Hardware Hacking with Matt Brown - CourtneyR.dev's 2nd Brain

Hardware Hacking with Matt Brown 🔗 **Source:** [Hardware Hacking with Matt Brown](https://www.youtube.com/watch?v=SpPd0Q6dmYI) > [!note]+ Document Notes > tags: [hardware-hacking, security-research, iot-pentesting] > author: Syntax > source: YouTube > reference: https://www.youtube.com/watch?v=SpPd0Q6dmYI > date created: 2024-12-28 10:00 > > # 🏷️ Title: Hardware Hacking with Matt Brown >  ## 🧰 Action Inbox - [H1] Explore UART console connections on IoT devices — look for TX/RX/GND pins #hardware-hacking - [H2] Try firmware extraction with binwalk on extracted flash chips — desolder and read with programmer #firmware-analysis - [H3] Set up transparent proxy with Burp Suite for IoT traffic interception — modify device trust store #api-discovery ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Matt Brown's YouTube Channel](https://youtube.com/@mattbrwn) - [Syntax Podcast](https://syntax.fm) ## 📝 Summary - Matt Brown demonstrates hardware hacking techniques for IoT security research, from UART console access to firmware extraction - Why it matters: IoT devices often contain serious security vulnerabilities that affect millions of users - Key stakeholders: Security researchers, IoT manufacturers, consumers with smart devices - Risks and tradeoffs: Legal boundaries exist but good faith security research has protections - Bottom line takeaway: Hardware hacking reveals software vulnerabilities through physical access to devices ## 📖 Main Content Matt Brown explains his methodology for hardware security research, starting with curiosity-driven exploration of thrift store electronics. His approach combines physical hardware manipulation with software analysis to uncover security flaws in IoT devices. The process typically involves opening devices, finding UART debug connections, extracting firmware from flash chips, and analyzing the software for vulnerabilities. He emphasizes that hardware hacking often serves as a means to understand and exploit software, particularly APIs and network communications that wouldn't be visible through traditional web development tools. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/SpPd0Q6dmYI?t=0) — [H1] Introduction to Matt Brown's work - Key idea: Security consultant who hacks IoT hardware to find software vulnerabilities - Evidence: "Found dozens of unsecured police license plate cameras with video feeds and GPS coordinates" #### ⏱️ [05:23](https://youtu.be/SpPd0Q6dmYI?t=323) — [H2] Getting started in hardware hacking - Key idea: Curiosity-driven exploration starting with thrift store electronics disassembly - Evidence: "Would go buy used electronics and take them apart, see if I could put them back together" #### ⏱️ [08:15](https://youtu.be/SpPd0Q6dmYI?t=495) — [H3] Hardware as means to software hacking - Key idea: Physical hardware access enables discovery of APIs and software vulnerabilities - Evidence: "Hardware hacking is like a means to an end to hack on software or APIs" #### ⏱️ [12:30](https://youtu.be/SpPd0Q6dmYI?t=750) — [H1] UART console access methodology - Key idea: First step is finding four-pin debug headers (TX/RX/GND/VCC) on PCBs - Evidence: "Look for that connector, might not even be populated to save on bill of materials cost" #### ⏱️ [18:45](https://youtu.be/SpPd0Q6dmYI?t=1125) — [H2] Intercepting encrypted IoT traffic - Key idea: Install custom CA certificate in device trust store to decrypt TLS communications - Evidence: "Put our cert into the trust store, then use transparent proxy like Burp Suite" #### ⏱️ [22:10](https://youtu.be/SpPd0Q6dmYI?t=1330) — [H3] Linux vs microcontroller devices - Key idea: IoT devices split between full Linux systems and microcontrollers like ESP32 - Evidence: "Battery powered devices often microcontrollers, IP cameras usually Linux" #### ⏱️ [25:40](https://youtu.be/SpPd0Q6dmYI?t=1540) — [H1] Firmware extraction process - Key idea: Desolder flash chips and read with programmer to extract binary blobs - Evidence: "Hot air gun to desolder chip, use universal programmer with different adapters" #### ⏱️ [30:15](https://youtu.be/SpPd0Q6dmYI?t=1815) — [H2] Using binwalk for filesystem analysis - Key idea: Extract known filesystems from firmware dumps using automated tools - Evidence: "Binwalk with -e flag extracts well-known filesystems like SquashFS" #### ⏱️ [35:20](https://youtu.be/SpPd0Q6dmYI?t=2120) — [H3] Password cracking from shadow files - Key idea: Extract password hashes and use GPU-based cracking to gain root access - Evidence: "Grab shadow file, throw hashes into hashcat, use GPU to crack passwords" #### ⏱️ [40:30](https://youtu.be/SpPd0Q6dmYI?t=2430) — [H1] Legal boundaries and ethics - Key idea: Own the device, test on your own accounts, follow good faith security research - Evidence: "If I own the device and do good faith security research, US laws have carveouts" #### ⏱️ [45:50](https://youtu.be/SpPd0Q6dmYI?t=2750) — [H2] Embedded web servers in IoT devices - Key idea: Many devices run custom web servers for local network communication - Evidence: "Camera streams directly phone to device when on same network to reduce latency" #### ⏱️ [52:15](https://youtu.be/SpPd0Q6dmYI?t=3135) — [H3] Logic analyzers for digital signal analysis - Key idea: Use logic analyzers to decode communications between chips and PCBs - Evidence: "Logic analyzer sits between multimeter and oscilloscope for digital signal sampling" #### ⏱️ [58:40](https://youtu.be/SpPd0Q6dmYI?t=3520) — [H1] Software defined radio for RF analysis - Key idea: SDR tools can capture and replay radio frequency communications - Evidence: "HackRF can record signal and replay it, check FCC database for frequencies" ## 📚 References - [Saleae Logic Analyzers](https://www.saleae.com/) - [Binwalk Tool](https://github.com/ReFirmLabs/binwalk) - [Burp Suite](https://portswigger.net/burp) - [HackRF SDR](https://greatscottgadgets.com/hackrf/) ## 🗣️ Paraphrase - Hardware hacking primarily serves as a pathway to discover software vulnerabilities in IoT devices through physical access - The methodology involves UART console access, firmware extraction from flash chips, and filesystem analysis using tools like binwalk - Legal protections exist for good faith security research, but researchers must own devices and test only their own accounts ## 📰 Newsletter Matt Brown's hardware hacking techniques reveal critical insights for anyone working with IoT devices or embedded systems. His systematic approach - from UART console discovery to firmware extraction - demonstrates how physical access can expose software vulnerabilities invisible through traditional web development tools. Key takeaway: Most IoT security flaws stem from poor software practices rather than hardware weaknesses. Developers can apply these insights by understanding how their code might be analyzed through firmware extraction. Resources: [UART Documentation](https://learn.sparkfun.com/tutorials/serial-communication), [Firmware Analysis Tools](https://github.com/ReFirmLabs/binwalk), [IoT Security Guidelines](https://www.iotsecurityfoundation.org/) ## ✅ Action Items #### DevRel - Developer advocacy: Create hardware security workshop for IoT developers, focus on secure coding practices - Education: Develop firmware analysis curriculum for security-minded developers - Developer experience: Document secure boot and trust store implementation patterns - Developer marketing: Campaign highlighting security-first IoT development - Community management: Moderate hardware hacking discussions, ensure legal compliance #### OSPO - Policy & Governance: Establish hardware security research guidelines and ethics policies - License Compliance: Review firmware extraction implications for open source license compliance - Security Management: Implement IoT vulnerability disclosure processes and coordination - Software Inventory: Track embedded system components and firmware versions across products - Developer Support: Training on secure embedded development practices and threat modeling #### Community - Maintainers: Support secure development practices in IoT-related open source projects - Contributors: Onboard security researchers interested in responsible disclosure - Sponsors: Fund hardware security research and vulnerability remediation efforts #### WordPress - Core: Evaluate IoT integration security for WordPress-powered devices and kiosks - Security: Assess implications of WordPress running on embedded systems and edge devices - Documentation: Create guides for secure WordPress deployment on IoT infrastructure ## 🧪 Hypotheses - Most IoT security vulnerabilities originate from software implementation flaws rather than hardware design issues - UART console access provides root shell access on 70% of consumer IoT devices due to debug interfaces left enabled - Firmware extraction success correlates inversely with device cost and manufacturer security maturity - Legal protections for security research vary significantly by jurisdiction and device ownership status ### 📊 Methodology - Systematic survey of IoT devices across price points and manufacturers to test UART accessibility hypothesis - Statistical analysis of firmware extraction success rates versus security implementation metrics - Legal framework comparison across jurisdictions for security research protections ### ❓ Questions - How can IoT manufacturers balance debug accessibility for development with production security requirements? - What percentage of consumer IoT devices implement proper secure boot and firmware integrity verification? - How do emerging regulations like IoT security labeling programs affect manufacturer security practices? ### 🔮 Future Research - Automated firmware analysis pipelines for large-scale IoT security assessment - Machine learning approaches to identify vulnerability patterns in embedded software - Standardized IoT security testing frameworks for both researchers and manufacturers ### 💡 Implications - Practice: Developers must consider physical access scenarios in IoT threat modeling - Policy: Need for stronger IoT security standards and manufacturer accountability frameworks - Security: Hardware access fundamentally changes attack surface analysis for connected devices - Education: Security curriculum must include embedded systems and hardware attack vectors - Funding: Investment needed in IoT security research tools and responsible disclosure programs ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade #### 👀 Visual learners - Present: PCB diagrams, oscilloscope traces, firmware extraction workflows - Improve: Interactive hardware teardown visualizations, pin identification guides #### 🔊 Aural learners - Present: Detailed verbal explanations of technical processes and methodology - Improve: Audio-described hardware hacking demonstrations, podcast-style technical discussions #### 🗣️ Verbal learners - Present: Clear analogies (UDP socket for UART), technical terminology definitions - Improve: Glossary of hardware hacking terms, comparison tables for tools and techniques #### 🧩 Kinesthetic learners - Present: Hands-on hardware teardown examples, step-by-step UART connection guide - Improve: Virtual lab simulations, interactive