixtures and a lot of oscilloscope time. Started reading datasheets for fun here and never really stopped.
Projects
brownout
Open-source voltage glitching toolkit
A cheap crowbar glitcher plus the search harness that makes it usable — parameter sweeps, automatic re-sync, and a log format you can diff. Runs on a €40 board. About 1,900 stars and a steady trickle of people telling me their chip now boots into a shell.
github.com/tlindqvist/brownoutSmart meter firmware extraction
Coordinated disclosure · 2023
Pulled signed firmware off a widely deployed metering unit through an undocumented factory mode, then showed the update signature check could be skipped entirely. Eleven months of coordinated disclosure with the vendor and a national CERT. Fixed in the field before I said a word publicly.
Rolling code replay study
Research paper · 2022
Measured how six aftermarket key-fob systems actually implement rolling codes. Four of them resynchronised far too eagerly. Presented with a live demo that worked on the second attempt.
Infusion pump assessment
Client engagement · 2020
Six weeks on a networked medical pump. Found a bootloader that would accept any image over the service port. The interesting part was the year afterwards, helping them design an update path they could deploy to devices already in hospitals.
pinfind
Small tool
Walks a header looking for a UART and tells you the baud rate. Two hundred lines. I use it on nearly every job, which is more than I can say for most things I have written.
github.com/tlindqvist/pinfindStack
- targets
- ARM Cortex-M, RISC-V, MSP430, ESP32, PIC, FPGA bitstreams
- tooling
- Ghidra, IDA, ChipWhisperer, JTAG/SWD, logic analysers, GNU Radio, AFL++
- languages
- C, Rust, Python, assembly (ARM, AVR), a little Verilog
- human
- Swedish (native), English (fluent), German (workable), coordinated disclosure, expert testimony
Education
Chalmers University of Technology
Thesis on side-channel leakage in low-power microcontrollers.
References
Tobias found the flaw and then spent a year helping us fix it properly, which almost nobody does. The report was written for our board, not for other researchers.
He will tell you when the interesting-looking bug is not actually exploitable. That costs him talks and it is exactly why I trust his advisories.
Talks
Glitching on a Budget
Everything in brownout, demonstrated live on a €40 board.
Eleven Months of Silence
What coordinated disclosure with a utility vendor actually looks like, including the parts where I was wrong.
Embedded exploitation, 2-day course
Twenty students, twenty dev boards, one bench power supply that keeps dying.
try it — click a command or type your own