Felix "FX" Lindner

Felix "FX" Lindner was a German security researcher whose work through the group Phenoelit made him one of the earliest and most influential researchers into the security of Cisco IOS and other embedded networking equipment, at a time when router and switch firmware was widely assumed to be out of reach for practical attack research.

Phenoelit and Early Router Research

Lindner founded Phenoelit, a hacking and research group based in Berlin, in the late 1990s. The group became known for systematically probing the security of networking infrastructure that most of the industry treated as a black box, including Cisco IOS, HP printers, and other embedded devices. Phenoelit released the IRPAS (Internetwork Routing Protocol Attack Suite), a toolkit for testing and attacking routing protocols such as HSRP, CDP, and IGRP, which became a reference tool in network penetration testing. Lindner is also associated with cd00r.c, a widely circulated proof-of-concept for a port-knocking-style invisible backdoor, originally written by another researcher and popularized and discussed extensively within the German and international hacking scene that Phenoelit was part of.

Cisco IOS Exploitation Talks

Beginning in the early 2000s, FX presented a series of talks at Black Hat, DEF CON, and the Chaos Communication Congress (CCC) demonstrating practical exploitation techniques against Cisco IOS, challenging the prevailing assumption that router firmware was too obscure or too reliable to be exploited like conventional software. These talks are widely credited with helping establish embedded and network-device exploitation as a recognized subfield of vulnerability research.

Recurity Labs

In 2006, Lindner founded Recurity Labs GmbH, a Berlin-based security research and consulting company, where he continued research into reverse engineering, code auditing, and embedded systems security. Under Recurity Labs he developed Blitzableiter (German for "lightning rod"), a tool designed to sanitize and hardened Adobe Flash (SWF) files against exploitation of parser vulnerabilities, presented at Black Hat in 2009.

Community Role and Recognition

From 2003 to 2011, Lindner organized pH-Neutral, an invitation-oriented hacker gathering held periodically in Berlin that brought together researchers from the international vulnerability-research community outside the format of formal conferences. He remained a recurring speaker at the Chaos Communication Congress across multiple years. In 2017, Lindner received the Pwnie Award for Lifetime Achievement, recognizing his sustained contributions to offensive security research.

Death

Felix Lindner died on March 1, 2026. His death was publicly announced by his company, Recurity Labs, in a tribute published on the company's blog, which described his role in founding the firm and his standing in the security research community.

Timeline

• 1990sFounded Phenoelit, a Berlin-based hacking and security research group.
• 2000Began presenting research on Cisco IOS and embedded-device security at hacker and security conferences.
• 2002Presented Cisco IOS exploitation research at Black Hat and DEF CON, alongside Phenoelit's continued CCC talks.
• 2003Began organizing pH-Neutral, a recurring hacker gathering in Berlin, running through 2011.
• 2006Founded Recurity Labs GmbH, a Berlin-based security research and consulting company.
• 2009Presented Blitzableiter, a hardening tool for Adobe Flash file parsing, at Black Hat.
• 2017Received the Pwnie Award for Lifetime Achievement.
• 2026-03-01Died; his death was announced publicly by Recurity Labs.