firmware analysis exercises #### 🧠 Logical learners - Present: Systematic methodology, decision trees for tool selection - Improve: Flowcharts for attack methodology, troubleshooting decision matrices #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion of legal and ethical considerations - Improve: Collaborative hardware hacking projects, peer review of security findings #### 🧘‍♀️ Solitary learners - Present: Detailed technical documentation, independent research methodology - Improve: Self-paced learning modules, reflective exercises on security implications #### 🌿 Naturalistic learners - Present: Ecosystem thinking about IoT device interconnections - Improve: Environmental impact discussions of device security lifecycles ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive technical explanations - Improve: Alt text for hardware diagrams, audio descriptions of visual demonstrations #### Keyboard navigation - Present: Standard web navigation patterns - Improve: Skip links for technical sections, keyboard shortcuts for video controls #### Contrast and readability - Present: High contrast text, clear technical terminology - Improve: Larger text options for detailed technical diagrams #### Text resizing and reflow - Present: Responsive design for technical content - Improve: Scalable technical diagrams, flexible layout for code examples #### Media and captions - Present: Detailed transcript with technical terminology - Improve: Visual descriptions of hardware manipulation, synchronized highlighting #### Forms and interactions - Present: Clear labels for technical parameters - Improve: Accessible tool selection interfaces, error handling for technical inputs ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global perspective on IoT device availability and legal frameworks - Improve: Examples from diverse manufacturing regions, international law considerations #### Inclusive language - Present: Technical but accessible terminology, avoided military metaphors - Improve: Plain language summaries of complex technical concepts #### Neurodiversity support - Present: Structured technical explanations, clear methodology steps - Improve: Multiple explanation formats, visual aids for abstract concepts #### Representation - Present: Diverse examples of device types and use cases - Improve: Inclusive examples of security researchers and use cases #### Psychological safety - Present: Emphasis on legal and ethical considerations - Improve: Clear guidelines for responsible disclosure, community safety standards ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Clear logical progression from physical access to software exploitation - Inductive strength: Generalizations based on extensive device testing experience - Causal reasoning: Establishes clear cause-effect between hardware access and vulnerability discovery - Analogical strength: Effective comparisons between IoT and web security methodologies #### Fallacies - No significant fallacies identified: Reasoning remains grounded in practical experience - Ethical considerations: Appropriately addresses legal and ethical boundaries #### Tone of voice - Overall tone: Educational and technical, emphasizing responsible security research practices ### 🛡️ DARVO Analysis - Deny: No denial patterns present - transparent about capabilities and limitations - Attack: No attacks on critics - acknowledges legal and ethical boundaries appropriately - Reverse victim/offender: Not applicable - focuses on defensive security research - Emotional cues and rhetoric: Professional and educational tone throughout ## 🎯 Conclusion Matt Brown's hardware hacking methodology provides crucial insights for IoT security, demonstrating how physical device access enables comprehensive software vulnerability analysis. His systematic approach from UART console discovery through firmware extraction reveals that most IoT security issues stem from poor software practices rather than hardware flaws. For practitioners, this highlights the importance of considering physical access scenarios in security design and implementing proper secure boot processes, debug interface management, and firmware integrity verification in IoT deployments. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad Purpose: Stage CEE units that become Literature notes. Split level: H3 ### [H1] Hardware access enables software vulnerability discovery > [!quote] Hardware Hacking with Matt Brown by [[Matt Brown]] via [[Syntax]]. Published 2024. Accessed 2024-12-28. > "Hardware hacking is like a means to an end to hack on software or APIs" Physical device access reveals software vulnerabilities invisible through network analysis alone. [view highlight](https://youtu.be/SpPd0Q6dmYI?t=495#H1) #hardware-security #vulnerability-research ID:rw_hw001 ### [H2] UART console provides direct system access > [!quote] Hardware Hacking with Matt Brown > "Look for TX and RX line, it's kind of --- ## Full Transcript [00:00] Welcome to Syntax. Today we have Matt [00:03] Brown on. He is a YouTuber and security [00:05] consultant who specializes in pentesting [00:07] IoT hardware. He has a YouTube channel [00:09] that's filled with fascinating videos. [00:11] So for example, he found dozens of [00:13] unsecured police license plate cameras [00:16] and they had a video feed. It had a [00:18] stream of all of the data which include [00:19] the license plates, the car making model [00:21] and the GPS coordinates. He's hacked his [00:23] smart grill and extracted the firmware [00:25] from that. and he's dove into the [00:27] network activity of dozens of cheap [00:29] Chinese cameras and recently he let [00:31] Claude Code rip on one of them which was [00:33] really interesting. So we've had him on [00:35] today to talk about how all of this [00:37] hardware hacking stuff works, the [00:39] legality of it and hopefully a few [00:41] interesting stories. Welcome Matt. [00:42] Thanks for coming on. [00:43] >> Thank you for having me. [00:45] >> Yeah. So I've been watching your YouTube [00:47] channel for I don't know probably for [00:49] about a year now. I I'm not sure how I [00:51] stumbled upon it, but you have these [00:52] really good breakdowns of how you can [00:56] take a piece of hardware um and then [00:58] just dig into how it works or find some [01:00] pieces of interesting pieces that you [01:02] may not necessarily know or buying [01:04] something that's from um like a [01:07] different industry like the police [01:08] license plate readers and then you could [01:10] just buy one yourself and then just dig [01:12] into it and you find all the API [01:14] endpoints and then you realize, oh, this [01:17] is maybe not as secure as as we thought [01:19] thought it would be. So, um, look, h how [01:22] do you even get into all of this stuff? [01:25] >> That's a that's a great question. I, uh, [01:28] I guess the the chief kind of hacker [01:32] mentality of curiosity and letting that [01:35] lead you in, in the discovery of [01:37] information and knowledge has always [01:39] been a thing that I've done since my [01:42] youth. So, uh, you know, back in back in [01:45] my high school and college days, you [01:47] know, messing around with computers at [01:49] my school, uh, things like that, I've [01:51] always been interested in going to [01:53] thrift stores. Back when I was in high [01:55] school, I would go to Goodwill, uh, [01:57] which is a a US-based thrift store. Uh, [02:00] I don't know if they have them outside [02:01] the United States, but [02:02] >> yeah, we have them in Canada. [02:03] >> Oh, sweet. So, I would just go buy used [02:06] electronics and take them apart and see [02:08] if I could like take them apart, put [02:10] them back together, see how they worked. [02:12] And that led me uh deeper and deeper [02:15] down the hardware hacking rabbit hole [02:18] where now I on my on my channel, I like [02:23] to just buy used devices, take them [02:25] apart, and usually I'm after two things. [02:28] Uh I I'm usually like you said [02:30] interested in kind of revealing [02:32] knowledge that might have security [02:34] applications in the software. Funny the [02:37] funny thing is there are people that are [02:39] like deep hardware silicon silicon [02:43] >> uh hardware security researchers and [02:45] that's actually not really my thing. [02:46] Usually hardware hacking is like a means [02:48] to an end to hack on software or hack on [02:52] APIs uh to to reveal, you know, APIs [02:56] that I wouldn't have known existed maybe [02:58] unless I dug into a piece of hardware. [03:00] >> Okay, that's that's really interesting [03:02] to me because like in in the web [03:04] development world, we love spelunking [03:06] into the dev tools. you know, you open [03:09] up the network tab and you see what's [03:11] going on or um we have an an app on the [03:13] desktop called proxy man and that will [03:16] allow you to monitor traffic that's [03:17] coming in and out of it. And some of us [03:20] dip into like maybe even like Wireshark [03:22] where you get a little bit past like [03:23] just HTTP traffic and and into some of [03:26] the lower level stuff. But once once it [03:29] ends on like something running on your [03:31] machine or maybe something running on [03:34] like your phone and you proxy your [03:36] phone's traffic through your computer, [03:38] that's kind of where it ends for me of [03:40] like dipping into it. And there's always [03:42] like these like like you get a camera or [03:44] you get like this thing that you [03:45] connects to your Wi-Fi and I'm always [03:47] curious like man like what are the API [03:50] calls um happening there and it's it's [03:54] kind of tricky. So, like let's say you [03:56] pick up a piece of hardware, what are [03:57] your like first steps for sort of [03:59] breaking that down, trying to find out [04:01] what the APIs are? [04:03] >> Yeah. So, if I'm looking at kind of your [04:06] standard IoT device that is going to [04:09] make calls out to some backend server on [04:12] the internet, most of the time that's [04:14] going to be wrapped in TLS, right? So, [04:17] just opening it up in Wireshark, I'm [04:20] going to get a host name and nothing [04:21] more. I'm not going to get any endpoint [04:23] information. And I'm not going to like [04:26] cuz what we want, right, is we want it [04:28] to be like the network tab on in [04:30] DevTools. We want to actually see uh the [04:33] requests and the responses cuz then as [04:36] security, you know, from a security or [04:38] maybe just a tinkering perspective, [04:40] maybe you want to write your own [04:42] application that interacts with the [04:44] backend, right? Kind some kind of a [04:46] third party thing there. There's all [04:47] sorts of applications of this this [04:49] hardware hacking uh work. And so there's [04:53] a couple of avenues. One is if we can [04:57] get a root shell on that device, if we [04:59] can if we can if we can gain control [05:01] over the device, then we could [05:04] potentially put a our own CA certificate [05:08] in the trust store of that device. kind [05:12] of like if you've ever used uh Burp [05:14] Suite or any of these proxying tools