Research Associate / Post-Doctoral Researcher

Contact: +49 (0) 6151 / 1621725 | zimmer@peasec.tu-darmstadt.de

Technical University of Darmstadt, Department of Computer Science,
Science and Technology for Peace and Security (PEASEC)
Pankratiusstraße 2, 64289 Darmstadt, Room 116

EN

Dr. rer. nat. Ephraim Zimmer works as a postdoctoral researcher at the Chair of Science and Technology for Peace and Security (PEASEC) of Prof. Dr. Dr. Christian Reuter in the Department of Computer Science at Technical University of Darmstadt (TU Darmstadt).

He is PI of the research projects PIONEER (2024-2028), XR-Guard (2024-2028), and AIDA (2025-2029) funded by the National Research Center for Applied Cybersecurity ATHENE. The projects are focusing on personal privacy assistants, the detection and intervention of virtual physical perception manipulation in eXtended Reality, as well as the mitigation of deceptive designs (dark patterns) via a technically assisted citizen science approach. He is also one of the program coordinators of the IWS-Master at the IT department of TU Darmstadt.

Before, he worked as a postdoctoral researcher and scientific coordinator in the Doctoral College “Privacy and Trust for Mobile Users” funded by the German Research Foundation (DFG). The Doctoral College was an interdisciplinary collaboration between Computer Science and the fields of Law, Economics, Sociology, and Psychology and hosted 13 PIs as well as 13 PhD candidates from three different Universities.

Ephraim received his PhD in Computer Science in October 2020 at the University of Hamburg, where he worked on his thesis on the topic of privacy-friendly mitigation of insider threats between 2016 and 2020.

For that, he joined the working group Security in Distributed Systems of Prof. Dr. Hannes Federrath in 2014 and since then he provides lectures, seminars, projects, and exercises. He supervises students, who work on their Bachelor, Master, and PhD thesis, and he successfully applies for and works on attracted third-party funded research projects.

In 2014, Ephraim graduated as Diplom-Informatiker at the TU Dresden with a major in IT security and privacy. His diploma thesis on the theoretical and practical integration of post-quantum cryptography into IPsec/IKEv2 ranked 2nd in the CAST Förderpreis IT-Sicherheit 2014.

Before that, he was granted a one-year-scholarship of the German Academic Exchange Service (DAAD) for studying abroad at Auckland University of Technology (AUT), New Zealand, where he extended his knowledge in digital forensics and network security. Alongside his studies, he worked as a teaching assistant at AUT University and delivered lectures and tutorials in mathematics and IT.

Research Interests:

  • Possibilities, boundaries, and risks of insider threat detection and prevention
  • Principles and recent developments of privacy-enhancing technologies
  • Mechanisms of user activity monitoring as basis for threat prevention and digital forensics
  • Classical cryptography, post-quantum cryptography, and cryptanalysis
  • Network security, tools, and techniques

DE

Dr. rer. nat. Ephraim Zimmer arbeitet als Postdoktorand am Lehrstuhl Wissenschaft und Technik für Frieden und Sicherheit (PEASEC) von Prof. Dr. Dr. Christian Reuter im Fachbereich Informatik der Technischen Universität Darmstadt.

Er ist PI der Forschungsprojekte PIONEER (2024-2028), XR-Guard (2024-2028) und AIDA (2025-2029), die vom Nationalen Forschungszentrum für Angewandte Cybersicherheit ATHENE gefördert werden. Die Projekte beforschen persönliche Privatsphäre-Assistenten, die Erkennung und Intervention von Wahrnehmungsmanipulationen in Virtuellen und Erweiterten Realitäten sowie die Abwehr von Dark Patterns mithilfe eines Ansatzes der Bürgerforschung. Darüber hinaus ist er einer der Studiengangskoordinatoren des Masterstudiengangs “Internet und Web-basierte Systeme” am Fachbereich Informatik der TU-Darmstadt.

