Hardware Hacking With Matt Brown  Welcome to Syntax. Today we have Matt Brown on. He is a YouTuber and security consultant who specializes in pentesting IoT hardware. He has a YouTube channel that's filled with fascinating videos. So for example, he found dozens of unsecured police license plate cameras and they had a video feed. It had a stream of all of the data which include the license plates, the car making model and the GPS coordinates. He's hacked his smart grill and extracted the firmware from that. and he's dove into the network activity of dozens of cheap Chinese cameras and recently he let Claude Code rip on one of them which was really interesting. So we've had him on today to talk about how all of this hardware hacking stuff works, the legality of it and hopefully a few interesting stories. Welcome Matt. Thanks for coming on. >> Thank you for having me. >> Yeah. So I've been watching your YouTube channel for I don't know probably for about a year now. I I'm not sure how I stumbled upon it, but you have these really good breakdowns of how you can take a piece of hardware um and then just dig into how it works or find some pieces of interesting pieces that you may not necessarily know or buying something that's from um like a different industry like the police license plate readers and then you could just buy one yourself and then just dig into it and you find all the API endpoints and then you realize, oh, this is maybe not as secure as as we thought thought it would be. So, um, look, h how do you even get into all of this stuff? >> That's a that's a great question. I, uh, I guess the the chief kind of hacker mentality of curiosity and letting that lead you in, in the discovery of information and knowledge has always been a thing that I've done since my youth. So, uh, you know, back in back in my high school and college days, you know, messing around with computers at my school, uh, things like that, I've always been interested in going to thrift stores. Back when I was in high school, I would go to Goodwill, uh, which is a a US-based thrift store. Uh, I don't know if they have them outside the United States, but >> yeah, we have them in Canada. >> Oh, sweet. So, I would just go buy used electronics and take them apart and see if I could like take them apart, put them back together, see how they worked. And that led me uh deeper and deeper down the hardware hacking rabbit hole where now I on my on my channel, I like to just buy used devices, take them apart, and usually I'm after two things. Uh I I'm usually like you said interested in kind of revealing knowledge that might have security applications in the software. Funny the funny thing is there are people that are like deep hardware silicon silicon >> uh hardware security researchers and that's actually not really my thing. Usually hardware hacking is like a means to an end to hack on software or hack on APIs uh to to reveal, you know, APIs that I wouldn't have known existed maybe unless I dug into a piece of hardware. >> Okay, that's that's really interesting to me because like in in the web development world, we love spelunking into the dev tools. you know, you open up the network tab and you see what's going on or um we have an an app on the desktop called proxy man and that will allow you to monitor traffic that's coming in and out of it. And some of us dip into like maybe even like Wireshark where you get a little bit past like just HTTP traffic and and into some of the lower level stuff. But once once it ends on like something running on your machine or maybe something running on like your phone and you proxy your phone's traffic through your computer, that's kind of where it ends for me of like dipping into it. And there's always like these like like you get a camera or you get like this thing that you connects to your Wi-Fi and I'm always curious like man like what are the API calls um happening there and it's it's kind of tricky. So, like let's say you pick up a piece of hardware, what are your like first steps for sort of breaking that down, trying to find out what the APIs are? >> Yeah. So, if I'm looking at kind of your standard IoT device that is going to make calls out to some backend server on the internet, most of the time that's going to be wrapped in TLS, right? So, just opening it up in Wireshark, I'm going to get a host name and nothing more. I'm not going to get any endpoint information. And I'm not going to like cuz what we want, right, is we want it to be like the network tab on in DevTools. We want to actually see uh the requests and the responses cuz then as security, you know, from a security or maybe just a tinkering perspective, maybe you want to write your own application that interacts with the backend, right? Kind some kind of a third party thing there. There's all sorts of applications of this this hardware hacking uh work. And so there's a couple of avenues. One is if we can get a root shell on that device, if we can if we can if we can gain control over the device, then we could potentially put a our own CA certificate in the trust store of that device. kind of like if you've ever used uh Burp Suite or any of these proxying tools to look at web traffic from your web browser, you have to go in either to your computer's trust store or the browsers like uh Firefox has its own independent trust store. Uh Chrome uses the OSS and you have to add the proxy certificate to allow it to terminate that SSL that TLS communications. So that's why when like you get like a laptop from your employer and they install their own certificate, they're able to even though the website you're going to may be HTTPS, they're still able to see every request that's that's coming through there because they literally are putting a secured certificate in the the chain, right? >> That's exactly right. >> Yeah. So we can effectively do the same thing in the hardware world if we if we if we obtain a root shell or we're able to you know modify that firmware somehow modify the running device and put our cert into the trust store and I say trust store we have to do some reverse engineering sometimes it's it's like a common Debian system where it's going to be in you know Etsy SSL you know uh s certificates or something like that that's really common sometimes it'll be super hardcoded into a binary that you kind of have to do some reversing and mod modifying of the system to figure out how to uh put yourself in that chain of trust. But once we put ours in that chain of trust, then we can use a a transparent or an intercepting proxy which Burpuite and Kaido they do have a mode where you can enable that and allow it to to proxy your traffic. Now then you have to you have to do some network shenanigans