to [05:17] look at web traffic from your web [05:19] browser, you have to go in either to [05:22] your computer's trust store or the [05:25] browsers like uh Firefox has its own [05:27] independent trust store. Uh Chrome uses [05:30] the OSS and you have to add the proxy [05:33] certificate to allow it to terminate [05:36] that SSL that TLS communications. So [05:39] that's why when like you get like a [05:41] laptop from your employer and they [05:43] install their own certificate, they're [05:45] able to even though the website you're [05:47] going to may be HTTPS, they're still [05:50] able to see every request that's that's [05:51] coming through there because they [05:52] literally are putting a secured [05:54] certificate in the the chain, right? [05:57] >> That's exactly right. [05:58] >> Yeah. So we can effectively do the same [06:01] thing in the hardware world if we if we [06:03] if we obtain a root shell or we're able [06:06] to you know modify that firmware somehow [06:08] modify the running device and put our [06:11] cert into the trust store and I say [06:13] trust store we have to do some reverse [06:16] engineering sometimes it's it's like a [06:18] common Debian system where it's going to [06:20] be in you know Etsy SSL you know uh s [06:24] certificates or something like that [06:26] that's really common sometimes it'll be [06:28] super hardcoded into a binary that you [06:30] kind of have to do some reversing and [06:32] mod modifying of the system to figure [06:34] out how to uh put yourself in that chain [06:37] of trust. But once we put ours in that [06:39] chain of trust, then we can use a a [06:43] transparent or an intercepting proxy [06:46] which Burpuite and Kaido they do have a [06:49] mode where you can enable that and allow [06:52] it to to proxy your traffic. Now then [06:55] you have to you have to do some network [06:57] shenanigans maybe with IP tables or [07:00] something with your router to uh [07:02] convince your device to route its [07:05] traffic through this system that has a [07:07] transparent proxy. But at that point we [07:10] we are able to see all the contents of [07:13] those uh that HTTP communication. And if [07:16] you want to see all of the errors in [07:18] your application you'll want to check [07:20] out Sentry at centry.io/sax. [07:24] You don't want a production application [07:26] out there that well you have no [07:27] visibility into in case something is [07:30] blowing up and you might not even know [07:31] it. So head on over to centry.io/sintax. [07:34] Again, we've been using this tool for a [07:36] long time and it totally rules. All [07:38] right. [07:40] And like what's usually running on these [07:42] devices? You mentioned like Debian like [07:44] are a lot of these things just running [07:46] like Linux on them or is it it does it [07:48] depend? [07:49] >> Yeah. Uh so in the IoT world there's [07:51] kind of two categories of devices. There [07:54] are more traditional Linux-based devices [07:58] uh and then there are microcontrollers. [08:01] And so you'll often see these used in uh [08:05] different applications if you need like [08:06] a low power application if it's a [08:08] battery powered device. Now the these [08:10] these lines can blur of course but [08:12] generally speaking if you you have low [08:13] power battery powered device those are [08:16] often times going to be microcontrollers [08:18] which are a whole a whole another game [08:22] in terms of uh how to do that firmware [08:24] modification [08:24] >> like an ESP32 or like a one of those [08:27] like Raspberry Pi Picos or something [08:29] like that. [08:30] >> Exactly. Yeah. And that's yeah the [08:32] Raspberry Pi world is a great [08:33] distinction. So, Raspberry Pi Pico [08:35] microcontroller, regular traditional [08:37] Raspberry Pi is going to be a uh a [08:40] microprocessor that runs Linux kind of [08:44] operating system. Exactly. [08:46] >> So, in the Linux case, that's that's [08:49] what you're going to find most of the [08:50] time. If you're if you're targeting [08:52] routers, IP cameras, most of the time [08:54] those are going to be Linux. Now, that [08:56] is changing uh because people like [08:58] batterypowered cameras. They like [09:00] lighter weight devices that uh don't [09:03] need to be plugged in. And so you are [09:05] seeing uh some advancements in [09:06] microcontrollers in that in that space. [09:09] for Linux devices. Yeah, it's it's [09:11] oftentimes going to be just a very kind [09:14] of custom [09:16] like I call it like an SDK where a chip [09:19] provider will provide an entire build [09:21] system that will include a kernel and uh [09:25] the all the root file system necessary [09:28] to boot Linux. And then on top of that, [09:31] a device manufacturer will build all [09:33] their custom business logic in the form [09:36] of some kind of a Damon that will run [09:38] and that will communicate out to the [09:40] cloud. [09:42] >> And what language is that stuff written [09:44] in? Typically, [09:46] >> mostly it's C. You'll see some C++. [09:50] uh in very odd cases you'll see some [09:54] higher level languages like Python being [09:57] used but it's it's mostly a bunch of C [10:00] code that is ripe for finding you know [10:03] command injection buffer overflow type [10:05] vulnerabilities uh that are that are [10:08] kind of commonly plague those languages. [10:10] Yeah. [10:10] >> Okay. So you get something and like how [10:14] do you even get root access to that [10:15] thing in the first place? You plug it in [10:17] via USB. often it will just like go into [10:19] the mode where it just like mounts as a [10:21] USB drive or or acts as a camera. How do [10:23] you get the lower level which is access [10:26] to like the firmware that's running on [10:27] this thing? [10:29] >> Yeah. So, so typically what I'm going to [10:31] do is I'm going to open up the device [10:34] and the first thing I'm going to look [10:36] for is the UART console header or debug [10:41] pins on that device. It's typically [10:45] going to be a fourpin header or [10:48] connector that might not even be [10:51] populated, right? That they might for [10:54] their debug version or their kind of [10:56] development version of that device, they [10:57] might actually have a header populated, [11:00] whereas in production, they might try to [11:02] like take that component out just to [11:04] save a little bit on their uh on their [11:06] bill of materials cost for the device. [11:09] But uh you're you're going to look for [11:11] that connector and that's where uh kind [11:14] of in my videos I talk about how there [11:16] are these USB to UR adapters and those [11:20] are going to be set to a certain [11:22] voltage. 3.3 volts is like the most [11:24] common one you find out there. And when [11:27] you connect up to you know the TX and [11:29] the RX line so it's just an asynchronous [11:32] uh physical communication. And my my [11:34] analogy I like to talk about is it's [11:36] kind of like a physical UDP socket, [11:39] right? It's you can you can send and [11:42] receive data across this these physical [11:44] wires and then on the device that can be [11:48] connected up to [11:50] a couple different things. So on a Linux [11:52] device that's typically going to be [11:54] connected to the console. And so if you [11:58] are connected properly and you power on [12:00] your device, you're going to start to [12:02] see the bootloadader logs roll by and [12:06] maybe you can enter maybe you can like [12:08] smash a key and interrupt that boot [12:11] process. If we let it boot up fully, [12:14] maybe they're they're uh you know dumb [12:16] enough to just leave a a logged in root [12:19] shell, right? They they don't even make [12:21] you log in or maybe there is a login [12:22] prompt, right? Uh, and this is where we [12:25] start to rabbit hole into different ways [12:27] to turn the situation into that root [12:30] shell. So, so, uh, it's it there there's [12:33] there's a lot of different tricks uh, [12:35] you can do, but if you have that console [12:37] access, you can often times turn it into [12:39] a root shell. [12:41] >> That's that's so fascinating to me [12:42] because like you open up any [12:44] electronics, you're often going to see a [12:46] couple little dots that'll say TX, RX, [12:48] and and ground, right? And th those are [12:50] your UART connections and Y and you [12:53] connect you can buy on Amazon you buy [12:54] like a $5 little USB converter um where [12:57] you just attach to those pins. I know [12:59] there's some probably some more advanced [13:01] like things, but at the very basic [13:03] you're trying to connect those three [13:04] wires to a USB. Um, and then you can [13:07] directly connect to that from your [13:09] computer. And then when you turn it on, [13:10] the the way I know about this is cuz I [13:12] did a uh putting JavaScript on my Roomba [13:15] video. And if anyone's like looking to [13:18] get into having fun, the old crappy [13:21] Roombas are like $6 at a thrift store. [13:25] And there is full documentation and [13:28] there's there's a pin header right on [13:29] the on the top of the Roomba. You don't [13:31] even have to open it up. Um, and you can [13:33] connect directly to it. And then when it [13:35] boots up, you can see all of the logs. [13:38] Um, and then you can just start sending [13:39] and receiving commands from it. And [13:41] there's there's libraries out there that [13:42] will help you um both send what the [13:46] commands are, you know, as well as [13:48] receive things like the battery [13:50] temperature and and and the how fast [13:53] something is driving, all that [13:54] interesting stuff. [13:55] >> Oh, that's so cool. [13:57] >> Yeah. But so like I'm curious like [13:58] that's like that was really well [14:00] documented for me, right? Like Roomba [14:02] Roomba wants you to hack them, which is [14:04] kind of a bummer. Now Roomba's filing [14:06] for bankruptcy. Um, but like what do you [14:09] do to figure out what these commands are [14:12] when someone doesn't want you to to hack [14:14] with it? [14:15] >> Yeah, that's that's a great question and [14:17] that kind of leads into the second [14:19] activity. So if like if the first [14:21] activity is like finding that UART [14:23] console and if it doesn't immediately [14:26] give you what you want, right? it [14:27] doesn't just like drop you into a Linux [14:29] shell. Maybe maybe it leaves you at a [14:31] login prompt and you're like okay how [14:33] how would I guess what the you know the [14:35] username and password is kind of the [14:37] second activity then is firmware [14:39] extraction uh in terms of hardware [14:41] hacking again always for that purpose of [14:43] hacking the software. So, this is like [14:47] where we are able to, you know, with a [14:49] hot air gun I've got over on the bench [14:51] here, uh, able to desolder a a chip. [14:54] Some sometimes you can read the chips in [14:57] circuit, meaning you can leave it [14:58] attached to the board and you can attach [15:01] a, you know, a universal like a [15:03] programmer, a firmware reader