From Game Reverse Engineering to IoT Security — Kostas Ereksonas’s Developer Journey
“Having a community of like-minded individuals also helps tremendously.”
Kostas Ereksonas's journey into cybersecurity began long before he had a formal security role.
It started with a computer.
Then hardware.
Then game modifications.
Then reverse engineering.
And eventually, a much bigger question:
How secure are the connected devices that surround us every day?
Today, Kostas works across cybersecurity, network analysis, IoT security, machine learning and post-quantum cryptography.
His work involves everything from analyzing Android applications and IP cameras to reverse engineering network protocols, studying encrypted traffic and thinking about how organizations will migrate to post-quantum cryptography.
What connects all of these areas is curiosity.
Rather than simply using technology, Kostas wants to understand what happens underneath it.
The First Computer
Kostas first became interested in computers while he was still in primary school.
It was around the time his parents got their first desktop computer.
He immediately became interested in what was happening inside it.
Hardware.
Low-level BIOS settings.
The things most people never needed to touch.
That curiosity soon expanded into something more experimental.
Games became an opportunity to investigate how software worked.
Kostas started modifying games and experimenting with tools such as Cheat Engine.
He wasn't satisfied with simply playing.
He wanted to understand how the game mechanics worked and whether they could be changed.
That naturally led him toward reverse engineering binaries.
At the same time, he began learning the fundamentals of JavaScript and C++ during middle school.
Those experiences eventually convinced him that Information Technology was the direction he wanted to pursue.
From Game Modification to Cybersecurity
Kostas's formal transition into cybersecurity happened while working on his Bachelor's thesis.
The subject was an internet-connected surveillance camera.
The project exposed him to something that changed the way he thought about connected devices.
The camera's security was patchy and outdated.
Instead of simply treating those limitations as part of the project, Kostas became interested in understanding them more deeply.
That investigation pulled him into the world of IoT security.
Along the way, his interests also expanded into data science and statistical analysis of network traffic.
This combination would later become important to his work in network intrusion detection.
Why IoT Security Matters
IoT devices create a particularly interesting security problem.
They are everywhere.
They often have constrained computing resources.
They can remain deployed for years.
And many users understandably assume that a device is safe simply because it is connected behind a router.
Kostas strongly disagrees with that assumption.
An end-of-life IoT device with known vulnerabilities can become a serious security risk if it remains connected to a network containing business-critical or sensitive systems.
Some devices may also contain weak security practices such as hardcoded credentials, weak encryption or undocumented functionality.
The problem isn't necessarily that every IoT device is inherently dangerous.
The problem is that these devices often become part of an organization's attack surface without receiving the same level of security attention as traditional computers and servers.
For Kostas, raising awareness of those risks is an important part of IoT security.
Looking Beyond the Interface
When Kostas investigates an application or connected device, he doesn't start by assuming the interface tells the whole story.
He starts by observing.
For an Android application, that might mean clicking through the application and watching what data moves between components.
For an IP camera or IoT control panel, it might mean observing the communication between the device and its surrounding infrastructure.
The goal is to identify patterns.
Once those patterns become visible, he can begin working out how the underlying system behaves.
Sometimes the technology turns out to be based on a familiar standard.
For example, while analyzing an Android application, Kostas encountered a standard AES-CBC implementation used for locally stored data.
The cryptographic algorithm itself wasn't unusual.
The problem was how it had been implemented and configured.
Hardcoded keys and passwords don't suddenly become secure simply because a standard encryption algorithm is being used.
The same principle applies to network protocols.
When a protocol operates over TCP/IP, tools such as Wireshark can reconstruct the network byte stream.
The researcher's job then becomes understanding how those bytes correspond to the application's protocol.
The Investigation That Required Everything He Had Learned
One of Kostas's most challenging investigations involved a Perenio Peifc01 IP camera.
The difficulty wasn't necessarily that the device used an impossibly complicated technology.
