To promote research and education in cyber defence, EPFL and the Cyber-Defence (CYD) Campus launched a rolling call for Master Thesis Fellowships – A Talent Program for Cyber Defence Research.
This month we introduce you to Nicolae Binică, a CYD Master Thesis Fellowship recipient, who is finishing up his Master Thesis in the System Security Group at ETH Zurich.How did you find out about the CYD Fellowships and what motivated you to apply?A friend of mine did his master's thesis at the CYD Campus, so I had been aware of the fellowship since the start of my master's degree. For my semester project, I worked with Daniel Hulliger from the CYD Campus, and I really enjoyed both the topic and the support I received. So when another exciting topic was listed just as I was looking for a master's thesis, I was glad to take it on, and motivated to apply for the CYD fellowship alongside it.What was your CYD Fellowship project about?My project assesses the security of consumer drones, specifically DJI's latest models, by analysing their firmware end to end. This spans the full stack: classical hardware techniques to extract the firmware, static analysis of the extracted binaries, live fuzzing of the device's protocol handlers and live analysis of the on-board TEEs. The goal is to evaluate the real and secure world security posture of these drones and hopefully discover vulnerabilities to then responsibly disclose them to the manufacturer.What were the advantages of conducting your master thesis project at the CYD Campus?The biggest advantage is the sheer depth of knowledge you have access to. You are surrounded by experts from across many security fields, all genuinely open to helping. One of my favourite experiences was a "hardware hacking day," where we learned the basics of desoldering and resoldering chips and how to reason about security at the hardware level, hands-on skills that I never had the chance to learn before.Did you as a child dream of working in cyber defence?Definitely not! I always liked computers as a kid and even started learning to code in school, but I assumed I would end up making video games. My interest in cybersecurity only came after high school. It actually started with a Game Theory YouTube video showing how many of the hacks in the game Watch Dogs aren't far from reality. It was a small thing, but it flipped a switch in my brain on how I saw technology. I realised how easily many of the systems we depend on can be broken, and how much that can affect the lives of ordinary people.What is driving you to pursue research in cyber defence?I like the variety in security, from hardware attacks like cold boot, to low-level binary analysis, to high-level application exploits. There is always something new to explore and learn. Combined with the fact that security is relevant for every system we rely on, including ones with real safety and national-defence implications like the drones I study, it feels like a field where curiosity and real impact go hand in hand.What is the most important lesson you have learned in your scientific career so far?Don't overthink it, just do it! I have often caught myself over-analysing a problem instead of acting, only to reach the same outcome I would have found by simply starting. I am not saying skip understanding the task, but don't try to predict every possible outcome before you have even begun. And if you make a mistake, that’s ok! Now you won’t forget it and you’ll know how to handle it next time. I’ve probably learned more from “debugging rabbit holes” than from any lectures at university.What are you most proud of in your career to date?Until recently I would have named one of two things. The first is finishing the Hardware Security class at ETH, where I implemented attacks like Rowhammer, Spectre, and Meltdown. Achieving privilege escalation by randomly reading some memory in the user space felt like black magic, and I am proud I figured it out. The second is my semester project building a Binary Ninja plugin for the Xtensa architecture, a tool with real-world impact that helps other security researchers do their work.Now, though, I think my thesis is becoming my proudest achievement. I am learning so much and really enjoying the topic, and the results so far have been very promising.Outside the lab, what do you enjoy doing most?I love spending time with family and friends, usually over board games or video games. Sport is a big part of my life too: I go to the gym regularly, run occasionally, and I am always eager to try something new. I also have a passion for music, playing the piano when I find the time and collecting vinyl records.What were your expectations about the CYD Fellowships?Much like my semester project, I expected great supervision and a supportive environment, and that's exactly what I had. Also, thanks to the living allowance, I was also expecting to have more time to pour into my thesis, which I really enjoyed.Could you share some tips with future applicants who are considering applying for the CYD Fellowships?Just do it! A lot of students find the application process intimidating, but it's a fantastic opportunity. My main advice is to plan ahead: start early, and especially think about who you will ask for recommendation letters, since those are usually the bottleneck in the process.
