Dive into my latest experiments in digital security, from exploit analysis and reverse engineering to advanced network defense configurations and protocols. Find out more about what drives my curiosity and passion for cybersecurity.

More sporadically than I'd like, I immerse myself in the world of CTF competitions. These challenges are more than just games; they are a playground for creative problem-solving and a vital way to stay ahead of evolving attack vectors. My experience spans low-level binary exploitation at ETHZ's Information Security Lab, rigorous hands-on training in the Software Security Course at EPFL, and competing in the Swiss Hacking Challenge 2026, where I placed in the top 50 out of 260+ participants. From reverse engineering and cryptography to web security and forensics, the challenges are very diverse and creative. They are a great way to learn about good old security practices. However, I believe that some challenges are not up to date with the latest security trends and attack vectors, so I am staying informed by reading the latest security news on The Hacker News each week.

Network Security has piqued my interest quite a bit. In the Network Security class at ETHZ, I built a (low-performance) Python-based firewall. This project incorporated modern defense mechanisms such as rate limiting, port scan detection, stateful handling of malicious (bogus) UDP/TCP packets, blacklisting, as well as Network Address Translation (NAT). Implementing a firewall system highlighted the critical tension between efficient, high-performance security enforcement and the necessity of minimizing false positives. A second project in this class was to set up and explore the SCION architecture. SCION is a future Internet architecture designed to be secure, available, and robust by design, addressing major security issues of the current IP- and BGP-based Internet. In the Network Security class, I explored its fundamental concepts, such as path-aware networking, control-plane isolation, and trust root delegation. The project involved setting up a SCION environment in Go and communicating over its channels.

Another thing I did was set up a home lab for networking and security experiments. I used it as a centralized log aggregation system with corresponding dashboards for analysis for some time, but now only as a VPN and DNS sinkhole to block malicious domains.

The future of secure authentication are Passkeys. In a group of two, we implemented a website that used WebAuthn to replace traditional passwords with cryptographic keys stored securely on the device. Our main motivation was to understand how underlying algorithms like FIDO2, public-private key cryptography, and attestation work. This project granted us a much deeper understanding of user identity and zero-trust security models. For reference, we also added normal username & password logins as well as 2FA!

There are many more projects that I have worked on, but I won't list them all here. They include attacks on trusted execution environments, formal verification with Tamarin, adversarial examples on machine learning models, a shopping list web app, distributed large-scale real-time routing for SBB with hadoop and spark, movie recommender systems, high-performance C implementations (vectorized, optimized for cache and instruction mix), or Get-Together, a web app for trip planning.

However, I do want to mention one project that has a special place in my heart: this website. Since 2023, I have been updating, improving and maintaining it to the best of my ability. Without knowing HTML, CSS, or JavaScript, I started and arrived at the current static website you're seeing. The process was sometimes hard but mostly fun, since I directly saw the results of my work. I really hope you like the contents and the design. If you happen to have any feedback, I would be glad to hear it! Alright, that's all for now. If you came this far, I wish you all the best, thanks a lot for reading, and peace out! ✌🏽