PortfolioIvo Rakić
Offensive security researcherZagreb, Croatia
I break things on purpose, mostly firmware and the protocols underneath it. Nine years split between a national response unit and product security work, which means I have written both the advisory and the apology. I am considerably better at finding bugs than at estimating how long finding them will take.
Work
Principal Security ResearcherVetrenjača Labs
2022 — Now- Lead a four-person team auditing embedded targets — building automation, medical telemetry, one extremely stubborn parking meter.
- Found and disclosed 31 CVEs over three years, six of them rated critical.
- Built the firmware emulation harness that took our average time-to-first-crash from nine days to under one.
- Run the disclosure process, which is a fifth research and four fifths patiently emailing vendors who do not want to hear from me.
Product Security EngineerModrina Systems
2019 — 2022- Sat inside the engineering org rather than beside it, reviewing designs before anyone built them.
- Wrote the secure-boot implementation now shipping on roughly 400,000 devices.
- Killed two features by demonstrating what they would eventually cost us, which I still count as my best quarters there.
Incident ResponderNational Cyber Response Unit
2016 — 2019- On the rotation for critical-infrastructure incidents, including two that made the news and several that did not.
- Reverse-engineered malware samples for attribution and wrote the public technical breakdowns.
- Learned that the first four hours of an incident are mostly spent telling people to stop deleting things.
Research
HalyardFirmware emulation harness
Visit ↗Boots unmodified ARM firmware under a stubbed peripheral layer so fuzzers can reach code that normally needs the physical board. Open sourced in 2023 — about 1,900 stars and, more usefully, three vendors now run it in CI.
Boiler room chainBuilding automation · 2024
Eleven related findings in a widely deployed building controller, from an unauthenticated write primitive up to full firmware replacement. Coordinated disclosure ran fourteen months across five vendors and one national CERT.
Secure boot rewriteModrina Systems · 2021
Replaced a homegrown signature check with a properly rollback-protected chain, retrofitted onto hardware that shipped without a key store. The interesting constraint was that none of it could brick a device in the field.
glassttySide project
Visit ↗A small terminal UI for diffing firmware images by structure rather than by bytes. Written almost entirely on trains. Roughly forty people use it and two of them have opinions.
Stack
Refs
Ivo told us our flagship feature was indefensible, then spent two weeks proving it rather than arguing about it. We shipped something narrower and much better.
He writes the clearest advisories I have read. Vendors who start out furious with him usually end up asking him to review the fix.
Talks
Eleven Ways Into A Boiler RoomOffensiveCon, Berlin
2025The building-controller chain end to end, including the fourteen months of email.
Emulating The Board You Do Not HaveREcon, Montréal
2023Halyard's design, and the peripherals we gave up on stubbing.
Study
MSc Computing, security trackUniversity of Zagreb
2014 — 2016Thesis on side-channel leakage in constrained devices.