to a chip. [15:06] Uh, some chips are just not able to be [15:08] attached to that way based on the [15:10] physical uh, layout of the chip. And so [15:13] uh that's why I prefer to desolder [15:15] things. Also, you can run into some [15:17] issues where if your incircuit [15:19] programmer reader can like inject power, [15:23] it can basically power the board and [15:25] cause it to do a bunch of uh undefined [15:28] things. So, usually [15:31] >> let the smoke out. Is does that happen [15:33] sometime? [15:34] >> Uh it can it can or it can just like [15:37] mess with mess with your firmware read [15:38] is what is what's probably more likely. [15:40] >> Oh, I see. I see. Okay. because then [15:42] you'll like power up the CPU or the MCU [15:45] and it will try to start talking to the [15:48] flash chip too to read and write from it [15:51] while you're while your programmer is [15:53] also trying to interact with it. And so [15:55] you're you're like both like arguing [15:57] over who has control over the flash [15:59] chip. Uh [16:01] >> oh, I see. [16:02] >> Yeah. [16:04] >> Okay. Okay. So, so once once you once [16:06] you remove that flash chip, uh you're [16:08] going to plug you're going to you're [16:09] going to put it into a programmer and [16:11] then obviously you need to have a bunch [16:12] of different kind of adapters to fit the [16:14] different kinds of chips. Uh but once we [16:16] do that and and once we read that [16:18] software off, we you're usually left [16:21] with a binary blob that is the entire [16:24] contents of that flash chip. And so [16:27] usually on a Linux-based device that is [16:31] going to contain multiple partitions, [16:33] multiple file systems. And so that's [16:36] when our handy tools like binwalk [16:39] are going to come in handy for searching [16:42] through that binary blob to extract out [16:45] well-known file systems. So you'll [16:48] you'll see things uh especially on more [16:50] heavy Linux systems or like Android [16:52] based devices, you'll see like ext4 file [16:55] systems. There are also a lot of file [16:58] systems that are made specifically for [17:00] embedded devices like Squash FS. Um [17:04] there there there's a whole number of [17:06] file systems that you'll never see [17:08] outside of kind of the IoT space. [17:11] >> But these things are like are like [17:12] well-known that that's what was so [17:14] interesting to me about this is that [17:16] like just like us web developers were [17:19] reaching for like React and Node and all [17:22] of these like well-known things. people [17:24] who are making hardware are are also [17:26] reaching for well-known things. Often [17:29] they'll take a chip off the shelf that [17:31] is like 80% of the way there. Um and [17:33] because those things are wellknown then [17:35] they are also a little bit easier to [17:38] decrypt with tools like binwalk. Is that [17:40] true? [17:41] >> That is true. Yeah. So, so binwok [17:43] usually if you the the the common flag [17:46] you pass it is dash lowercase e which is [17:48] just hey extract is the extraction flag [17:52] like say hey go through go through this [17:53] file and extract out all of the [17:56] well-known file systems and so if that [17:59] works and you know there's there's a [18:00] whole bunch of caveats of you know [18:02] sometimes a manufacturer will try to be [18:04] cute and like slightly modify a file [18:07] system specification but most of the [18:09] time they don't do that and you're left [18:12] with the contents of like maybe the root [18:15] file system and maybe a another [18:18] partition. So most of the time on these [18:19] IoT devices there'll be multiple [18:21] partitions and the root file system will [18:23] be read only kind kind of as a a [18:26] reliability mechanism right to to keep [18:30] creep and and errors from making the [18:33] system unbootable. And so and then [18:35] you'll you'll have data stored in [18:37] another partition. And those are all of [18:40] the things that you need to then go [18:42] start searching through the file system [18:44] for binaries you might want to throw [18:47] into a reverse engineering tool or say [18:50] the the the Etsy shadow file to uh grab [18:53] password hashes out of and then you can [18:55] try to crack those password hashes to go [18:57] back to your UART console to attempt to [19:00] log in. [19:02] >> Okay, [19:04] man. That this is so fascinating to me. [19:06] Sorry, Scott. But I'm not letting you [19:07] know. I haven't let talk at all. [19:09] >> I don't do any of this stuff. So, uh, [19:11] Wes is the the hardware hacker on this [19:14] show, so I'm just kind of like [19:16] >> listening and soaking it in. So, no, I I [19:18] I appreciate I appreciate your insight, [19:21] Wes. [19:21] >> All right. Well, good. Oh, so like like [19:24] what's the next step then? So, like once [19:26] you've dumped this firmware and you've [19:28] used Binwok to sort of look through it, [19:30] like what are you now then looking for? [19:32] >> Yeah. So, like I said, if if I if my [19:35] goal is still like if I haven't [19:37] accomplished that root shell goal yet, [19:39] then I might look for things like, you [19:43] know, the shadow file, and then I might [19:46] grab those password hashes, those Linux [19:48] password hashes, and throw them into [19:51] hashcat, use my GPU to to try to crack [19:54] uh those passwords. And so, if that's [19:57] successful, then that gets me in. If [19:59] that's not successful, there's kind of [20:02] the next step down the rabbit hole of [20:05] attempting to modify that firmware [20:08] image. So, if there's if there's a [20:11] password that I can't crack, but but [20:13] there's a shadow file, maybe I could [20:16] replace it with with with a hash that I [20:19] do know the p the corresponding password [20:21] to. And then if I can package all the [20:24] file systems back up into that binary [20:26] blob and then use my programmer to write [20:29] back to the chip and then solder the [20:32] chip back onto the board. [20:34] >> Gosh. [20:35] >> Then it would assuming there's no kind [20:39] of secure boot controls, there's no [20:41] integrity controls on the system. Uh [20:43] which you're seeing more devices that [20:45] have those, but some of them there [20:48] there's still lots out there that don't [20:49] have those kind of controls. [20:51] Can I can I tell you a story of one time [20:53] I accidentally did that? [20:55] >> Um, I had bought a [20:57] >> this was probably like 12 years ago and [20:59] I had bought a camera off of uh I think [21:03] AliExpress or or Deal Extreme back in [21:06] then. And it was like the Chinese [21:08] version of a very popular North American [21:10] brand. Um, and I was like, I wonder if I [21:14] can just load the firmware from the [21:16] North American one onto the Chinese one. [21:19] So, I I went on GitHub and I found [21:21] somebody had dumped the firmware from [21:23] one of the North American cameras. So, I [21:25] just dumped that on my camera, booted it [21:27] up, paired it to the North American app, [21:29] no problem. And all of a sudden, I see [21:31] video from somebody else's camera. And I [21:36] was like, "Oh no." Like, this is it must [21:40] have like a like it must have like [21:42] flashed the MAC address or some sort of [21:44] identifier. Um, and it was like in [21:46] someone's bedroom. So, I I unplugged it [21:48] and I've never to this day plugged that [21:50] camera back in again cuz I was like, I [21:51] don't know if I just what I just did was [21:53] illegal or whatever, but I was just [21:56] trying to get add it to my own thing. [21:58] Um, and it it started streaming in [22:00] someone else's video and I was like I [22:02] was almost kind of scared there and I [22:04] just I have never plugged it in again. I [22:06] think I tossed it a couple years ago cuz [22:07] it was kind of scary, but that's [22:09] something that could happen, right? [22:11] >> Oh, yeah. So, so that's Yeah. So, so [22:13] going back to the there how there's [22:15] commonly like a root file system that's [22:17] that that's kind of, you know, [22:19] unmodifiable that and then there's the [22:22] data partition. So, what was probably [22:24] wrapped up in that in the data partition [22:25] somewhere is some kind of APIs, tokens, [22:28] keys that uh identifiers that [22:30] corresponded to probably the person who [22:32] made that repo and the firmware dump, [22:34] right? [22:35] >> Yeah. Yeah. [22:36] >> And and and then and then in and then [22:38] you by flashing that on onto your [22:40] device, you basically you basically [22:44] cloned the device, right? And so, uh, [22:47] that is an attack that, you know, that [22:51] that that could be considered valid, you [22:54] know, in in some cases. Now, obviously, [22:57] you need like physical access, you need [22:58] a firmware dump to somebody else's [23:00] camera. So, it's like in in in a lot of [23:02] cases that won't be like a security [23:04] vulnerability, right? [23:05] >> Yeah. [23:05] >> It's like if I give my keys away to [23:08] somebody else, it's like, okay, yeah, [23:09] then they can then they can then they [23:11] can access They can enter your house. [23:13] Yeah. Okay. [23:14] >> Yeah. So, I with all of this stuff, like [23:16] where does that legality border exist? [23:20] >> Yeah. Have you ever had the police knock [23:22] on your door? [23:23] >> No. No. No. No police. I've I've had [23:26] some strongly worded emails, but uh I [23:28] haven't I haven't been sued yet, so that [23:30] that's good. Knock knock knock on wood [23:31] here. So, generally speaking, [23:34] my understanding I'm not a lawyer, by [23:36] the way, so this is not not legal [23:38] advice. uh is if I own the device, [23:42] right? I like like like I'm always very [23:44] careful when doing security research to [23:48] like like like if I'm hitting API like [23:50] cloud APIs, that's where I draw a very [23:52] strict line to if I want to test can [23:56] like one device kind of access the stuff [24:00] of another device, then I'll buy two [24:02] devices and I'll create I'll create two [24:05] accounts, right? and I'll try to do [24:08] those cross account attacks on myself. [24:10] Uh again, not legal advice. Uh that [24:13] might still be considered an [24:14] unauthorized test. And then obviously [24:16] the hardware is that's my property when [24:19] I buy it. Um there there are some United [24:24] States laws against reverse engineering, [24:27] but at least today they still all have [24:30] carveouts for what is called goodfaith [24:33] security research. So, [24:36] >> uh, again, I'm not a lawyer and don't [24:38] know the the specific definition of that [24:39] term, but I try to do my research in [24:42] good faith, uh, and and to not not to [24:45] use it maliciously, not to attack other [24:48] people. And so, uh, at least in the [24:50] United States, we have kind of those [24:52] protections. I obviously don't know [24:55] about about other countries what the [24:56] situation is there. Yeah. [24:58] >> All right. So, where where were we with [25:00] the the process