It was that there wasn't much existing research available about that particular model.
Compared with more widely investigated IP cameras, there were fewer write-ups and fewer resources to build upon.
That meant Kostas had to rely heavily on experience gained from previous investigations.
He applied what he had already learned from analyzing IP cameras and their Android applications.
That experience helped him identify how locally stored data was protected and analyze the audio and video stream transmitted through RTP over UDP.
Wireshark became an important part of understanding what was happening on the network.
The investigation reinforced an important lesson:
Previous investigations become tools for future investigations.
Every device teaches you something that can become useful when the next unfamiliar system appears.
The Dangerous “It's Behind a Router” Assumption
One of the security assumptions Kostas considers particularly dangerous is:
“It's behind a router, so it must be safe.”
A router is not a security guarantee.
An IoT device can communicate with external cloud services.
It can contain vulnerabilities.
It can become compromised.
And once an attacker controls one device inside a network, that device may become a stepping stone toward other systems.
Cloud communication introduces additional considerations as well.
A compromised or poorly secured device may communicate with its vendor's infrastructure in ways that create additional attack opportunities.
For Kostas, network isolation and understanding what devices are actually communicating with are therefore critical parts of securing IoT environments.
Detecting Attacks When Traffic Is Encrypted
Modern network security faces another major challenge:
Much of today's network traffic is encrypted.
Traditional payload inspection becomes more difficult when security systems cannot simply inspect the contents of every packet.
That makes statistical analysis increasingly useful.
Instead of asking only:
“What does this packet contain?”
security systems can ask:
“Does this traffic behave normally?”
For example, a system might examine characteristics such as packet counts or connection behaviour within a particular time window.
An unusual pattern can then become a signal worth investigating.
This approach doesn't replace traditional security analysis.
Instead, it adds another layer.
The system learns what normal behaviour looks like and searches for deviations.
Where Machine Learning Can Help
Kostas sees several promising applications for machine learning in cybersecurity.
Network and Endpoint Anomaly Detection
Machine learning can model relationships between many network traffic characteristics and identify deviations from normal behaviour.
This can be particularly useful when the data contains many interacting variables that would be difficult to monitor manually.
Detecting Previously Unknown Attacks
Machine learning can also help identify patterns that haven't previously been classified.
That could potentially help researchers investigate previously unseen attacks.
But Kostas emphasizes an important limitation.
An unusual pattern isn't automatically malicious.
It could simply be a legitimate action that the system hasn't encountered before.
Human review remains important.
Malware and Behavioural Analysis
Models can also be used to analyze characteristics such as binaries, system calls, API behaviour, memory characteristics and process trees.
Phishing and Social Engineering
NLP and LLM-based systems can analyze emails, URLs, domains and contextual signals to identify potentially malicious communication.
Alert Prioritization
Security operations teams can receive enormous numbers of alerts.
Machine learning can help prioritize those alerts.
But the challenge remains balancing detection with false positives.
A system that flags everything isn't useful.
A system that misses important attacks isn't useful either.
The quality of the underlying data therefore becomes critical.
Research and Engineering
Kostas describes one of his biggest lessons from combining research and engineering in a simple way:
Be methodical and persistent.
Security research can involve long periods where the answer isn't obvious.
A device may not behave as expected.
A protocol may not be documented.
Existing research may not exist.
A model may produce an unexpected result.
The temptation is to jump from one idea to another.
Instead, Kostas's approach is to keep investigating systematically.
Observation.
Experimentation.
Analysis.
Iteration.
Then repeat.
Preparing for the Post-Quantum Era
Another major area of Kostas's work is post-quantum cryptography.
He was given an opportunity to work on a project involving Quantum Key Distribution, which introduced another dimension to his security research.
But the larger issue is broader than quantum networking.
Organizations need to start thinking about post-quantum migration now.
Why?
Because cryptographic migration takes time.
Some information being protected today may need to remain confidential for decades.
