Hardware · Firmware · Security · RF
We care about how things are made.
Bitqan Systems Design is an electronics, hardware security and embedded engineering design firm in Abu Dhabi that takes consumer and industrial electronics from idea to manufacturing.
Bitqan: With Mastery
Bitqan comes from the Arabic بإتقان, “with mastery”. That is the bar we hold ourselves to, not a title we give ourselves. We care about how things are made: solid engineering, an intuitive interface, security built in from the start. We take consumer and industrial electronics from an idea to something you can manufacture: the circuits, the boards, the firmware, the enclosure.
-
The name
بإتقان (bi-itqan) means doing something with mastery and care. It sets the bar for every schematic, line of code and enclosure we deliver.
-
The whole product
Electronics, firmware, RF and mechanics are designed together so the product works as one thing and can be built.
-
Founded in Abu Dhabi, 2026
Bitqan Systems Design L.L.C - S.P.C is registered in Abu Dhabi and was founded in 2026, building on more than 25 years of embedded and security engineering.
Meet our founder
Bitqan is led by its founder. You talk to the engineer who designs your product.
Milosch Meriac has designed hardware, firmware and software defined radios (SDR) for more than 25 years, from open-source RFID tags to GNSS-jammer localization systems. At Bitqan that experience goes into the whole product: schematic, RF front end, firmware and enclosure.
RF, acoustics & localization
- Built and led the Signals, Electronics & Acoustics group at the Technology Innovation Institute, Abu Dhabi
- Real-time GNSS jammer and spoofer localization system, developed to TRL 7
- Real-time acoustic localization with microphone arrays: phased-array processing and direction finding for sound and RF
- Acoustic jamming device that protects confidential conversations, TRL 9: productized as the SAAMIT Box, which blocks unauthorized recordings on nearby phones with inaudible jamming signals SAAMIT Box at VentureOne
- Underwater communications and Sonar
- Using AIS RF ship localization and data analysis for detecting localized GNSS spoofing in the gulf region
Security
- Reverse-engineered HID iCLASS access-control readers: the Heart of Darkness white paper, the 27C3 talk and the ESORICS 2012 paper Dismantling iClass and iClass Elite White paper 27C3 talk ESORICS 2012
- Led the Arm Research Security group in Cambridge, UK
- Created Arm mbed uVisor, the secure hypervisor for Cortex-M microcontrollers
- Arm Inventor of the Year 2014, contributing to 112 granted patents from 53 families Granted patents Patent families
- Hardware and supply-chain security reviews for high-assurance devices and hardware security penetration testing at darkmatter.ae
- Founding member of the Xbox-Linux project: helped analyze and break the Xbox's trusted-computing security in 2002 and ported the first Linux system to the console 19C3 talk Slides In “Hacking the Xbox”
Low-power wireless & open hardware
- Founded OpenBeacon in 2006: coin-cell 2.4 GHz tags that log for weeks
- Built the world's first large-scale real-time conference tracking system for the 2006 Chaos Communication Congress: custom-designed hardware for each of the 1,000 visitors and custom networked RFID readers that located them to within meters; later museum installations worldwide 23C3 project page RFID Journal Make: heise online 23C3 talk
- Co-founded OpenPCD, OpenPICC and the SocioPatterns collaboration SocioPatterns
From prototype to factory
- CTO at Bitmanufaktur: tags, PoE readers, moulded and cast enclosures, production in China OpenBeacon project Hardware gallery
- Blinkenlights Stereoscope: 960 lights on Toronto City Hall driven by 2.4 GHz dimmers Documentation video Code on GitHub
- txtr e-ink reader: Arm Linux e-book hardware designed from scratch taken to production, pressure-senitive behind-screen multitouch patent filed
Community
- Speaker at Chaos Communication Congress, hardwear.io (keynote), Arm TechCon, Embedded World and HITB All CCC talks Tower defense for hackers Practical RTOS security High-end security for low-end MCUs Securing your laptop
Reference projects
Public projects Milosch Meriac designed or led before Bitqan.
Client work under NDA is not shown.
