I’m an IT Security expert with the specialization in web security and NFC solutions. I also do some backend development and DevOps/system administration.
Certifications
- OffSec Web Expert (OSWE) - since November 6th, 2025
Projects
Near-field communication (NFC)
- nfc-developer / sdm-backend - Example backend server for Secure Dynamic Messaging (SDM)
- icedevml / react-native-host-card-emulation - Host Card Emulation (HCE) library for React Native, supporting both iOS and Android targets (including background HCE operation on Android)
Malware analysis tools
- CERT-Polska / DRAKVUF Sandbox - The first open-source hypervisor level malware sandbox for x86/x64 architecture (based on DRAKVUF by Tamas K Lengyel, LibVMI and Xen project)
- CERT-Polska / mquery - Blazingly fast Yara queries for malware analysts
Crypto/X.509
- icedevml/pyksef - Python KSeF Authentication Library (for PKCS#11 and local private keys), for Polish National E-Invoicing System
- icedevml/python-pdf-scsigner - Python CLI script for creation of qualified signatures on PDF files
- icedevml/pykmstool - Google Cloud KMS Certificate Signing Request (CSR) Generation Tool (CLI utility)
- icedevml/crl2ocsp - Experimental project: OSCP responder that consumes CRL lists as a source of truth
- icedevml/kms-attest-verifier - A tool to verify the HSM attestation files provided by Google Cloud KMS
Misc
- icedevml/zxp-native-usb-adapter-64bit-hack - Unofficial patch for ZXP Card Java SDK to resolve compatibility issues
Conferences and other public appearances
- [EN] CONFidence 2022: DRAKVUF Sandbox - Open source, self-hosted malware sandbox in hypervisor (with Adam Kliś)
- [PL] Interview: Rozmowa Kontrolowana - Odcinek 66 - Michał Leszczyński
- [PL] Oh My H@ck 2020 - Miałem WordPressa, ale mi zhakowali
- [EN] The Standoff 365 (2020) - A few stories about virtual machine introspection and malware monitoring (with Adam Kliś)
- [EN] Virus Bulletin 2020 - A new open-source hypervisor-level malware monitoring and extraction system (with Krzysztof Stopczański)
- [PL] PWNing 2019 / SECURE 2019 - Monitorowanie i rozpakowywanie złośliwego oprogramowania na poziomie hypervisora (with Krzysztof Stopczański)
- [PL] What The Hack 2018 - Hardware RE: hakujemy firmware zamka hotelowego i piszemy lepszy (with Jarosław Jedynak and Marek Klimowicz)
- [PL] PWNing 2018 - Hardware RE: hakujemy firmware zamka hotelowego i piszemy lepszy (with Jarosław Jedynak and Marek Klimowicz)
- [PL] SECURE 2018 - Jak zorganizować CTF i przetrwać, czyli organizacja konkursów dla hakerów z perspektywy admina
- [PL] Secure 2018 Early Bird - Meltdown i Spectre - co tam się stało?
Publications (PL)
- Meltdown and Spectre explained: Processor hacking (with Jarosław Jedynak and Michał Purzyński)
- Analysis of Przelewy24 mobile payment library from the security point of view
- Practical cryptography: Hashing, digital signatures and key derivation (with Jarosław Jedynak)
- Implementing web authentication using asymmetric cryptography (with Jarosław Jedynak)
- Algochecker project - a scalable Docker-based platform for automated testing of programs (with Dmytro Ievseienko, Paweł Paczuski, Przemysław Miazga)
- In response to XSS attacks - Content-Security-Policy mechanism
- SSL client certificates - how to deal with that?
- Hacker versus programmer, the thing about security of PHP web applications
Past projects
- Apartament4you - backend development and security audit; taking care of proper synchronization with external systems (like Booking.com)
- Algochecker - the Docker-based online judge platform developed at the WUT’s Faculty of Electronics and Information Technology (WEiTI PW); currently used for organization of teaching (and sometimes for some competitions); source code available on GitHub