5 minutes with a reverse engineer ー Ivan Kwiatkowski

## Overview

This interview features Ivan Kwiatkowski, a senior security researcher at Kaspersky's GReAT team, discussing his specialization in reverse engineering and his journey in cybersecurity. The interviewer, Liza, explores how he entered the field, what aspects he finds most engaging, and offers insights for aspiring security professionals.

## How He Entered Cybersecurity

Ivan began his cybersecurity career at age 19 while studying general computer science. He developed an interest in Wi-Fi security, took online classes, and never left the field. He emphasizes that his early introduction and consistent engagement set the foundation for his career.

## Reverse Engineering Focus

Although he initially thought offensive penetration testing would be his preferred specialization, Ivan discovered his passion for reverse engineering—reading and understanding malware code. He explains his preference by noting that unlike penetration testing, where success is uncertain, reverse engineering through persistent effort always yields results. This certainty of eventual success through hard work is what he values most.

## Challenges and Rewards

The most challenging aspect of the job is maintaining persistence. Hours spent analyzing seemingly meaningless instructions and CPU operations can be mentally draining and feels "against nature." However, the satisfaction comes from eventual success after sustained effort—a feeling that drives him forward despite the difficulty.

## Notable Discovery

Ivan's proudest achievement was connecting new traces of malicious activity called "Tomiris" to the existing SolarWinds incident. This discovery was significant because it identified previously unnoticed connections to a major case that impacted the world.

## Career Advice

He recommends newcomers only pursue cybersecurity if they are genuinely passionate, as the learning curve is steep and requires substantial personal commitment. Success requires doing what you love and persisting until you achieve your goals.

## Learning Preferences and Tools

Regarding learning methods, Ivan has evolved from using videos to preferring books and articles for their efficiency in accessing specific knowledge. Regarding tools, he mentions that while he long relied on Iproat, recent developments in Ghidra (an open-source alternative) suggest a viable transition path.

## Culture and Practical Insights

On naming malware or APT groups, he prefers clever or funny names over formal conventions. For media recommendations, he cites Mr. Robot (seasons 1–5) as uniquely accurate in technical representation. He also highlights an effective but seemingly counterintuitive protective measure: regularly rebooting phones can remove sophisticated malware that does not persist across reboots.