maybe with IP tables or something with your router to uh convince your device to route its traffic through this system that has a transparent proxy. But at that point we we are able to see all the contents of those uh that HTTP communication. And if you want to see all of the errors in your application you'll want to check out Sentry at centry.io/sax. You don't want a production application out there that well you have no visibility into in case something is blowing up and you might not even know it. So head on over to centry.io/sintax. Again, we've been using this tool for a long time and it totally rules. All right. And like what's usually running on these devices? You mentioned like Debian like are a lot of these things just running like Linux on them or is it it does it depend? >> Yeah. Uh so in the IoT world there's kind of two categories of devices. There are more traditional Linux-based devices uh and then there are microcontrollers. And so you'll often see these used in uh different applications if you need like a low power application if it's a battery powered device. Now the these these lines can blur of course but generally speaking if you you have low power battery powered device those are often times going to be microcontrollers which are a whole a whole another game in terms of uh how to do that firmware modification >> like an ESP32 or like a one of those like Raspberry Pi Picos or something like that. >> Exactly. Yeah. And that's yeah the Raspberry Pi world is a great distinction. So, Raspberry Pi Pico microcontroller, regular traditional Raspberry Pi is going to be a uh a microprocessor that runs Linux kind of operating system. Exactly. >> So, in the Linux case, that's that's what you're going to find most of the time. If you're if you're targeting routers, IP cameras, most of the time those are going to be Linux. Now, that is changing uh because people like batterypowered cameras. They like lighter weight devices that uh don't need to be plugged in. And so you are seeing uh some advancements in microcontrollers in that in that space. for Linux devices. Yeah, it's it's oftentimes going to be just a very kind of custom like I call it like an SDK where a chip provider will provide an entire build system that will include a kernel and uh the all the root file system necessary to boot Linux. And then on top of that, a device manufacturer will build all their custom business logic in the form of some kind of a Damon that will run and that will communicate out to the cloud. >> And what language is that stuff written in? Typically, >> mostly it's C. You'll see some C++. uh in very odd cases you'll see some higher level languages like Python being used but it's it's mostly a bunch of C code that is ripe for finding you know command injection buffer overflow type vulnerabilities uh that are that are kind of commonly plague those languages. Yeah. >> Okay. So you get something and like how do you even get root access to that thing in the first place? You plug it in via USB. often it will just like go into the mode where it just like mounts as a USB drive or or acts as a camera. How do you get the lower level which is access to like the firmware that's running on this thing? >> Yeah. So, so typically what I'm going to do is I'm going to open up the device and the first thing I'm going to look for is the UART console header or debug pins on that device. It's typically going to be a fourpin header or connector that might not even be populated, right? That they might for their debug version or their kind of development version of that device, they might actually have a header populated, whereas in production, they might try to like take that component out just to save a little bit on their uh on their bill of materials cost for the device. But uh you're you're going to look for that connector and that's where uh kind of in my videos I talk about how there are these USB to UR adapters and those are going to be set to a certain voltage. 3.3 volts is like the most common one you find out there. And when you connect up to you know the TX and the RX line so it's just an asynchronous uh physical communication. And my my analogy I like to talk about is it's kind of like a physical UDP socket, right? It's you can you can send and receive data across this these physical wires and then on the device that can be connected up to a couple different things. So on a Linux device that's typically going to be connected to the console. And so if you are connected properly and you power on your device, you're going to start to see the bootloadader logs roll by and maybe you can enter maybe you can like smash a key and interrupt that boot process. If we let it boot up fully, maybe they're they're uh you know dumb enough to just leave a a logged in root shell, right? They they don't even make you log in or maybe there is a login prompt, right? Uh, and this is where we start to rabbit hole into different ways to turn the situation into that root shell. So, so, uh, it's it there there's there's a lot of different tricks uh, you can do, but if you have that console access, you can often times turn it into a root shell. >> That's that's so fascinating to me because like you open up any electronics, you're often going to see a couple little dots that'll say TX, RX, and and ground, right? And th those are your UART connections and Y and you connect you can buy on Amazon you buy like a $5 little USB converter um where you just attach to those pins. I know there's some probably some more advanced like things, but at the very basic you're trying to connect those three wires to a USB. Um, and then you can directly connect to that from your computer. And then when you turn it on, the the way I know about this is cuz I did a uh putting JavaScript on my Roomba video. And if anyone's like looking to get into having fun, the old crappy Roombas are like $6 at a thrift store. And there is full documentation and there's there's a pin header right on the on the top of the Roomba. You don't even have to open it up. Um, and you can connect directly to it. And then when it boots up, you can see all of the logs. Um, and then you can just start sending and receiving commands from it. And there's there's libraries out there that will help you um both send what the commands are, you know, as well as receive things like the battery temperature and and and the how fast something is driving, all that interesting stuff. >> Oh, that's so cool. >> Yeah. But so like I'm curious like that's like that was really well documented for me, right? Like Roomba Roomba wants you to hack them, which is kind of a bummer. Now Roomba's filing for bankruptcy. Um, but like what do you do to figure out what these commands are when