Zuvor arbeitete er als Postdoktorand und wissenschaftlicher Koordinator im Graduiertenkolleg “Privatheit und Vertrauen für Mobile Nutzende”, gefördert durch die Deutsche Forschungsgemeinschaft (DFG). Das Graduiertenkolleg war eine interdisziplinäre Zusammenarbeit zwischen der Informatik und den Disziplinen der Rechtswissenschaften, Wirtschaftswissenschaften, Soziologie und Psychologie und erlaubte 13 PIs und 13 Doktoranden von drei unterschiedlichen Universitäten die Forschung am besagten Leitthema.

Ephraim promovierte in der Informatik im Oktober 2020 an der Universität Hamburg, wo er zwischen 2016 und 2020 an seiner Doktorarbeit zum Thema “Datenschutzfreundliche Erkennung und Abwehr von Insiderbedrohungen” arbeitete.

Dafür schloss er sich 2014 dem Lehrstuhl Sicherheit in Verteilten Systemen von Prof. Dr. Hannes Federrath an und führt seitdem Vorlesungen, Seminare, Projekte und Übungen durch. Er betreut Studenten bei ihren Bachelor-, Master- und Doktorarbeiten und arbeitet an eigenen erfolgreich eingeworbenen Drittmittelprojekten.

Im Jahr 2014 schloss Ephraim sein Studium als Diplom-Informatiker an der Technischen Universität Dresden mit seinen Schwerpunkten in IT-Sicherheit und Datenschutz ab. Seine Diplomarbeit zur theoretischen und praktischen Integration von Post-Quanten-Kryptographie in IPsec/IKEv2 erreichte den 2. Platz des CAST Förderpreis IT-Sicherheit 2014.

Zuvor erhielt er ein Stipendium des Deutschen Akademischen Austauschdienstes (DAAD) für ein Auslandsstudium an der Auckland University of Technology (AUT) in Neuseeland, wo er sein Wissen und seine Fähigkeiten in der Digitalen Forensik und der Netzwerksicherheit vertiefte. Neben seinem Auslandsstudium arbeitete er als Lehrassistenz an der AUT University und hielt Vorlesungen und Tutorien in Mathematik und Informatik.
Forschungsinteressen:

  • Möglichkeiten, Grenzen und Risiken der Erkennung und Abwehr von Insiderbedrohungen
  • Grundlagen und aktuelle Fortschritte von Datenschutzfreundlichen Technologien
  • Mechanismen der Beobachtung von Nutzeraktivitäten als Basis für die Abwehr von Bedrohungen sowie für die Digitale Forensik
  • Klassische Kryptographie, Post-Quanten-Kryptographie und Kryptanalyse
  • Werkzeuge und Techniken der Netzwerksicherheit

Publications

2026

  • Simon Althaus, Nikolaos Alexopoulos, Max Mühlhäuser, Christian Reuter, Ephraim Zimmer (2026)
    WOOTdroid: Whole-system Online On-device Tracing for Android
    arXiv: 2026.
    [BibTeX] [Abstract] [Download PDF]

    System auditing on Android faces two problems. First, existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them. Second, security-relevant application behavior is mediated through Binder, Android’s kernel IPC mechanism, and is therefore hidden from the syscall layer. The Binder parcels that the kernel does see carry no method names or typed arguments, a disconnect between low-level events and high-level behavior known as the semantic gap. Existing approaches address the semantic gap either by modifying the Android platform, making them difficult to adjust to OS updates, or by instrumenting the traced application in user space, which sophisticated adversaries can evade by bypassing the instrumented framework APIs. We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation. WDSys, an eBPF port of eAudit-style syscall auditing, runs on current Android with at most 3.6\% Geekbench overhead and traces 33\% more syscalls than ftrace. WDBind captures Binder parcels in the kernel and decodes them out-of-process against a framework signature table extracted via Java reflection. We demonstrate WOOTdroid on Pixel 9 devices running Android 16 with an end-to-end case study reconstructing ten security-relevant Binder transactions.