-
Hardware security
Slides (PDF)Prior work xen1thLabs, DarkMatter Abu Dhabi 2019Virtualization-based laptop security
A hardened business laptop, presented at HITB+ CyberWeek 2019 in Abu Dhabi. The threat model covers malicious firmware that survives OS reinstalls, attackers with brief physical access and supply-chain implants. A minimal, secure-booted Linux on a read-only partition owns the hardware and runs Windows 10 in an IOMMU-protected hypervisor compartment with direct access to the GPU only. USB ports, cameras, microphones and speakers stay isolated from Windows by the virtualization layer and are only exposed by Linux policy when they are needed, which prevents firmware compromise of these devices and unauthorized audio or video recording. Network traffic is routed by Linux, so it cannot bypass the VPN where the use case requires one. Linux also handles the double disk encryption (TCG Opal and LUKS2 with Argon2 key derivation tied to the TPM and an external USB crypto token), so Windows malware can neither become persistent in firmware nor reach the keys. A decoy password opens a disposable system for border checks; disabled DMA-capable ports, tamper detection and glitter nail polish on the screws complete the picture.
-
Security & IoT
Source code on GitHubPrior work Arm, Cambridge UK 2013 to 2017Arm mbed uVisor
A self-contained secure hypervisor for Cortex-M microcontrollers that splits firmware into isolated compartments. It supports both Armv7-M (Cortex-M3, M4 and M7), where it enforces the boundaries with the memory protection unit, and Armv8-M (Cortex-M23 and M33), where it also uses TrustZone. Each compartment owns its memory regions and peripherals through access control lists, and secure gateways let code cross a boundary one function call at a time, so a single driver or crypto routine can run in its own compartment. uVisor became a core component of the Arm mbed operating system.
-
RFID Security
Prior work Independent research, with Henryk Plötz and Radboud University Nijmegen 2010 to 2012HID iCLASS security research
Reverse-engineered HID's iCLASS access-control readers to recover the Standard Security keys, showing that breaking one reader opens every installation running that mode. Documented in the white paper Heart of Darkness, presented at 27C3 with Henryk Plötz, and continued with Radboud University Nijmegen in the ESORICS 2012 paper Dismantling iClass and iClass Elite.
-
Electronics & RF
See the hardware galleryPrior work Project Blinkenlights, Toronto 2008Blinkenlights Stereoscope
For Nuit Blanche 2008, Project Blinkenlights turned the two towers of Toronto City Hall into a giant display: 960 windows, each lit by a lamp with eight grey levels. The lamps were switched by 2.4 GHz wireless dimmers built on OpenBeacon radio hardware, designed and produced for the installation.
-
Electronics & mechanical
See the hardware galleryPrior work Bitmanufaktur, Berlin 2010 to 2012OpenBeacon readers and enclosures
USB tags for offline operation with an injection-moulded case, a PoE Ethernet reader in a cast aluminium housing and the OpenPCD 2 13.56 MHz reader, all taken through production setup in China.
-
Security & IoT
Read the case studyPrior work OpenBeacon / SocioPatterns 2006 onwardOpenBeacon proximity tags
Open-source 2.4 GHz active RFID tags that log face-to-face contacts for weeks on a coin cell. Built the world's first large-scale real-time conference tracking system for the 2006 Chaos Communication Congress: custom-designed hardware for each of the 1,000 visitors and custom networked RFID readers that located them to within meters. Later used in social-network research with SocioPatterns and in museum installations worldwide.
-
Security & IoT
Prior work Xbox-Linux project 2002Xbox security analysis and Xbox-Linux
As a founding member of the Xbox-Linux project, helped analyze and break the trusted-computing security of the first Xbox in 2002, ported the first Linux system to the console and built a networked Linux distribution that fit into one megabyte of onboard flash. The work is documented in Andrew Huang's book Hacking the Xbox.
-
Security & IoT
Open the interactive explorerPrior work Open-source tool 2018
Arm Trusted Firmware-M explorer
An interactive memory explorer for Arm Trusted Firmware-M, the open-source PSA reference firmware for Cortex-M. It shows the code size and memory consumption of a TF-M build as a zoomable sunburst, from the MCUboot BL2 bootloader to the complete TrustZone-M layout of an RTX application across the secure and non-secure worlds, on the CoreLink SSE-200 subsystem (MPS2+, AN521). The size-optimized builds behind it are produced automatically in Docker on CircleCI.
Tell us what you want to build.
Write to us at contact@bitqan.ae for collaboration or a free consultation. We look forward to hearing from you!
