Lucid Duck

Vulnerability research and Linux kernel development

Self Employed • Selbstständig

Dec 2025 - Present • 8 mos

Independent security researcher, embedded-firmware reverse engineer, and Linux kernel contributor. I analyze stripped binaries and undocumented systems, validate findings with reproducible PoCs, and deliver reports engineers can act on. EMBEDDED FIRMWARE & BINARY RE: • Reverse engineer automotive and keyless-entry firmware for a hardware-security client across STM8, ARM Cortex-M0, 8051, PIC, HCS12/HCS12X, V850, and R32C targets • Reconstruct cryptography, PRNGs, key derivation, radio protocols, and state machines from raw flash • Produce byte-exact C implementations validated against captured traffic or instruction-accurate emulation • Reconstruct proprietary IPC and serialization formats from stripped software VULNERABILITY RESEARCH: • Discovered and received public credit for CVE-2026-20161, an arbitrary file overwrite in Cisco ThousandEyes Enterprise Agent • Demonstrated vendor-confirmed root-level flaws in enterprise VPN software, including Windows TOCTOU to SYSTEM and Linux command-injection and symlink chains • Found code-execution and authorization failures in endpoint, network-monitoring, and IoT products • Built working PoCs and coordinated disclosure through Bugcrowd, HackerOne, and vendor PSIRTs LINUX KERNEL & DRIVERS: • Contributed mainline fixes across rtw89, mt76, and mac80211 as author, co-developer, reporter, and tester • Fixed an rtw89 USB TX flow-control bug causing approximately 200x packet loss • Debugged TX-power, monitor-mode, USB-transport, and concurrency failures • Co-maintain a community mt76 driver repository and multi-distribution regression tooling Deliverables include technical reports, root-cause analysis, protocol documentation, C/Python tooling, PoCs, and remediation guidance. Tools: Ghidra, IDA, GDB, ftrace, Wireshark, Burp Suite, Python, C