    @techreport{althausWOOTdroidWholesystemOnline2026,
address = {arXiv},
title = {{WOOTdroid}: {Whole}-system {Online} {On}-device {Tracing} for {Android}},
url = {https://arxiv.org/abs/2604.27830},
abstract = {System auditing on Android faces two problems. First, existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them. Second, security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is therefore hidden from the syscall layer. The Binder parcels that the kernel does see carry no method names or typed arguments, a disconnect between low-level events and high-level behavior known as the semantic gap. Existing approaches address the semantic gap either by modifying the Android platform, making them difficult to adjust to OS updates, or by instrumenting the traced application in user space, which sophisticated adversaries can evade by bypassing the instrumented framework APIs.
We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation. WDSys, an eBPF port of eAudit-style syscall auditing, runs on current Android with at most 3.6\% Geekbench overhead and traces 33\% more syscalls than ftrace. WDBind captures Binder parcels in the kernel and decodes them out-of-process against a framework signature table extracted via Java reflection. We demonstrate WOOTdroid on Pixel 9 devices running Android 16 with an end-to-end case study reconstructing ten security-relevant Binder transactions.},
institution = {arXiv},
author = {Althaus, Simon and Alexopoulos, Nikolaos and Mühlhäuser, Max and Reuter, Christian and Zimmer, Ephraim},
year = {2026},
note = {\_eprint: 2604.27830},
keywords = {Security, UsableSec, Projekt-ATHENE-Pioneer},
}

  • Simon Althaus, Alina Stöver, Sara Hahn, Vahan Demirci, Till Feldner, Sebastian Gandenberger, Fransisca Hapsari, Bedirhan Sahin, Max Mühlhäuser, Christian Reuter, Ephraim Zimmer, Nina Gerber (2026)
    Empowering Users with Privacy Knowledge: User Preferences for Content, Presentation, and Customization in Privacy Support Tools
    Gesellschaft für Informatik e.V.. doi:10.18420/muc2026-mci-ws01-194
    [BibTeX] [Abstract] [Download PDF]

    Having sufficient knowledge about privacy and security allows users to make informed, self-determined decisions about their online data. To explore users’ interests in learning privacy and security topics, how they prefer this content presented, how they want their knowledge tested, and which customization options they favor, we conducted an online survey with 66 participants. Results show that, rather than learning about specific technologies, users are more interested in concrete ways to protect their privacy and the consequences of lacking privacy protection. For presenting learning content, users prefer text-based materials enhanced with images and videos. For knowledge testing, they favor multiple-choice questions or assignment tasks. Additionally, users want to track their progress and tailor content to their expertise. With these insights, we lay the groundwork for Privacy Support Tools (PSTs) that provide users with relevant privacy and security knowledge, enhancing their self-determination online.

    @misc{althaus_empowering_2026,
title = {Empowering {Users} with {Privacy} {Knowledge}: {User} {Preferences} for {Content}, {Presentation}, and {Customization} in {Privacy} {Support} {Tools}},
url = {https://dl.gi.de/items/337ac9ec-2c49-4a71-8e88-0bc3649e2cae},
doi = {10.18420/muc2026-mci-ws01-194},
abstract = {Having sufficient knowledge about privacy and security allows users to make informed, self-determined decisions about their online data. To explore users' interests in learning privacy and security topics, how they prefer this content presented, how they want their knowledge tested, and which customization options they favor, we conducted an online survey with 66 participants. Results show that, rather than learning about specific technologies, users are more interested in concrete ways to protect their privacy and the consequences of lacking privacy protection. For presenting learning content, users prefer text-based materials enhanced with images and videos. For knowledge testing, they favor multiple-choice questions or assignment tasks. Additionally, users want to track their progress and tailor content to their expertise. With these insights, we lay the groundwork for Privacy Support Tools (PSTs) that provide users with relevant privacy and security knowledge, enhancing their self-determination online.},
publisher = {Gesellschaft für Informatik e.V.},
author = {Althaus, Simon and Stöver, Alina and Hahn, Sara and Demirci, Vahan and Feldner, Till and Gandenberger, Sebastian and Hapsari, Fransisca and Sahin, Bedirhan and Mühlhäuser, Max and Reuter, Christian and Zimmer, Ephraim and Gerber, Nina},
year = {2026},
note = {Published: Mensch und Computer 2026 - Workshopband},
keywords = {Crisis, HCI, Projekt-ATHENE-Pioneer, Security, Student, UsableSec},
}