someone doesn't want you to to hack with it? >> Yeah, that's that's a great question and that kind of leads into the second activity. So if like if the first activity is like finding that UART console and if it doesn't immediately give you what you want, right? it doesn't just like drop you into a Linux shell. Maybe maybe it leaves you at a login prompt and you're like okay how how would I guess what the you know the username and password is kind of the second activity then is firmware extraction uh in terms of hardware hacking again always for that purpose of hacking the software. So, this is like where we are able to, you know, with a hot air gun I've got over on the bench here, uh, able to desolder a a chip. Some sometimes you can read the chips in circuit, meaning you can leave it attached to the board and you can attach a, you know, a universal like a programmer, a firmware reader to a chip. Uh, some chips are just not able to be attached to that way based on the physical uh, layout of the chip. And so uh that's why I prefer to desolder things. Also, you can run into some issues where if your incircuit programmer reader can like inject power, it can basically power the board and cause it to do a bunch of uh undefined things. So, usually >> let the smoke out. Is does that happen sometime? >> Uh it can it can or it can just like mess with mess with your firmware read is what is what's probably more likely. >> Oh, I see. I see. Okay. because then you'll like power up the CPU or the MCU and it will try to start talking to the flash chip too to read and write from it while you're while your programmer is also trying to interact with it. And so you're you're like both like arguing over who has control over the flash chip. Uh >> oh, I see. >> Yeah. >> Okay. Okay. So, so once once you once you remove that flash chip, uh you're going to plug you're going to you're going to put it into a programmer and then obviously you need to have a bunch of different kind of adapters to fit the different kinds of chips. Uh but once we do that and and once we read that software off, we you're usually left with a binary blob that is the entire contents of that flash chip. And so usually on a Linux-based device that is going to contain multiple partitions, multiple file systems. And so that's when our handy tools like binwalk are going to come in handy for searching through that binary blob to extract out well-known file systems. So you'll you'll see things uh especially on more heavy Linux systems or like Android based devices, you'll see like ext4 file systems. There are also a lot of file systems that are made specifically for embedded devices like Squash FS. Um there there there's a whole number of file systems that you'll never see outside of kind of the IoT space. >> But these things are like are like well-known that that's what was so interesting to me about this is that like just like us web developers were reaching for like React and Node and all of these like well-known things. people who are making hardware are are also reaching for well-known things. Often they'll take a chip off the shelf that is like 80% of the way there. Um and because those things are wellknown then they are also a little bit easier to decrypt with tools like binwalk. Is that true? >> That is true. Yeah. So, so binwok usually if you the the the common flag you pass it is dash lowercase e which is just hey extract is the extraction flag like say hey go through go through this file and extract out all of the well-known file systems and so if that works and you know there's there's a whole bunch of caveats of you know sometimes a manufacturer will try to be cute and like slightly modify a file system specification but most of the time they don't do that and you're left with the contents of like maybe the root file system and maybe a another partition. So most of the time on these IoT devices there'll be multiple partitions and the root file system will be read only kind kind of as a a reliability mechanism right to to keep creep and and errors from making the system unbootable. And so and then you'll you'll have data stored in another partition. And those are all of the things that you need to then go start searching through the file system for binaries you might want to throw into a reverse engineering tool or say the the the Etsy shadow file to uh grab password hashes out of and then you can try to crack those password hashes to go back to your UART console to attempt to log in. >> Okay, man. That this is so fascinating to me. Sorry, Scott. But I'm not letting you know. I haven't let talk at all. >> I don't do any of this stuff. So, uh, Wes is the the hardware hacker on this show, so I'm just kind of like >> listening and soaking it in. So, no, I I I appreciate I appreciate your insight, Wes. >> All right. Well, good. Oh, so like like what's the next step then? So, like once you've dumped this firmware and you've used Binwok to sort of look through it, like what are you now then looking for? >> Yeah. So, like I said, if if I if my goal is still like if I haven't accomplished that root shell goal yet, then I might look for things like, you know, the shadow file, and then I might grab those password hashes, those Linux password hashes, and throw them into hashcat, use my GPU to to try to crack uh those passwords. And so, if that's successful, then that gets me in. If that's not successful, there's kind of the next step down the rabbit hole of attempting to modify that firmware image. So, if there's if there's a password that I can't crack, but but there's a shadow file, maybe I could replace it with with with a hash that I do know the p the corresponding password to. And then if I can package all the file systems back up into that binary blob and then use my programmer to write back to the chip and then solder the chip back onto the board. >> Gosh. >> Then it would assuming there's no kind of secure boot controls, there's no integrity controls on the system. Uh which you're seeing more devices that have those, but some of them there there's still lots out there that don't have those kind of controls. Can I can I tell you a story of one time I accidentally did that? >> Um, I had bought a >> this was probably like 12 years ago and I had bought a camera off of uh I think AliExpress or or Deal Extreme back in then. And it was like the Chinese version of a very popular North American brand. Um, and I was like, I wonder if I can just load the firmware from the North American one onto the Chinese one. So, I I went on GitHub and I found somebody had dumped the firmware from one of the North American cameras. So, I just dumped that on my camera, booted it up, paired it to the North American app, no problem. And all