of [25:03] >> I think Yeah. like what what to do with [25:05] the firmware extraction. So another [25:07] thing that might that might be [25:08] interesting especially to like kind of [25:10] like in getting into the web topic is so [25:14] the first kind of theoretical IoT device [25:16] we talked about was where the device [25:18] reaches out to a cloud server via its [25:20] APIs but also a lot of times these [25:23] devices will have their own embedded web [25:25] servers on them. they'll have or or [25:27] other network services that can be [25:28] connected into, right? So maybe maybe [25:31] there's a mobile application and le [25:34] let's talk about a video camera, right? [25:36] So in the video camera use case, you [25:39] could think of okay, I want to be able [25:41] to access my camera remotely and so when [25:44] I'm away from my home uh on the mobile [25:47] app, that that data has to go up through [25:49] the cloud server. But if I'm in my house [25:51] now, there's a lot of latency. There's a [25:53] lot of video latency in that first case. [25:56] So maybe when I'm in my house, I'm on [25:58] the same network. I want it to stream [26:00] directly from from phone to camera. And [26:02] so a a lot of video cameras will do [26:04] this. They'll have a way that that it [26:06] can sense that and the mobile [26:08] application can directly connect to a [26:11] service that's running on the device. [26:14] And so once I have that firmware, I can [26:17] usually find the binaries that are [26:20] hosting those web servers or those [26:23] custom binary protocols that are running [26:27] on the device. And the the web servers [26:30] are especially interesting cuz sometimes [26:33] you'll see kind of standardized servers [26:35] that use like CGI like light HTTPD [26:39] which will uh so so light HTTPD will [26:43] manage kind of the basic web stuff but [26:46] then it will make calls to a binary to [26:48] like a C program that will actually like [26:51] execute [26:52] when you make a web request to certain [26:55] endpoints. [26:57] Also, you'll see people roll their own [27:01] web server and web application all in [27:04] one binary, [27:06] which is uh which is always fascinating [27:09] because then they're they're doing all [27:11] the raw they're writing they're rolling [27:14] their own web server [27:15] >> many times and so there's all sorts of [27:18] you know potential security issues there [27:20] and then the application actually the [27:22] the business logic is all implemented [27:24] all in one binary [27:26] >> that that's exactly what I did with my [27:27] Roomba, the uh the ReactJS code, the web [27:31] server, the websocket server, and the [27:33] like lower level communicate send bytes [27:36] to the the Roomba. Uh that was all in a [27:39] single binary. So that's that's [27:41] generally not a good idea, you're [27:43] saying? No, I it it it like I guess what [27:47] I'm saying in the IoT world there's not [27:49] like there's some standards but it [27:53] hasn't coalesed as much as the [27:56] traditional web world I guess around a [27:58] certain set of frameworks and standards. [28:02] There's a lot of different people who [28:05] had their own ideas about how to [28:07] implement a web server and or a web [28:10] application and it just leads to a lot [28:13] of security bugs where each case is [28:17] different. It's not like I can run like [28:20] it's not like I have a security tool [28:21] that audits like React applications and [28:24] then I run I run that tool and then I [28:26] find V's like common mistakes people [28:30] make with that framework. There's not [28:31] like just oftent times it requires [28:34] custom reverse engineering of each web [28:37] server application on each device to [28:41] really uncover if there's anything [28:42] that's uh not being done correctly. [28:45] >> Oh man. All right. So you you have [28:47] access you figure out what the API [28:49] endpoints are. Um and then like like [28:52] what's your process for trying to [28:54] replicate what these these things are? [28:55] Do you then bring that to your just to [28:57] your computer or then or do you try to [28:59] like put a custom firmware on the [29:01] device? [29:03] >> Yeah, that kind of depends. Usually I'll [29:05] try to extract uh some of that logic [29:08] out, right? Like like you want to figure [29:10] out how the authentication is being done [29:13] and even that you'll see being done in [29:16] kind of a multitude of ways. you'll uh [29:19] it might be using you know m mutual TLS [29:21] authentication with kind of like client [29:23] client certificate au [29:26] uh or or you know some kind of API key [29:28] that's on the device if I can get that [29:30] off the device and replicate it in you [29:33] know Python or or in my own browser uh [29:37] that's something that I like to do a lot [29:40] but uh yeah a lot of times it's just [29:42] like making little custom Python scripts [29:44] on my on my desktop side to to emulate [29:48] the device and its calls. And then I can [29:50] fiddle with, you know, hey, can like I [29:53] have a device on this account and a [29:55] device on this account. Can device A [29:58] access uh or make API calls as if it was [30:01] device B? [30:03] >> Okay, I see. [30:04] >> Yeah, that's fascinating. [30:06] >> What get what gets you inspired to look [30:08] at stuff uh specifically? Like what how [30:10] do you pick a project that you're [30:12] working on? Is it just uh you see [30:14] something and you have a question and [30:17] like you mentioned your your innate [30:18] curiosity kind of takes over? [30:21] >> Yeah, I guess yeah I I guess it is that [30:24] curiosity and I'm I'm always like [30:28] looking for challenges in new [30:30] industries, right? So like like right [30:32] now like this is something I haven't [30:34] even made a video on yet, but uh I'm [30:36] kind of getting interested in drone [30:38] technology and and drone hacking. And so [30:42] then there's a whole bunch of like skill [30:44] sets that that that involves. So I might [30:47] look for different devices to like help [30:49] me build a certain skill set. Right? So [30:53] there's been times where I've purposely [30:55] sought out uh devices that I think will [30:57] have a certain kind of microcontroller [30:59] or a certain component that I want to [31:01] learn more about. And so I'll kind of [31:04] try to cherrypick the hardware to to [31:07] teach me something because honestly [31:10] making content, making the videos is one [31:12] of the best ways that I learn and and I [31:14] get better as a professional uh by just [31:17] uh yeah trying to do something new. [31:20] >> Yeah. [31:20] >> What about uh doing more like [31:23] man-in-the-middle [31:24] um detection? So, I'm thinking about [31:26] right now we have I've got a fleet of [31:29] these like 12vt Fisher Price cars that [31:32] our kids drive on. Um, and we have one [31:34] that's called a Wild Thing where it's [31:36] kind of like a little wheelchair that [31:37] you sit in. You have two joysticks. It I [31:40] found on the side of the road in the [31:41] trash and and it didn't work. It was [31:43] erratic. Um, so I replaced the main like [31:46] motherboard on it with a brand new one [31:48] and it still didn't fix it. So, I was [31:50] like, "Oh, the the joysticks themselves [31:52] have um little daughter boards on them, [31:55] like tiny little boards." And and I'm [31:57] I'm at a point now where I'm like, "How [31:59] do I figure out what the daughterboard [32:02] is sending to the main board?" That's is [32:04] that something that you dip into as [32:06] well? It's not really APIs. It's more [32:07] lower level. I think about like um the [32:09] button to talk to my garage door is not [32:12] simply just like a closing a loop of [32:14] electricity. It's it's sending some sort [32:16] of data. How would I figure out what [32:17] that data is? [32:19] Yeah, that that's a great question and [32:21] that is that is stuff that I do and the [32:24] tool is going to be a logic analyzer [32:26] that's that's going to help get you [32:29] insight into those digital [32:31] communications that are happening kind [32:32] of like like between different chips on [32:36] a PCB or between two different PCBs. So, [32:40] uh yeah, so you typically a logic [32:42] analyzer is what's going to help you and [32:44] and then connecting up to th to those [32:46] lines, right? So if we go back to the to [32:49] the case of the UART console, right? [32:52] Those that's just digital [32:54] communications, but there's like there's [32:56] not yet another end connected to it, [32:59] right? So sometimes if I'm trying to uh [33:04] even debug a UART uh kind of interface, [33:07] may maybe it has a really weird uh baud [33:11] rate, the like a symbol rate for for for [33:14] how for how fast it transmits sometimes. [33:17] Then I have to go back a step. I I I [33:19] have to set aside that USB to to UART [33:22] adapter for a second and actually [33:24] connect up a logic analyzer. So the best [33:27] way to think about a logic analyzer is [33:29] if if if we know what a multimeter is, [33:32] right? A multimeter measures voltage, [33:34] right? And a multimeter is slow, right? [33:37] So it's like I connect it up to like a [33:38] circuit. It might say if I connect it up [33:40] to like a UART uh where where a digital [33:43] signal where it's oscillating between 0 [33:45] volts and 3.3 volts then a multimeter it [33:49] might like it might like give you a [33:50] little fluctuation if there's some data [33:52] being communicated but it's going to be [33:55] really slow. [33:56] >> Yeah. [33:56] >> But a logic analyzer can sample a lot [33:59] faster and can give you a nice clean [34:01] kind of a square wave that is that [34:04] represents that digital signal. And then [34:08] >> yeah, go ahead. [34:09] >> Is is that what like an oscilloscope is? [34:11] I see it over your shoulder right now. [34:13] >> So So yeah. No, and that that's that's a [34:16] great like thing to put on the spectrum [34:18] because on on the kind of spectrum of [34:21] sample rate, multimeter super low. Logic [34:24] analyzer kind of sits in the middle and [34:26] then oscilloscope is like super fast [34:29] sample rate. So it's kind of like [34:31] figuring out the right tool for the [34:34] right job. But they're they're kind of [34:36] all sampling uh you know the DC voltage [34:40] and giving you kind of a readout of of [34:43] what that situation is. So most of the [34:45] times to to interpret a digital signal [34:47] you don't need to go as far as an [34:49] oscilloscope. [34:50] >> Usually a logic analyzer will [34:52] >> a logic analyzer will also record it. So [34:54] you could like I could hook it up, hit [34:56] the button or like like like pull the [34:59] controller back and then go back and [35:01] look at it and say it sent like it sent [35:04] just like high highs and lows. Is that's [35:06] is that what it's sending? [35:08] >> Yeah, exactly. So the most common one [35:10] out there uh that that that goes with [35:13] soy makes a lot of very nice they're a [35:16] little more expensive logic analyzers. [35:18] You can also get little ones for like [35:20] $10 that are kind of like knockoffs uh [35:23] on Amazon and it it it will work with [35:25] their software as well. It's called like [35:27] logic 2 is the name of the software and [35:29] yeah it will give you a graph that you [35:31] can you can zoom in and out on the [35:33] signals and then it will include all of [35:36] these analyzers right so if you're like [35:38] okay I think this is a serial [35:42] communications then you can you can kind [35:45] of add the analyzer and it will let's [35:48] say if it's like transmitting like just [35:49] asky data back and forth like a kind of [35:52] that UR console uh situation would you [35:55] can have it interpret it and and you [35:57] you'll see like over a set of eight [36:00] bytes it it it can put the symbol it can [36:03] say okay this is the letter A that's [36:05] being transmitted uh if if you're [36:07] interpreting that correctly and you can [36:09] and and that's where you can kind of [36:10] test hypotheses to be like I think this [36:13] is a UART signal and I think the signal [36:15] rate is this uh there's also other [36:19] protocols that can be used like you know [36:22] like SPI or uh I squared See, there's [36:26] there's these different digital [36:27] protocols that uh you know use one or [36:31] more wires to communicate a digital [36:35] signal. [36:37] >> Okay. Cuz so GitHub Universe had a a [36:41] badge that was like like a little PCB [36:43] has a Raspberry Pi microcontroller on [36:46] it. Um, and there's a little I only [36:48] recently learned it's not I2C, it's I [36:50] squared C. But that's often where you [36:53] can buy like a microphone or a little [36:55] display or something that also sends I [36:59] squared C communication. It's a kind of [37:01] a nice hot plug thing. [37:03] >> Yeah. Yeah. And so so those those logic [37:05] analyzers are what to use when you like [37:09] like you're like, okay, I think it's [37:11] using one of those well-defined [37:13] protocols, but I don't know which one it [37:15] is. Right? It's it's kind of your first [37:17] step to uncovering that mystery. And [37:21] then [37:22] >> once you do that, then you can use kind [37:24] of a dedicated tool that that speaks [37:28] whatever the protocol is. Uh like in our [37:31] USB to UART example, if it's a ser if [37:34] it's serial communications, uh that [37:36] that's what UART is, right? It's it's [37:38] it's a it's a ser it's a form of uh it's [37:40] a two-way, you know, serial uh as [37:43] asynchronous serial communications. So, [37:46] >> and is this what like tuners are doing [37:48] in cars as well? Cuz in your car, you've [37:50] got like an OBD port. Um and there's all [37:53] kinds of pins on that thing is. And then [37:55] that you can get some guy to like tune [37:57] your Dodge Ram or whatever, right, to [37:59] roll coal. Is is that what they're doing [38:01] here? [38:02] >> Yeah. And so that's that's another [38:04] protocol. Uh more or less. Uh but [38:07] they're probably going to be again using [38:09] a dedicated tool because they know what [38:10] protocol that it's going to be CAN. So [38:13] CAN bus. Yes. Yeah. Yeah. CAN is is the [38:15] protocol that pretty much all uh [38:18] automotive stuff uses uh to to [38:21] communicate. So you know your your wheel [38:23] sensor can communicate to the ECU and [38:26] all the other components in your car uh [38:29] can can read the messages of what's [38:31] going on in the car. And so that's [38:33] that's what that ODB2 port is giving you [38:35] access to. So you could use a logic [38:37] analyzer. Uh but in that case pretty [38:40] much everybody knows they're like okay [38:42] it's it's going to be speaking CAN. So [38:43] we can use a CANSP specific tool. The [38:46] the the the logic analyzer is the [38:49] generalist tool. And then usually you [38:52] you figure out what what what language [38:55] what protocol uh those physic uh those [38:58] digital communications are using and [39:00] then you and then you use a [39:01] purpose-built tool uh to kind of hone in [39:03] on that. Oh, that's cool. I've always [39:06] wondered that because in like the Tesla [39:07] world, there's all these like [39:08] aftermarket accessories that will like [39:11] pop the passenger door open or or um [39:14] like recline the passenger or turn the [39:16] back lights on and people just add [39:18] buttons wherever they want. And it's [39:20] because they're just they're adding this [39:21] little module somewhere in the CAN [39:24] stream and I guess intercepting those [39:26] requests and or sending them down the [39:28] pipe if they need to. [39:30] >> Yeah, [39:30] >> that's cool. Have have you dug into any [39:32] of the car hacking stuff yet or is there [39:34] plenty on your bench to work on? [39:37] >> Yeah. Yeah, that that that that hasn't [39:39] been an area of focus yet. I like I [39:42] said, I I'm curious about everything. [39:44] So, it's just a matter of uh managing [39:46] that curiosity. Uh haven't gotten quite [39:49] into the [39:51] >> uh the automotive world yet. [39:54] Do you have any like crazy stories of of [39:56] things you've done recently that is kind [39:58] of fun [39:59] >> or or even just like like hardware IRL? [40:01] Like I every time I see like a massage [40:03] chair or like an arcade claw machine, [40:06] I'm always trying to hit combinations of [40:08] buttons or uh like trying to like reset [40:12] it like I or the the inscreen [40:14] entertainment systems and the plane. [40:16] You're always trying to hit the buttons [40:17] and figure out what that is. [40:20] >> Yeah, I think I had a post on X about [40:22] that. I was I was like flying back I [40:23] think it was from Defcon and like I was [40:26] able to figure out like like I wasn't [40:28] able to get a full escape back to like [40:30] the Android but you but like those most [40:32] of those increen displays are are [40:34] Android [40:36] in in in fact I I like this is a little [40:38] bit of context into the the industry [40:40] that I'm most familiar with but most [40:42] like security panels at home that have a [40:44] nice display not like a super old like [40:47] crappy LCD display but a proper display [40:50] on them those are usually running [40:52] Android as well. [40:53] >> Oh, interesting. [40:54] >> But uh yeah, those in those increen [40:57] displays uh I was able to like enter a [41:00] game and then like it would it would [41:02] show the home like the go home button uh [41:05] or or or or or the or the like the [41:07] button in Android to like access your [41:09] other running applications and like you [41:11] could spam that really fast and like [41:13] >> it would escape back to the like just [41:15] the the app selection menu, but it [41:17] didn't let you escape any farther than [41:18] that. But [41:20] >> yeah. Oh, that's so fascinating. I also [41:22] had a post on X a while ago asking like [41:24] what these things are built in. We had a [41:26] couple people from the industry chime in [41:28] as to like what they're built in and and [41:30] it was it was a really interesting read [41:32] just to get a peer into these h how all [41:35] of the stuff works, especially on a [41:37] plane, you know, it's it's a fairly [41:38] closed loop system because the shows are [41:41] on a drive on the plane. [41:43] >> Oh, yeah. No, no, no. That stuff is uh [41:45] is super fascinating. Yeah. with with [41:47] hardware, I'm always I'm always looking [41:49] around me in the world for targets. So, [41:52] I'm I'm like that weird person that's [41:54] like in a coffee shop and I'm like, "Oh, [41:56] they have that brand of security camera [41:58] running, you know, and uh but uh I think [42:01] you mentioned my grill video cuz that's [42:03] that, you know, I I I had that smart [42:05] grill for probably like a couple years [42:07] and I was like and I've always been [42:09] like, "Oh man, I should really rip this [42:10] apart, but I don't want to break my [42:12] grill." Uh, so so that that that was a [42:15] fun adventure and that always leads me [42:17] to like eBay, right? Like like eBay is [42:19] just a is just a great place for me to [42:21] go find a bunch of weird used uh in [42:25] industrial technology or or consumer [42:27] technology uh to to always hack on. [42:30] >> That's So tell us what you did with the [42:31] grill though. I think that was pretty [42:33] interesting. [42:34] >> Yeah. So So that was Yeah, it was just a [42:36] fascinating experience because first I [42:39] again the motivation is like I use my [42:41] grill. I don't want I don't want to like [42:43] accidentally brick my grill because I'm [42:45] like trying to do firmware extraction on [42:46] it. [42:47] >> And so [42:49] >> I I So So I went on eBay and I found a [42:53] replacement computer module that was [42:57] supposed to work as a drop-in [42:59] replacement for for my grill. And so I I [43:04] you know I went and I started to do the [43:06] analysis on that and I was like this [43:09] this is weird. this like doesn't [43:11] properly connect out to the internet. [43:14] And so then I was like, "All right, I [43:16] just need to go do it on my own grill." [43:18] And so I and so I ripped them off and I [43:20] was comparing apples to apples. And it [43:23] was like a different hardware uh [43:25] revision, which was really fascinating. [43:27] So, I don't know if that was like the [43:30] thing I bought on eBay was someone [43:34] uh bought that, you know, like that [43:36] device was uh some kind of a development [43:38] unit or some kind of a unit that didn't [43:40] pass QA and they're like, "Oh, I'm going [43:42] to make some money by by reselling this [43:44] on eBay." Uh [43:47] >> curious about that as well is like how [43:50] hard is it for people just to create [43:52] like aftermarket boards for these [43:54] things? Is that something that happens? [43:57] Yeah. Well, and and then like part of [43:59] the the security world that is not [44:02] usually the the like security flaws that [44:04] I'm looking for because the these I are [44:06] I'm not as concerned about, but there is [44:09] a lot of uh anti- cloning work in the [44:13] security community. And so, uh so they [44:17] are are trying to prevent firmware [44:20] extraction, right? that they're trying [44:22] to or or or they're trying to put some [44:24] piece of the puzzle in a place maybe [44:28] maybe it's in some kind of internal um [44:32] you know storage inside of the CPU or [44:35] it's a microcontroller where they can [44:38] actually lock the debug connection and [44:40] the firmware is like locked inside the [44:42] microcontroller [44:43] >> and they'll do that to prevent cloners [44:47] from from just you know reading out the [44:50] firmware and then and than producing a a [44:53] compatible unit. [44:55] >> Yeah, it's it's a hard thing because [44:57] like part of me like I have a Sidu [44:59] that's 20 years old and you you go on [45:01] AliExpress and buy an entire like [45:04] computer, it's called the SPI for your [45:06] SIDO and for like 80 