  • Simon Althaus, Jacques Jurado, Marc-André Kaufhold, Max Mühlhäuser, Christian Reuter, Ephraim Zimmer (2026)
    Towards Privacy Resilience: Understanding Mobile Privacy Leaks through Runtime Behavioral Reconstruction using eBPF
    Gesellschaft für Informatik e.V.. doi:10.18420/muc2026-mci-ws01-222
    [BibTeX] [Abstract] [Download PDF]

    Apps from the Google Play Store frequently access personal and device-related information, yet users, auditors, and researchers have limited visibility into how this data is processed and potentially disclosed at runtime. Detecting such privacy leaks in the Android system as a means for more privacy resilience is challenging for system administrators and auditors managing several devices, as well as for end users relying on the integrity of their own devices. A variety of apps use a variety of system resources to hide or mask privacy leaking behavior, which is the motivation for dynamic analysis methods, like recording API call traces at process runtime. However, API traces on Android are easily detected by apps. Tracing of system calls in the kernel space using technologies such as the extended Berkeley Packet Filter (eBPF) is more difficult to detect by apps. Still, such traces provide only low-level observations and therefore often struggle to capture deeper insights into application behavior, and often suffer from data overload. In this paper, we propose a privacy leak detection system, which reconstructs Android-specific behavioral semantics from eBPF-recorded runtime information, bridging the gap between low-level system observations and higher-level application behavior to enable more transparent and explainable privacy analysis of Android applications. In addition, a prototype hybrid taint analysis method is developed to precisely trace privacy leaks during application runtime while intelligently handling the large volume of low-level log data. Our evaluation shows that the system runs on physical Android devices and reconstructs behavioral semantics of an Android application at runtime and derives privacy violations from this. Our results demonstrate that reconstructed behavioral semantics can be used to identify privacy-relevant data flows and potential privacy violations. Furthermore, the evaluation of the prototype highlights the challenges of realizing taint analysis based on eBPF and provides insights into open research problems for building transparent and explainable privacy auditing systems on Android.

    @misc{althaus_privacy_2026,
title = {Towards {Privacy} {Resilience}: {Understanding} {Mobile} {Privacy} {Leaks} through {Runtime} {Behavioral} {Reconstruction} using {eBPF}},
url = {https://dl.gi.de/items/905b7747-fcd9-41ab-b7fc-b715ba6da050},
doi = {10.18420/muc2026-mci-ws01-222},
abstract = {Apps from the Google Play Store frequently access personal and device-related information, yet users, auditors, and researchers have limited visibility into how this data is processed and potentially disclosed at runtime. Detecting such privacy leaks in the Android system as a means for more privacy resilience is challenging for system administrators and auditors managing several devices, as well as for end users relying on the integrity of their own devices. A variety of apps use a variety of system resources to hide or mask privacy leaking behavior, which is the motivation for dynamic analysis methods, like recording API call traces at process runtime. However, API traces on Android are easily detected by apps. Tracing of system calls in the kernel space using technologies such as the extended Berkeley Packet Filter (eBPF) is more difficult to detect by apps. Still, such traces provide only low-level observations and therefore often struggle to capture deeper insights into application behavior, and often suffer from data overload.
In this paper, we propose a privacy leak detection system, which reconstructs Android-specific behavioral semantics from eBPF-recorded runtime information, bridging the gap between low-level system observations and higher-level application behavior to enable more transparent and explainable privacy analysis of Android applications. In addition, a prototype hybrid taint analysis method is developed to precisely trace privacy leaks during application runtime while intelligently handling the large volume of low-level log data. Our evaluation shows that the system runs on physical Android devices and reconstructs behavioral semantics of an Android application at runtime and derives privacy violations from this. Our results demonstrate that reconstructed behavioral semantics can be used to identify privacy-relevant data flows and potential privacy violations. Furthermore, the evaluation of the prototype highlights the challenges of realizing taint analysis based on eBPF and provides insights into open research problems for building transparent and explainable privacy auditing systems on Android.},
publisher = {Gesellschaft für Informatik e.V.},
author = {Althaus, Simon and Jurado, Jacques and Kaufhold, Marc-André and Mühlhäuser, Max and Reuter, Christian and Zimmer, Ephraim},
year = {2026},
note = {Published: Mensch und Computer 2026 - Workshopband},
keywords = {HCI, Projekt-ATHENE-Pioneer, Security, Student, UsableSec},
}