of a sudden, I see video from somebody else's camera. And I was like, "Oh no." Like, this is it must have like a like it must have like flashed the MAC address or some sort of identifier. Um, and it was like in someone's bedroom. So, I I unplugged it and I've never to this day plugged that camera back in again cuz I was like, I don't know if I just what I just did was illegal or whatever, but I was just trying to get add it to my own thing. Um, and it it started streaming in someone else's video and I was like I was almost kind of scared there and I just I have never plugged it in again. I think I tossed it a couple years ago cuz it was kind of scary, but that's something that could happen, right? >> Oh, yeah. So, so that's Yeah. So, so going back to the there how there's commonly like a root file system that's that that's kind of, you know, unmodifiable that and then there's the data partition. So, what was probably wrapped up in that in the data partition somewhere is some kind of APIs, tokens, keys that uh identifiers that corresponded to probably the person who made that repo and the firmware dump, right? >> Yeah. Yeah. >> And and and then and then in and then you by flashing that on onto your device, you basically you basically cloned the device, right? And so, uh, that is an attack that, you know, that that that could be considered valid, you know, in in some cases. Now, obviously, you need like physical access, you need a firmware dump to somebody else's camera. So, it's like in in in a lot of cases that won't be like a security vulnerability, right? >> Yeah. >> It's like if I give my keys away to somebody else, it's like, okay, yeah, then they can then they can then they can access They can enter your house. Yeah. Okay. >> Yeah. So, I with all of this stuff, like where does that legality border exist? >> Yeah. Have you ever had the police knock on your door? >> No. No. No. No police. I've I've had some strongly worded emails, but uh I haven't I haven't been sued yet, so that that's good. Knock knock knock on wood here. So, generally speaking, my understanding I'm not a lawyer, by the way, so this is not not legal advice. uh is if I own the device, right? I like like like I'm always very careful when doing security research to like like like if I'm hitting API like cloud APIs, that's where I draw a very strict line to if I want to test can like one device kind of access the stuff of another device, then I'll buy two devices and I'll create I'll create two accounts, right? and I'll try to do those cross account attacks on myself. Uh again, not legal advice. Uh that might still be considered an unauthorized test. And then obviously the hardware is that's my property when I buy it. Um there there are some United States laws against reverse engineering, but at least today they still all have carveouts for what is called goodfaith security research. So, >> uh, again, I'm not a lawyer and don't know the the specific definition of that term, but I try to do my research in good faith, uh, and and to not not to use it maliciously, not to attack other people. And so, uh, at least in the United States, we have kind of those protections. I obviously don't know about about other countries what the situation is there. Yeah. >> All right. So, where where were we with the the process of >> I think Yeah. like what what to do with the firmware extraction. So another thing that might that might be interesting especially to like kind of like in getting into the web topic is so the first kind of theoretical IoT device we talked about was where the device reaches out to a cloud server via its APIs but also a lot of times these devices will have their own embedded web servers on them. they'll have or or other network services that can be connected into, right? So maybe maybe there's a mobile application and le let's talk about a video camera, right? So in the video camera use case, you could think of okay, I want to be able to access my camera remotely and so when I'm away from my home uh on the mobile app, that that data has to go up through the cloud server. But if I'm in my house now, there's a lot of latency. There's a lot of video latency in that first case. So maybe when I'm in my house, I'm on the same network. I want it to stream directly from from phone to camera. And so a a lot of video cameras will do this. They'll have a way that that it can sense that and the mobile application can directly connect to a service that's running on the device. And so once I have that firmware, I can usually find the binaries that are hosting those web servers or those custom binary protocols that are running on the device. And the the web servers are especially interesting cuz sometimes you'll see kind of standardized servers that use like CGI like light HTTPD which will uh so so light HTTPD will manage kind of the basic web stuff but then it will make calls to a binary to like a C program that will actually like execute when you make a web request to certain endpoints. Also, you'll see people roll their own web server and web application all in one binary, which is uh which is always fascinating because then they're they're doing all the raw they're writing they're rolling their own web server >> many times and so there's all sorts of you know potential security issues there and then the application actually the the business logic is all implemented all in one binary >> that that's exactly what I did with my Roomba, the uh the ReactJS code, the web server, the websocket server, and the like lower level communicate send bytes to the the Roomba. Uh that was all in a single binary. So that's that's generally not a good idea, you're saying? No, I it it it like I guess what I'm saying in the IoT world there's not like there's some standards but it hasn't coalesed as much as the traditional web world I guess around a certain set of frameworks and standards. There's a lot of different people who had their own ideas about how to implement a web server and or a web application and it just leads to a lot of security bugs where each case is different. It's not like I can run like it's not like I have a security tool that audits like React applications and then I run I run that tool and then I find V's like common mistakes people make with that framework. There's not like just oftent times it requires custom reverse engineering of each web server application on each device to really uncover if there's anything that's uh not being done correctly. >> Oh man. All right. So you you have access you figure out what the API endpoints are. Um and then like like what's your process for trying to replicate what these these things are? Do you then bring that to your just to your computer or then or do you