Laban Sköllermark

I work for Reversec since April 2025.

Do you pentest IoT equipment before joining it to your network?

This is an attachment to the blog post Wardriving 2024: Using Electricity Meter Readers to Get In.

This is an attachment to the blog post Wardriving 2024: Using Electricity Meter Readers to Get In.

This is an attachment to the blog post Wardriving 2024: Using Electricity Meter Readers to Get In.

This is an attachment to the blog post Wardriving 2024: Using Electricity Meter Readers to Get In.

This is an attachment to the blog post Wardriving 2024: Using Electricity Meter Readers to Get In.

When working for my employer Sentor I discovered an origin disclosure vulnerability in Akamai GTM, but they didn’t agree it was a vulnerability.

When working for my employer Sentor I discovered an authentication bypass vulnerability in Auth0.

When working for my employer Sentor I discovered a session fixation vulnerability in Auth0.

Last week my favorite IT security podcast Bli säker (Become Secure in English) published the episode The Epochalypse and the QR Code (only in Swedish) where they explained the techonology behind mobile authenticator apps.

During 2021 I had access to a facility equipped with an alarm system from Securitas Direct.

I work for the security consultant company Defensify where I conduct security assessments of applications and networks.

This is a follow-up on the previous post Brute-Forcing Borrowers’ PINs at the Swedish Board of Student Finance (CSN) where I describe some vulnerabilities discovered in August 2020 and the response from CSN.

Maintenance banner on csn.se at the time of publication of this blog post, in Swedish.

Original too many tries message in Swedish.

Original PIN login form in Swedish.

Original personal code order confirmation in Swedish.

Original order personal code form in Swedish.

Original login menu in Swedish.

Original incorrect PIN message in Swedish.

Original choose delivery method form in Swedish.

New design of the order personal code form in Swedish.

New design of the choose delivery method form in Swedish.

The Swedish Board of Student Finance CSN is the government agency that manages Swedish student finance, i.e. grants and loans for studies.

This is the story on how I discovered that Yubico used an invalid certificate chain in their Personal Identity Verification (PIV) attestation feature on YubiKey 4.3 and YubiKey NEO, which could only be solved by a new hardware release.

This is an attachment to the blog post about the broken attestation certificate chain in YubiKey 4.3 and YubiKey NEO.

You probably use an “authenticator app” such as Google Authenticator to enable two-step verification (sometimes called two-factor authentication, 2FA, or multi-factor authentication, MFA) for an online account.

TL;DR: This post has a lot of details.

Inpired by Hackeriet’s blog where Alexander Kjäll use to post CTF write-ups, I’ve decided to create a personal one for myself.