An attacker could potentially capture encrypted information today and store it.
If sufficiently powerful quantum computers become available in the future, some current public-key cryptographic systems could become vulnerable.
That creates a particularly important problem for long-lived sensitive information.
Intellectual property.
Financial records.
Government information.
Personal data.
The challenge isn't simply replacing one cryptographic algorithm with another.
The Real Problem Is Finding the Cryptography
One of the hardest parts of post-quantum migration may actually happen before any algorithm is replaced.
Organizations first need to know:
Where is cryptography being used?
It isn't always obvious.
Cryptographic dependencies can exist inside:
- Libraries
- Network protocols
- Firmware
- Hardware security modules
- Third-party SaaS platforms
- Legacy applications
- Proprietary communication protocols
- Operating systems
- Infrastructure services
An organization may know it uses TLS and certificates without knowing every underlying place where RSA, ECC or Diffie-Hellman dependencies exist.
IoT creates an additional complication.
A camera, industrial controller or network appliance may have limited CPU, RAM or flash storage.
It may also have a deployment lifetime of ten or fifteen years.
Replacing the hardware simply because its cryptography is no longer suitable isn't always practical.
And even if an organization is ready to migrate its own software, its vendors and infrastructure providers may not be ready.
That makes cryptographic inventory and crypto agility increasingly important.
Security Must Work Outside the Laboratory
For Kostas, one of the biggest challenges in emerging security technologies is proving that something works in the real world.
A technology can perform extremely well in a controlled benchmark.
Production environments are different.
Real networks contain:
- Legacy systems
- Proprietary devices
- Encrypted protocols
- Unusual traffic
- Previously unseen behaviours
- Unexpected interactions
A solution that works perfectly under controlled conditions may behave very differently when exposed to that complexity.
That's why practical evaluation matters.
Security research shouldn't stop at the benchmark.
It needs to be tested against environments that are messy, changing and unpredictable.
Kostas doesn't believe there is one universal security tool.
The tools he uses depend on the problem.
An Android application investigation requires a different workflow from network protocol analysis.
A QKD simulation requires something different again.
A post-quantum cryptography inventory script has its own requirements.
His toolkit includes technologies such as:
- Wireshark
- Python
- JavaScript
- C++
- Frida
- Burp Suite
- Lua
The important part isn't memorizing a list of tools.
It's knowing which tool is appropriate for the problem in front of you.
And being comfortable reaching for something new when an unexpected problem appears.
Curiosity Is Part of the Job
Cybersecurity changes constantly.
New vulnerabilities appear.
New protocols emerge.
New attacks are developed.
New defensive technologies are introduced.
For Kostas, staying current requires more than reading about those changes.
Curiosity matters.
Hands-on experimentation matters.
Open-source research matters.
Platforms such as TryHackMe can also provide useful environments for learning and experimentation.
The important thing is to keep finding interesting problems to solve.
A new challenge can become a reason to learn an unfamiliar technology.
And that learning can later become useful when facing a completely different security problem.
The Moment IoT Changed His Perspective
Learning how insecure IoT devices can be had a direct impact on how Kostas approaches security in his own life.
It changed how he thinks about his home network.
It also made him more diligent when securing enterprise environments.
The lesson was simple:
Security assumptions are dangerous when they aren't tested.
A device might appear harmless.
A network might appear isolated.
A protocol might appear secure.
But understanding what is actually happening is more important than trusting appearances.
That principle has become part of how Kostas approaches security research.
Where Cybersecurity Is Heading
Looking five years ahead, Kostas sees several areas increasingly converging:
AI.
IoT security.
Post-quantum cryptography.
Rather than remaining separate disciplines, he expects them to become parts of the same security engineering problem.
One particularly interesting possibility is IoT systems that can continuously detect unusual behaviour, authenticate themselves, adapt to changing conditions and eventually migrate their cryptography without requiring hardware replacement.
AI could help deal with the enormous diversity of IoT devices.