try to like put a custom firmware on the device? >> Yeah, that kind of depends. Usually I'll try to extract uh some of that logic out, right? Like like you want to figure out how the authentication is being done and even that you'll see being done in kind of a multitude of ways. you'll uh it might be using you know m mutual TLS authentication with kind of like client client certificate au uh or or you know some kind of API key that's on the device if I can get that off the device and replicate it in you know Python or or in my own browser uh that's something that I like to do a lot but uh yeah a lot of times it's just like making little custom Python scripts on my on my desktop side to to emulate the device and its calls. And then I can fiddle with, you know, hey, can like I have a device on this account and a device on this account. Can device A access uh or make API calls as if it was device B? >> Okay, I see. >> Yeah, that's fascinating. >> What get what gets you inspired to look at stuff uh specifically? Like what how do you pick a project that you're working on? Is it just uh you see something and you have a question and like you mentioned your your innate curiosity kind of takes over? >> Yeah, I guess yeah I I guess it is that curiosity and I'm I'm always like looking for challenges in new industries, right? So like like right now like this is something I haven't even made a video on yet, but uh I'm kind of getting interested in drone technology and and drone hacking. And so then there's a whole bunch of like skill sets that that that involves. So I might look for different devices to like help me build a certain skill set. Right? So there's been times where I've purposely sought out uh devices that I think will have a certain kind of microcontroller or a certain component that I want to learn more about. And so I'll kind of try to cherrypick the hardware to to teach me something because honestly making content, making the videos is one of the best ways that I learn and and I get better as a professional uh by just uh yeah trying to do something new. >> Yeah. >> What about uh doing more like man-in-the-middle um detection? So, I'm thinking about right now we have I've got a fleet of these like 12vt Fisher Price cars that our kids drive on. Um, and we have one that's called a Wild Thing where it's kind of like a little wheelchair that you sit in. You have two joysticks. It I found on the side of the road in the trash and and it didn't work. It was erratic. Um, so I replaced the main like motherboard on it with a brand new one and it still didn't fix it. So, I was like, "Oh, the the joysticks themselves have um little daughter boards on them, like tiny little boards." And and I'm I'm at a point now where I'm like, "How do I figure out what the daughterboard is sending to the main board?" That's is that something that you dip into as well? It's not really APIs. It's more lower level. I think about like um the button to talk to my garage door is not simply just like a closing a loop of electricity. It's it's sending some sort of data. How would I figure out what that data is? Yeah, that that's a great question and that is that is stuff that I do and the tool is going to be a logic analyzer that's that's going to help get you insight into those digital communications that are happening kind of like like between different chips on a PCB or between two different PCBs. So, uh yeah, so you typically a logic analyzer is what's going to help you and and then connecting up to th to those lines, right? So if we go back to the to the case of the UART console, right? Those that's just digital communications, but there's like there's not yet another end connected to it, right? So sometimes if I'm trying to uh even debug a UART uh kind of interface, may maybe it has a really weird uh baud rate, the like a symbol rate for for for how for how fast it transmits sometimes. Then I have to go back a step. I I I have to set aside that USB to to UART adapter for a second and actually connect up a logic analyzer. So the best way to think about a logic analyzer is if if if we know what a multimeter is, right? A multimeter measures voltage, right? And a multimeter is slow, right? So it's like I connect it up to like a circuit. It might say if I connect it up to like a UART uh where where a digital signal where it's oscillating between 0 volts and 3.3 volts then a multimeter it might like it might like give you a little fluctuation if there's some data being communicated but it's going to be really slow. >> Yeah. >> But a logic analyzer can sample a lot faster and can give you a nice clean kind of a square wave that is that represents that digital signal. And then >> yeah, go ahead. >> Is is that what like an oscilloscope is? I see it over your shoulder right now. >> So So yeah. No, and that that's that's a great like thing to put on the spectrum because on on the kind of spectrum of sample rate, multimeter super low. Logic analyzer kind of sits in the middle and then oscilloscope is like super fast sample rate. So it's kind of like figuring out the right tool for the right job. But they're they're kind of all sampling uh you know the DC voltage and giving you kind of a readout of of what that situation is. So most of the times to to interpret a digital signal you don't need to go as far as an oscilloscope. >> Usually a logic analyzer will >> a logic analyzer will also record it. So you could like I could hook it up, hit the button or like like like pull the controller back and then go back and look at it and say it sent like it sent just like high highs and lows. Is that's is that what it's sending? >> Yeah, exactly. So the most common one out there uh that that that goes with soy makes a lot of very nice they're a little more expensive logic analyzers. You can also get little ones for like $10 that are kind of like knockoffs uh on Amazon and it it it will work with their software as well. It's called like logic 2 is the name of the software and yeah it will give you a graph that you can you can zoom in and out on the signals and then it will include all of these analyzers right so if you're like okay I think this is a serial communications then you can you can kind of add the analyzer and it will let's say if it's like transmitting like just asky data back and forth like a kind of that UR console uh situation would you can have it interpret it and and you you'll see like over a set of eight bytes it it it can put the symbol it can say okay this is the letter A that's being transmitted uh if if you're interpreting that correctly and you can and and that's where you can kind of test hypotheses to be like I think this is a UART signal and I think the signal rate is this uh there's also