    2025

  • Sarah Abdelwahab Gaballah, Lamya Abdullah, Ephraim Zimmer, Sascha Fahl, Max Mühlhäuser, Karola Marky (2025)
    “It’s Not My Data Anymore”: Exploring Non-Users’ Privacy Perceptions of Medical Data Donation Apps
    Proceedings on Privacy Enhancing Technologies (PoPETs) . doi:10.56553/popets-2025-0035
    [BibTeX] [Abstract] [Download PDF]

    This paper contributes an in-depth investigation (N=24) of privacy perceptions in the context of medical data donation apps. Medical data donation refers to the act of voluntarily sharing medical data with research institutions, which plays a crucial role in advancing healthcare research and personalized medicine. To design effective medical data donation apps, we need to understand how privacy expectations affect people’s willingness to use such apps. We focus on non-users—those who have no experience with medical data donation apps—because gaining a deeper understanding of their perceptions is essential for fostering the adoption of these apps. Our findings highlight the importance of trust, transparency, and anonymity as driving factors. Participants expressed a willingness to share highly sensitive medical data with the apps if they were assured of complete anonymity, yet criticism regarding the risks of de-anonymization was also raised. Based on our results, we identify privacy awareness issues, especially concerning data sensitivity. Additionally, we explain the differences between participants’ privacy expectations and preferences and what existing medical data donation apps offer. Finally, we provide guidance for the development of future user-centric medical data donation apps.

    @article{gaballahItsNotMy2025,
title = {“{It}’s {Not} {My} {Data} {Anymore}”: {Exploring} {Non}-{Users}’ {Privacy} {Perceptions} of {Medical} {Data} {Donation} {Apps}},
issn = {2299-0984},
shorttitle = {“{It}’s {Not} {My} {Data} {Anymore}”},
url = {https://petsymposium.org/popets/2025/popets-2025-0035.php},
doi = {10.56553/popets-2025-0035},
abstract = {This paper contributes an in-depth investigation (N=24) of privacy perceptions in the context of medical data donation apps. Medical data donation refers to the act of voluntarily sharing medical data with research institutions, which plays a crucial role in advancing healthcare research and personalized medicine. To design effective medical data donation apps, we need to understand how privacy expectations affect people's willingness to use such apps. We focus on non-users—those who have no experience with medical data donation apps—because gaining a deeper understanding of their perceptions is essential for fostering the adoption of these apps. Our findings highlight the importance of trust, transparency, and anonymity as driving factors. Participants expressed a willingness to share highly sensitive medical data with the apps if they were assured of complete anonymity, yet criticism regarding the risks of de-anonymization was also raised. Based on our results, we identify privacy awareness issues, especially concerning data sensitivity. Additionally, we explain the differences between participants' privacy expectations and preferences and what existing medical data donation apps offer. Finally, we provide guidance for the development of future user-centric medical data donation apps.},
urldate = {2026-02-05},
journal = {Proceedings on Privacy Enhancing Technologies (PoPETs)},
author = {Gaballah, Sarah Abdelwahab and Abdullah, Lamya and Zimmer, Ephraim and Fahl, Sascha and Mühlhäuser, Max and Marky, Karola},
year = {2025},
keywords = {A-Paper, HCI, Projekt-ATHENE-PriVis, Ranking-CORE-A, Security, UsableSec},
}

     

    Former Publications:

    View Calendar