bucks you can if if [45:09] you for some reason have blown your [45:11] 20-year-old computer unit on your SIDO, [45:13] you can just get a brand new one and and [45:16] slap that thing in. Um, which is great [45:18] for like right to repair, but also awful [45:21] for like someone could steal your sidu [45:23] and just slap in a new, you know, slap [45:26] in a new computer unit and that thing is [45:28] is untraceable. Now, it's a it's a [45:31] tricky area. [45:32] >> It It really is. And I Yeah, I've gotten [45:35] asked those questions before and like [45:37] like I'm not an expert. I'm I'm really [45:38] interested in the whole retro repair [45:40] movement. I I actually start I would not [45:43] have started my YouTube channel if it [45:45] hadn't been for Louis Rossman actually [45:48] for for kind of a funny reason. So I [45:51] hate video editing. I'm not good at it. [45:53] And so I watch I would like watch his [45:56] videos and I'm like this guy gets a ton [45:59] of people watching board repair videos [46:01] unedited sometimes like an hourong [46:04] video. And I was like okay. So like long [46:07] form content clearly not dead. and you [46:10] know, attention spans in the [46:13] hardware/tech techchnical domain. [46:15] There's an interest for that. So, that's [46:17] kind of what led me to start my YouTube [46:20] channel and make it just a format where [46:21] it's it's more or less unedited and long [46:24] form. [46:25] >> So, I'm I'm I yeah, I I have a lot of [46:28] lot to thank Lewis for and uh definitely [46:31] interested in the movement. Yeah. [46:33] Although he did start that paperclip [46:35] movement which like the worst people [46:37] that comment on our YouTube channel are [46:39] all of a paper clip. [46:40] >> Yeah. Oh my god. [46:41] >> Avatar. [46:43] >> Okay. It's so funny cuz I haven't [46:45] watched Lewis in like in a while, right? [46:48] Just because I I'm busy with other [46:49] stuff. And so I would see all these like [46:52] paper clips in my in my YouTube comments [46:54] and I'm like what is going on? Are these [46:56] like is this like a bot farm? [46:58] >> Yeah. We thought it was the same guy. [47:00] >> Yeah. [47:02] Yeah. Yeah. And I was so I was so [47:05] confused and then I was like, "Oh." And [47:06] then like I I I finally like tracked it [47:08] back. I'm like, "Oh, this is like a [47:10] Louis Rossman thing." [47:14] >> Yeah. [47:14] >> Oh, all the paper clips, please leave a [47:16] comment right now. We need to see you. [47:18] >> Yeah. [47:21] >> Anything we haven't hit on that you [47:23] you'd love to cover. [47:25] Um, no, no, this is this is really cool. [47:29] I'm just uh yeah, glad to get to chat [47:31] and uh share something uh interesting to [47:34] the audience. [47:34] >> I've got I got one more question for [47:36] you. And this is this entire podcast is [47:38] very self-serving. Um I only want you on [47:40] so I can ask you questions directly [47:42] without having to pay for your time. No, [47:44] I'm just joking. But um so for [47:46] Christmas, we're getting our kids laser [47:48] tag. Um, and as far as I understand that [47:51] that's RF. Um, like it sends an RF [47:53] signal. And I was thinking like [47:56] >> I want to build a nuke. Um, that like I [47:59] want to build some device where I hit a [48:01] button and it does RF in every direction [48:04] and just like boom, gets all the kids [48:07] and they're all dead. You know, how fun [48:09] would that be? Like what what would even [48:12] be my first step to building something [48:13] like that? [48:15] >> Yeah. So, so this is something that I [48:18] this is a domain that I've recently [48:20] started to produce some videos on. Uh, [48:22] so that that is going to be kind of some [48:25] yeah some radio protocol reverse [48:27] engineering and so an a software defined [48:30] radio and SDR is probably going to be [48:33] step one. Also, the thing is if it's RF [48:38] uh you can do a lot of open- source [48:40] intelligence gathering through the FCC. [48:43] So, uh, the FCC website and there's like [48:46] a third party site, I think it's like [48:47] FCCID.io [48:50] that just like scrapes the FCC website. [48:52] >> I love it. You can see internal photos [48:54] of everything. [48:55] >> Exactly. Well, and the other thing [48:57] they'll document on there is the [48:59] frequency, the radio frequencies that [49:02] are being used. And that saves you a lot [49:04] of like scanning around with your SDR. [49:06] If you know what what it's transmitting [49:08] on, then you can listen. And uh, you're [49:12] going to need an S. Now, to actually do [49:14] the the replay attack part of it, you're [49:17] going to need a a radio that can [49:19] transmit. So, the simple uh RTLSDR that [49:21] everyone starts with, which is great. Uh [49:23] those can only receive, they can't [49:25] transmit signals. And so, uh you're [49:28] going to need something like a hack RF [49:30] maybe. And so, the hack RF even has [49:32] really simple programs that will record [49:34] a signal and try to replay it. [49:36] So, uh, assuming that, you know, there's [49:41] not some super advanced security going [49:43] on with the the laser tag system, if you [49:45] can just capture a signal, right? Like [49:47] record and then and then shoot and then [49:49] shoot like like shoot the gun at at the [49:52] antenna and then record that signal and [49:54] then try to replay it and see if it has [49:57] uh the effect that you're looking for. [49:58] Yeah, [49:59] >> man. I I think I have something like [50:01] that. It's either RF or IR. I bought it [50:03] to I think Scott might have done this as [50:05] well. We have like these like little AC [50:07] units that don't have like a Wi-Fi chip [50:10] in them, but you can just like point the [50:12] remote at it and and train it, right? I [50:14] should look into that. I actually got [50:16] one for my laser tag. [50:19] >> Oh, that'd be awesome. [50:20] >> Yeah. [50:23] >> Wes hacking to cheat at laser tag with [50:25] his kids is [50:26] >> definitely and like there's no chance [50:29] it's it's like like encrypted, is it? [50:32] >> I I highly doubt it. Highly doubt it. [50:35] Now, now, now what might happen is like [50:37] each gun might have its own like like a [50:40] part of the signal that's different if [50:41] if it has any kind of like scoring [50:43] system, right? Because then you need to [50:45] know who shot who. [50:47] >> And so, okay, there might be something [50:49] that is encoded. I doubt it's encrypted, [50:52] but there might be some part of the [50:54] communications that is identifying [50:57] that's like unique to each gun, but [50:59] maybe you don't care about that if [51:00] you're wanting to nuke. Well, well, then [51:03] you should do it with your gun because [51:05] you probably can't in the system. You [51:06] probably can't shoot yourself [51:08] >> and so you would be immune if you [51:10] captured your own gun's signal. You got [51:12] to filter it, sent out the nuke. Yeah. [51:14] Yeah. Oh man. I I I think the first [51:17] thing that ever got me interested in [51:18] this is years ago somebody figured out [51:20] that you can take this like kids diary [51:23] from the '9s. It was called the like I [51:25] am me or something like that. It was [51:27] like this little thing and it had an RF [51:30] >> transceiver so you could go between [51:32] them. Um, but somebody figured out that [51:34] you can just make it go on loop and send [51:37] every garage door code out. Um, and this [51:40] was before garage doors had like rolling [51:43] codes. So, this was like like like [51:44] 30-year-old garage doors would just [51:46] open, [51:47] >> which is at our cottage we have one. It [51:49] just randomly opens. And we've we [51:51] haven't pinned it down as to what it is, [51:53] but it's somebody's key fob for their [51:55] like Dodge Caravan or something just [51:56] causes our garage door to open. [52:00] >> Yeah, that's uh Sammy Camcar uh his work [52:03] and he's got a Defcon talk that uh I [52:05] Yeah, highly recommend his stuff. Yeah, [52:07] >> I want to go. [52:08] >> He's done some crazy stuff now. So, he's [52:11] getting into uh laser [52:15] uh using lasers to transmit sound. And [52:19] he had a project where he could make an [52:22] Amazon Alexa unit receive audio with a [52:27] laser through a window. [52:31] So he could so he could transmit audio [52:34] through a window like like if it was in [52:36] somebody's house like to the Amazon [52:38] Alexa and it would the the the [52:40] vibrations like the the signal that [52:43] >> unmodified Alexa they would just the [52:45] vibrations would play. Oh that's [52:47] terrifying. [52:49] >> Holy hell. [52:51] >> Yeah. He's getting really deep into [52:54] laser uh technology. Uh now he's got [52:56] some like homebrew like like laser [52:59] technology. Uh that's like yeah you got [53:01] to you got to wear proper eye protection [53:03] with [53:04] >> So So my last question is IoT stuff. Do [53:08] you have it any that the classic thing [53:10] is like I keep my IoT next to next to my [53:13] bed with a gun. Um do you run any smart [53:16] home stuff after all you've seen here? [53:19] >> I do. I Yeah. I'm I'm maybe not as [53:22] doomsday as like most people about it. [53:26] Uh I like I've got I don't know like I'm [53:29] I'm just kind of a network nerd anyway. [53:31] So I do have like networks some not not [53:34] overly like paranoid but I do have some [53:36] network segmentation that I keep okay [53:38] you know some devices on a different [53:40] network and so um [53:43] >> yeah and it's just a matter about you [53:45] know choosing what your your risk [53:47] profile is. I I have some devices. I [53:49] don't have a lot of devices, so it's [53:51] it's it's it's kind of a compromise in [53:53] the middle. And obviously, I'm always [53:55] playing around with things in my in my [53:57] kind of like test lab here. So, I've [53:59] I've always got some some weird traffic [54:01] going out [54:03] >> of my network. [54:05] >> Uh Matt, that was uh really enlightening [54:08] for me personally, considering I I don't [54:10] get my hands dirty with most of this [54:11] stuff. So, I I really really enjoyed [54:13] hearing all of this. So, uh, now is the [54:16] part of the show where we get into sick [54:19] picks, which is something that you're [54:20] just enjoying in life right now. It [54:22] could be anything from a podcast, a [54:24] YouTube channel, product, whatever. Is [54:26] there anything that you're just really [54:28] feeling right now? [54:30] >> Yeah. Sorry, I totally forgot to tell [54:32] you about this. Usually, we have like a [54:33] whole document we send ahead, but I did [54:35] I did it a different way this time. [54:38] >> No, no, no. This is this is really good. [54:40] So kind of my my side interest is uh has [54:44] been business lately. So so so I've [54:46] been, you know, uh running uh my my my [54:50] my side business uh and I've been just [54:53] getting more interested in in how to run [54:54] a business effectively. So uh reading [54:57] books like um Key Person of