other protocols that can be used like you know like SPI or uh I squared See, there's there's these different digital protocols that uh you know use one or more wires to communicate a digital signal. >> Okay. Cuz so GitHub Universe had a a badge that was like like a little PCB has a Raspberry Pi microcontroller on it. Um, and there's a little I only recently learned it's not I2C, it's I squared C. But that's often where you can buy like a microphone or a little display or something that also sends I squared C communication. It's a kind of a nice hot plug thing. >> Yeah. Yeah. And so so those those logic analyzers are what to use when you like like you're like, okay, I think it's using one of those well-defined protocols, but I don't know which one it is. Right? It's it's kind of your first step to uncovering that mystery. And then >> once you do that, then you can use kind of a dedicated tool that that speaks whatever the protocol is. Uh like in our USB to UART example, if it's a ser if it's serial communications, uh that that's what UART is, right? It's it's it's a it's a ser it's a form of uh it's a two-way, you know, serial uh as asynchronous serial communications. So, >> and is this what like tuners are doing in cars as well? Cuz in your car, you've got like an OBD port. Um and there's all kinds of pins on that thing is. And then that you can get some guy to like tune your Dodge Ram or whatever, right, to roll coal. Is is that what they're doing here? >> Yeah. And so that's that's another protocol. Uh more or less. Uh but they're probably going to be again using a dedicated tool because they know what protocol that it's going to be CAN. So CAN bus. Yes. Yeah. Yeah. CAN is is the protocol that pretty much all uh automotive stuff uses uh to to communicate. So you know your your wheel sensor can communicate to the ECU and all the other components in your car uh can can read the messages of what's going on in the car. And so that's that's what that ODB2 port is giving you access to. So you could use a logic analyzer. Uh but in that case pretty much everybody knows they're like okay it's it's going to be speaking CAN. So we can use a CANSP specific tool. The the the the logic analyzer is the generalist tool. And then usually you you figure out what what what language what protocol uh those physic uh those digital communications are using and then you and then you use a purpose-built tool uh to kind of hone in on that. Oh, that's cool. I've always wondered that because in like the Tesla world, there's all these like aftermarket accessories that will like pop the passenger door open or or um like recline the passenger or turn the back lights on and people just add buttons wherever they want. And it's because they're just they're adding this little module somewhere in the CAN stream and I guess intercepting those requests and or sending them down the pipe if they need to. >> Yeah, >> that's cool. Have have you dug into any of the car hacking stuff yet or is there plenty on your bench to work on? >> Yeah. Yeah, that that that that hasn't been an area of focus yet. I like I said, I I'm curious about everything. So, it's just a matter of uh managing that curiosity. Uh haven't gotten quite into the >> uh the automotive world yet. Do you have any like crazy stories of of things you've done recently that is kind of fun >> or or even just like like hardware IRL? Like I every time I see like a massage chair or like an arcade claw machine, I'm always trying to hit combinations of buttons or uh like trying to like reset it like I or the the inscreen entertainment systems and the plane. You're always trying to hit the buttons and figure out what that is. >> Yeah, I think I had a post on X about that. I was I was like flying back I think it was from Defcon and like I was able to figure out like like I wasn't able to get a full escape back to like the Android but you but like those most of those increen displays are are Android in in in fact I I like this is a little bit of context into the the industry that I'm most familiar with but most like security panels at home that have a nice display not like a super old like crappy LCD display but a proper display on them those are usually running Android as well. >> Oh, interesting. >> But uh yeah, those in those increen displays uh I was able to like enter a game and then like it would it would show the home like the go home button uh or or or or or the or the like the button in Android to like access your other running applications and like you could spam that really fast and like >> it would escape back to the like just the the app selection menu, but it didn't let you escape any farther than that. But >> yeah. Oh, that's so fascinating. I also had a post on X a while ago asking like what these things are built in. We had a couple people from the industry chime in as to like what they're built in and and it was it was a really interesting read just to get a peer into these h how all of the stuff works, especially on a plane, you know, it's it's a fairly closed loop system because the shows are on a drive on the plane. >> Oh, yeah. No, no, no. That stuff is uh is super fascinating. Yeah. with with hardware, I'm always I'm always looking around me in the world for targets. So, I'm I'm like that weird person that's like in a coffee shop and I'm like, "Oh, they have that brand of security camera running, you know, and uh but uh I think you mentioned my grill video cuz that's that, you know, I I I had that smart grill for probably like a couple years and I was like and I've always been like, "Oh man, I should really rip this apart, but I don't want to break my grill." Uh, so so that that that was a fun adventure and that always leads me to like eBay, right? Like like eBay is just a is just a great place for me to go find a bunch of weird used uh in industrial technology or or consumer technology uh to to always hack on. >> That's So tell us what you did with the grill though. I think that was pretty interesting. >> Yeah. So So that was Yeah, it was just a fascinating experience because first I again the motivation is like I use my grill. I don't want I don't want to like accidentally brick my grill because I'm like trying to do firmware extraction on it. >> And so >> I I So So I went on eBay and I found a replacement computer module that was supposed to work as a drop-in replacement for for my grill. And so I I you know I went and I started to do the analysis on that and I was like this this is weird. this like doesn't properly connect out to the internet. And so then I was like, "All right, I just need to go do it on my own grill." And so I and so I ripped them off and I was comparing apples to apples. And it was like a different hardware