A small specialized model running close to an IoT gateway could learn the normal communication pattern of a camera, for example.
If that camera suddenly begins communicating with an unfamiliar service, the system could flag the behaviour without needing to inspect the encrypted payload.
This kind of edge intelligence could become increasingly important.
Post-Quantum IoT
The combination of IoT and post-quantum cryptography presents another enormous engineering challenge.
Millions of cameras, sensors, routers and industrial devices may have long deployment lifetimes and limited resources.
Updating their cryptographic foundations isn't simply a software upgrade.
It can involve:
- Device identity
- Secure boot
- Firmware updates
- Machine-to-machine authentication
- Hardware limitations
- Compatibility
- Cryptographic agility
The challenge is making future security possible without requiring organizations to replace every device in the environment.
For Kostas, that is one of the areas worth watching closely.
Advice for Aspiring Security Researchers
Kostas's first piece of advice is surprisingly simple:
Have fun.
Enjoy the process of figuring things out.
Curiosity is one of the most useful qualities a security researcher can have.
He also believes community matters.
Having people around you who are interested in similar problems can make a huge difference.
For anyone looking to build a strong technical foundation, Kostas recommends developing knowledge in several areas.
Linux Internals
Understand processes, filesystems, permissions, sockets, /proc and system calls.
Networking
Learn TCP/IP, DNS, TLS, HTTP, MQTT, RTSP/RTP, UDP and routing.
C/C++ and Python
C and C++ provide valuable insight into vulnerable systems and binaries.
Python is extremely useful for tooling and automation.
Assembly
Develop basic familiarity with x86-64 and ARM.
Operating Systems
Understand memory management, processes, threads and inter-process communication.
Cryptography
Learn the fundamentals:
Hashing.
MACs.
Encryption.
Key exchange.
Certificates.
PKI.
These foundations make it much easier to understand what is happening when investigating a real system.
Start With a Real Device
Kostas also recommends a practical starting point for aspiring IoT security researchers:
Buy an inexpensive IoT device and investigate it.
An IP camera.
A smart plug.
An IoT hub.
The objective isn't simply to find a vulnerability.
It's to learn how a real connected system works.
Study the device.
Understand its network behaviour.
Look at its web interface if it has one.
Capture and analyze its traffic.
Understand the protocols involved.
If it has a companion mobile application, study how the application communicates with the device.
The process can teach far more than simply reading about IoT security.
It turns abstract concepts into something tangible.
From Curiosity to Security Research
Kostas's journey began with curiosity about a computer his parents brought home.
That curiosity led to hardware experimentation.
Then game modifications.
Then reverse engineering.
Then university.
Then cybersecurity.
And eventually into some of the most interesting security problems emerging today.
IoT security.
Network intrusion detection.
Machine learning.
Quantum security.
Post-quantum cryptography.
What connects these subjects is not a particular programming language or tool.
It's a way of thinking.
Observe the system.
Understand its behaviour.
Question assumptions.
Experiment.
And keep investigating until the pieces make sense.
For Kostas, cybersecurity isn't simply about breaking systems.
It's about understanding them well enough to make them harder to break.
About Kostas Ereksonas
Kostas Ereksonas is a Security Engineer and cybersecurity researcher specializing in computer networks and IoT security.
His interests include network intrusion detection, reverse engineering, Android application security, IoT security, machine learning for cybersecurity, quantum security and post-quantum cryptography.
He holds Bachelor's and Master's degrees in Information Technology Engineering from Klaipeda University.
His work includes security analysis of IP cameras and Android applications, network protocol reverse engineering, QKD research and post-quantum cryptography inventory work.
View Kostas's profile on CoderLegion
CoderLegion Developer Stories
Real developers. Real journeys. Real experiences.
Developer Stories at CoderLegion gives developers an opportunity to share how they think, what they build, the problems they encounter and what they learn along the way.
Interview & Story by Mehadi Hasan