uh revision, which was really fascinating. So, I don't know if that was like the thing I bought on eBay was someone uh bought that, you know, like that device was uh some kind of a development unit or some kind of a unit that didn't pass QA and they're like, "Oh, I'm going to make some money by by reselling this on eBay." Uh >> curious about that as well is like how hard is it for people just to create like aftermarket boards for these things? Is that something that happens? Yeah. Well, and and then like part of the the security world that is not usually the the like security flaws that I'm looking for because the these I are I'm not as concerned about, but there is a lot of uh anti- cloning work in the security community. And so, uh so they are are trying to prevent firmware extraction, right? that they're trying to or or or they're trying to put some piece of the puzzle in a place maybe maybe it's in some kind of internal um you know storage inside of the CPU or it's a microcontroller where they can actually lock the debug connection and the firmware is like locked inside the microcontroller >> and they'll do that to prevent cloners from from just you know reading out the firmware and then and than producing a a compatible unit. >> Yeah, it's it's a hard thing because like part of me like I have a Sidu that's 20 years old and you you go on AliExpress and buy an entire like computer, it's called the SPI for your SIDO and for like 80 bucks you can if if you for some reason have blown your 20-year-old computer unit on your SIDO, you can just get a brand new one and and slap that thing in. Um, which is great for like right to repair, but also awful for like someone could steal your sidu and just slap in a new, you know, slap in a new computer unit and that thing is is untraceable. Now, it's a it's a tricky area. >> It It really is. And I Yeah, I've gotten asked those questions before and like like I'm not an expert. I'm I'm really interested in the whole retro repair movement. I I actually start I would not have started my YouTube channel if it hadn't been for Louis Rossman actually for for kind of a funny reason. So I hate video editing. I'm not good at it. And so I watch I would like watch his videos and I'm like this guy gets a ton of people watching board repair videos unedited sometimes like an hourong video. And I was like okay. So like long form content clearly not dead. and you know, attention spans in the hardware/tech techchnical domain. There's an interest for that. So, that's kind of what led me to start my YouTube channel and make it just a format where it's it's more or less unedited and long form. >> So, I'm I'm I yeah, I I have a lot of lot to thank Lewis for and uh definitely interested in the movement. Yeah. Although he did start that paperclip movement which like the worst people that comment on our YouTube channel are all of a paper clip. >> Yeah. Oh my god. >> Avatar. >> Okay. It's so funny cuz I haven't watched Lewis in like in a while, right? Just because I I'm busy with other stuff. And so I would see all these like paper clips in my in my YouTube comments and I'm like what is going on? Are these like is this like a bot farm? >> Yeah. We thought it was the same guy. >> Yeah. Yeah. Yeah. And I was so I was so confused and then I was like, "Oh." And then like I I I finally like tracked it back. I'm like, "Oh, this is like a Louis Rossman thing." >> Yeah. >> Oh, all the paper clips, please leave a comment right now. We need to see you. >> Yeah. >> Anything we haven't hit on that you you'd love to cover. Um, no, no, this is this is really cool. I'm just uh yeah, glad to get to chat and uh share something uh interesting to the audience. >> I've got I got one more question for you. And this is this entire podcast is very self-serving. Um I only want you on so I can ask you questions directly without having to pay for your time. No, I'm just joking. But um so for Christmas, we're getting our kids laser tag. Um, and as far as I understand that that's RF. Um, like it sends an RF signal. And I was thinking like >> I want to build a nuke. Um, that like I want to build some device where I hit a button and it does RF in every direction and just like boom, gets all the kids and they're all dead. You know, how fun would that be? Like what what would even be my first step to building something like that? >> Yeah. So, so this is something that I this is a domain that I've recently started to produce some videos on. Uh, so that that is going to be kind of some yeah some radio protocol reverse engineering and so an a software defined radio and SDR is probably going to be step one. Also, the thing is if it's RF uh you can do a lot of open- source intelligence gathering through the FCC. So, uh, the FCC website and there's like a third party site, I think it's like FCCID.io that just like scrapes the FCC website. >> I love it. You can see internal photos of everything. >> Exactly. Well, and the other thing they'll document on there is the frequency, the radio frequencies that are being used. And that saves you a lot of like scanning around with your SDR. If you know what what it's transmitting on, then you can listen. And uh, you're going to need an S. Now, to actually do the the replay attack part of it, you're going to need a a radio that can transmit. So, the simple uh RTLSDR that everyone starts with, which is great. Uh those can only receive, they can't transmit signals. And so, uh you're going to need something like a hack RF maybe. And so, the hack RF even has really simple programs that will record a signal and try to replay it. So, uh, assuming that, you know, there's not some super advanced security going on with the the laser tag system, if you can just capture a signal, right? Like record and then and then shoot and then shoot like like shoot the gun at at the antenna and then record that signal and then try to replay it and see if it has uh the effect that you're looking for. Yeah, >> man. I I think I have something like that. It's either RF or IR. I bought it to I think Scott might have done this as well. We have like these like little AC units that don't have like a Wi-Fi chip in them, but you can just like point the remote at it and and train it, right? I should look into that. I actually got one for my laser tag. >> Oh, that'd be awesome. >> Yeah. >> Wes hacking to cheat at laser tag with his kids is >> definitely and like there's no chance it's it's like like encrypted, is it? >> I I highly doubt it. Highly doubt it. Now, now, now what might happen is like each gun might have its own like like a part of the signal that's different if if it has any kind of like scoring system, right? Because then you need to know who shot who. >> And so, okay, there might be something that is encoded. I doubt it's encrypted, but there might be some part of the communications that is identifying that's like unique to each gun, but maybe you don't care about that if you're wanting to nuke. Well, well, then you should do it with your gun because you probably can't in the system. You probably can't shoot yourself >> and so you would be immune if you captured your own gun's signal. You got to filter it, sent out the nuke. Yeah. Yeah. Oh man. I I I think the first thing that ever got me interested in this is years ago somebody figured out that you can take this like kids diary from the '9s. It was called the like I am me or something like that. It was like this little thing and it had an RF >> transceiver so you could go between them. Um, but somebody figured out that you can just make it go on loop and send every garage door code out. Um, and this was before garage doors had like rolling codes. So, this was like like like 30-year-old garage doors would just open, >> which is at our cottage we have one. It just randomly opens. And we've we haven't pinned it down as to what it is, but it's somebody's key fob for their like Dodge Caravan or something just causes our garage door to open. >> Yeah, that's uh Sammy Camcar uh his work and he's got a Defcon talk that uh I Yeah, highly recommend his stuff. Yeah, >> I want to go. >> He's done some crazy stuff now. So, he's getting into uh laser uh using lasers to transmit sound. And he had a project where he could make an Amazon Alexa unit receive audio with a laser through a window. So he could so he could transmit audio through a window like like if it was in somebody's house like to the Amazon Alexa and it would the the the vibrations like the the signal that >> unmodified Alexa they would just the vibrations would play. Oh that's terrifying. >> Holy hell. >> Yeah. He's getting really deep into laser uh technology. Uh now he's got some like homebrew like like laser technology. Uh that's like yeah you got to you got to wear proper eye protection with >> So So my last question is IoT stuff. Do you have it any that the classic thing is like I keep my IoT next to next to my bed with a gun. Um do you run any smart home stuff after all you've seen here? >> I do. I Yeah. I'm I'm maybe not as doomsday as like most people about it. Uh I like I've got I don't know like I'm I'm just kind of a network nerd anyway. So I do have like networks some not not overly like paranoid but I do have some network segmentation that I keep okay you know some devices on a different network and so um >> yeah and it's just a matter about you know choosing what your your risk profile is. I I have some devices. I don't have a lot of devices, so it's it's it's it's kind of a compromise in the middle. And obviously, I'm always playing around with things in my in my kind of like test lab here. So, I've I've always got some some weird traffic going out >> of my network. >> Uh Matt, that was uh really enlightening for me personally, considering I I don't get my hands dirty with most of this stuff. So, I I really really enjoyed hearing all of this. So, uh, now is the part of the show where we get into sick picks, which is something that you're just enjoying in life right now. It could be anything from a podcast, a YouTube channel, product, whatever. Is there anything that you're just really feeling right now? >> Yeah. Sorry, I totally forgot to tell you about this. Usually, we have like a whole document we send ahead, but I did I did it a different way this time. >> No, no, no. This is this is really good. So kind of my my side interest is uh has been business lately. So so so I've been, you know, uh running uh my my my my side business uh and I've been just getting more interested in in how to run a business effectively. So uh reading books like um Key Person of Influence, uh by Daniel Priestley, just yeah, just some general business books to kind of up my game in that area. Funny enough, my my undergrad is kind of in business, but it was it was because like management information systems like our my IT degree was uh in the college of business at my college. So, >> oh that's that's exactly what I went to school for. I went to school for business technology management which is exactly like not enough coding but more on the business side of things. But uh >> it was really because I didn't want to take calc 3 and like alt in physics why why why I chickenened out of CS but uh that's another story. >> Oh that's great. I got I have never read that one. Key person of influence. I can check that out. >> Yeah. Uh, and it and and it really like I I really like that book because it talks about how you can use, you know, your like like I I'll never call myself like an influencer or whatever, but but it it talks about how you can use your your public presence, your content to build a business that kind of syncs with the rest of your life. And so the cool thing for me is I feel like it kind of follows the journey that I've gone on o over the past two years because I made my YouTube channel. When I started my YouTube channel, I was like, if over the lifetime of the channel I get 10,000 subs, I can like be like mission accomplished. And obviously it like rocketed past that. And so, uh, that caused me to just get reached out to by businesses to be like, "Hey, can can you do some consulting for us?" And so, the business just kind of grew out of the content. And so, uh, we're going to we're just going to see where that goes. >> That's awesome. How How long have you been doing your YouTube? >> Uh, about two years now. So, >> holy, you're almost at 200k subscribers. That's amazing. >> Yeah. Yeah. It's been a wild ride. >> Yeah. Wow. Well, congrats. Thank you so much for your time today. And >> oh, whoa, whoa, whoa, >> whoa. Oh, sorry. Never mind. Go ahead, Scott. >> Also, the last thing is shamelessly plugging. So, is there anything you would love to plug to our audience to make them aware? So, we'll we'll link up your YouTube channel. It's a fantastic subscribe. Um, anything else you want to plug? >> Yeah, just uh if anyone is in the need for hardware pen testing, that's like the the one thing that I do uh at my business. And so brownfind.com uh is where you can find info on that. >> Nice. Sick. >> Right on. And the his YouTube is just Matt Brown. It's M A T B R WN. If you're going to YouTube as well, you can click the link in the show notes, but if you're just typing it in, you'll find it in there. >> Cool. Well, thanks again for all your time. This is super interesting. I appreciate all your all your time. >> Thank you. It's been a great great time. Thanks, Matt., Hardware Hacking With Matt Brown, YouTube, 01kchdhz29qm6wsga9r0ycs69k.