Influence, [55:01] uh by Daniel Priestley, just yeah, just [55:03] some general business books to kind of [55:05] up my game in that area. Funny enough, [55:07] my my undergrad is kind of in business, [55:10] but it was it was because like [55:12] management information systems like our [55:14] my IT degree was uh in the college of [55:17] business at my college. So, [55:18] >> oh that's that's exactly what I went to [55:20] school for. I went to school for [55:21] business technology management which is [55:23] exactly like not enough coding but more [55:26] on the business side of things. But uh [55:30] >> it was really because I didn't want to [55:31] take calc 3 and like alt in physics why [55:35] why why I chickenened out of CS but uh [55:38] that's another story. [55:40] >> Oh that's great. I got I have never read [55:41] that one. Key person of influence. I can [55:43] check that out. [55:44] >> Yeah. Uh, and it and and it really like [55:47] I I really like that book because it [55:49] talks about how you can use, you know, [55:53] your like like I I'll never call myself [55:56] like an influencer or whatever, but but [55:57] it it talks about how you can use your [56:00] your public presence, your content to [56:03] build a business that kind of syncs with [56:05] the rest of your life. And so the cool [56:07] thing for me is I feel like it kind of [56:10] follows the journey that I've gone on o [56:12] over the past two years because I made [56:15] my YouTube channel. When I started my [56:17] YouTube channel, I was like, if over the [56:19] lifetime of the channel I get 10,000 [56:22] subs, I can like be like mission [56:24] accomplished. And obviously it like [56:26] rocketed past that. And so, uh, that [56:30] caused me to just get reached out to by [56:33] businesses to be like, "Hey, can can you [56:35] do some consulting for us?" And so, the [56:37] business just kind of grew out of the [56:40] content. And so, uh, we're going to [56:42] we're just going to see where that goes. [56:44] >> That's awesome. How How long have you [56:46] been doing your YouTube? [56:47] >> Uh, about two years now. So, [56:49] >> holy, you're almost at 200k subscribers. [56:51] That's amazing. [56:52] >> Yeah. Yeah. It's been a wild ride. [56:55] >> Yeah. Wow. Well, congrats. Thank you so [56:57] much for your time today. And [56:58] >> oh, whoa, whoa, whoa, [56:59] >> whoa. Oh, sorry. Never mind. Go ahead, [57:02] Scott. [57:03] >> Also, the last thing is shamelessly [57:06] plugging. So, is there anything you [57:08] would love to plug to our audience to [57:10] make them aware? So, we'll we'll link up [57:12] your YouTube channel. It's a fantastic [57:13] subscribe. Um, anything else you want to [57:16] plug? [57:17] >> Yeah, just uh if anyone is in the need [57:20] for hardware pen testing, that's like [57:22] the the one thing that I do uh at my [57:24] business. And so brownfind.com [57:27] uh is where you can find info on that. [57:29] >> Nice. Sick. [57:31] >> Right on. And the his YouTube is just [57:33] Matt Brown. It's M A T B R WN. If you're [57:37] going to YouTube as well, you can click [57:40] the link in the show notes, but if [57:41] you're just typing it in, you'll find it [57:42] in there. [57:43] >> Cool. Well, thanks again for all your [57:45] time. This is super interesting. I [57:47] appreciate all your all your time. [57:48] >> Thank you. It's been a great great time. [57:51] Thanks, Matt.  ## 📺 Video ![](https://www.youtube.com/watch?v=SpPd0Q6dmYI) --- # 📝 Full Notes (Deep-Read Analysis) # 🏷️ Title: Hardware Hacking with Matt Brown ## 🧰 Action Inbox - [H1] Explore UART console connections on IoT devices — look for TX/RX/GND pins #hardware-hacking - [H2] Try firmware extraction with binwalk on extracted flash chips — desolder and read with programmer #firmware-analysis - [H3] Set up transparent proxy with Burp Suite for IoT traffic interception — modify device trust store #api-discovery ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Matt Brown's YouTube Channel](https://youtube.com/@mattbrwn) - [Syntax Podcast](https://syntax.fm) ## 📝 Summary - Matt Brown demonstrates hardware hacking techniques for IoT security research, from UART console access to firmware extraction - Why it matters: IoT devices often contain serious security vulnerabilities that affect millions of users - Key stakeholders: Security researchers, IoT manufacturers, consumers with smart devices - Risks and tradeoffs: Legal boundaries exist but good faith security research has protections - Bottom line takeaway: Hardware hacking reveals software vulnerabilities through physical access to devices ## 📖 Main Content Matt Brown explains his methodology for hardware security research, starting with curiosity-driven exploration of thrift store electronics. His approach combines physical hardware manipulation with software analysis to uncover security flaws in IoT devices. The process typically involves opening devices, finding UART debug connections, extracting firmware from flash chips, and analyzing the software for vulnerabilities. He emphasizes that hardware hacking often serves as a means to understand and exploit software, particularly APIs and network communications that wouldn't be visible through traditional web development tools. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/SpPd0Q6dmYI?t=0) — [H1] Introduction to Matt Brown's work - Key idea: Security consultant who hacks IoT hardware to find software vulnerabilities - Evidence: "Found dozens of unsecured police license plate cameras with video feeds and GPS coordinates" #### ⏱️ [05:23](https://youtu.be/SpPd0Q6dmYI?t=323) — [H2] Getting started in hardware hacking - Key idea: Curiosity-driven exploration starting with thrift store electronics disassembly - Evidence: "Would go buy used electronics and take them apart, see if I could put them back together" #### ⏱️ [08:15](https://youtu.be/SpPd0Q6dmYI?t=495) — [H3] Hardware as means to software hacking - Key idea: Physical hardware access enables discovery of APIs and software vulnerabilities - Evidence: "Hardware hacking is like a means to an end to hack on software or APIs" #### ⏱️ [12:30](https://youtu.be/SpPd0Q6dmYI?t=750) — [H1] UART console access methodology - Key idea: First step is finding four-pin debug headers (TX/RX/GND/VCC) on PCBs - Evidence: "Look for that connector, might not even be populated to save on bill of materials cost" #### ⏱️ [18:45](https://youtu.be/SpPd0Q6dmYI?t=1125) — [H2] Intercepting encrypted IoT traffic - Key idea: Install custom CA certificate in device trust store to decrypt TLS communications - Evidence: "Put our cert into the trust store, then use transparent proxy like Burp Suite" #### ⏱️ [22:10](https://youtu.be/SpPd0Q6dmYI?t=1330) — [H3] Linux vs microcontroller devices - Key idea: IoT devices split between full Linux systems and microcontrollers like ESP32 - Evidence: "Battery powered devices often microcontrollers, IP cameras usually Linux" #### ⏱️ [25:40](https://youtu.be/SpPd0Q6dmYI?t=1540) — [H1] Firmware extraction process - Key idea: Desolder flash chips and read with programmer to extract binary blobs - Evidence: "Hot air gun to desolder chip, use universal programmer with different adapters" #### ⏱️ [30:15](https://youtu.be/SpPd0Q6dmYI?t=1815) — [H2] Using binwalk for filesystem analysis - Key idea: Extract known filesystems from firmware dumps using automated tools - Evidence: "Binwalk with -e flag extracts well-known filesystems like SquashFS" #### ⏱️ [35:20](https://youtu.be/SpPd0Q6dmYI?t=2120) — [H3] Password cracking from shadow files - Key idea: Extract password hashes and use GPU-based cracking to gain root access - Evidence: "Grab shadow file, throw hashes into hashcat, use GPU to crack passwords" #### ⏱️ [40:30](https://youtu.be/SpPd0Q6dmYI?t=2430) — [H1] Legal boundaries and ethics - Key idea: Own the device, test on your own accounts, follow good faith security research - Evidence: "If I own the device and do good faith security research, US laws have carveouts" #### ⏱️ [45:50](https://youtu.be/SpPd0Q6dmYI?t=2750) — [H2] Embedded web servers in IoT devices - Key idea: Many devices run custom web servers for local network communication - Evidence: "Camera streams directly phone to device when on same network to reduce latency" #### ⏱️ [52:15](https://youtu.be/SpPd0Q6dmYI?t=3135) — [H3] Logic analyzers for digital signal analysis - Key idea: Use logic analyzers to decode communications between chips and PCBs - Evidence: "Logic analyzer sits between multimeter and oscilloscope for digital signal sampling" #### ⏱️ [58:40](https://youtu.be/SpPd0Q6dmYI?t=3520) — [H1] Software defined radio for RF analysis - Key idea: SDR tools can capture and replay radio frequency communications - Evidence: "HackRF can record signal and replay it, check FCC database for frequencies" ## 📚 References - [Saleae Logic Analyzers](https://www.saleae.com/) - [Binwalk Tool](https://github.com/ReFirmLabs/binwalk) - [Burp Suite](https://portswigger.net/burp) - [HackRF SDR](https://greatscottgadgets.com/hackrf/) ## 🗣️ Paraphrase - Hardware hacking primarily serves as a pathway to discover software vulnerabilities in IoT devices through physical access - The methodology involves UART console access, firmware extraction from flash chips, and filesystem analysis using tools like binwalk - Legal protections exist for good faith security research, but researchers must own devices and test only their own accounts ## 📰 Newsletter Matt Brown's hardware hacking techniques reveal critical insights for anyone working with IoT devices or embedded systems. His systematic approach - from UART console discovery to firmware extraction - demonstrates how physical access can expose software vulnerabilities invisible through traditional web development tools. Key takeaway: Most IoT security flaws stem from poor software practices rather than hardware weaknesses. Developers can apply these insights by understanding how their code might be analyzed through firmware extraction. Resources: [UART Documentation](https://learn.sparkfun.com/tutorials/serial-communication), [Firmware Analysis Tools](https://github.com/ReFirmLabs/binwalk), [IoT Security Guidelines](https://www.iotsecurityfoundation.org/) ## ✅ Action Items #### DevRel - Developer advocacy: Create hardware security workshop for IoT developers, focus on secure coding practices - Education: Develop firmware analysis curriculum for security-minded developers - Developer experience: Document secure boot and trust store implementation patterns - Developer marketing: Campaign highlighting security-first IoT development - Community management: Moderate hardware hacking discussions, ensure legal compliance #### OSPO - Policy & Governance: Establish hardware security research guidelines and ethics policies - License Compliance: Review firmware extraction implications for open source license compliance - Security Management: Implement IoT vulnerability disclosure processes and coordination - Software Inventory: Track embedded system components and firmware versions across products - Developer Support: Training on secure embedded development practices and threat modeling #### Community - Maintainers: Support secure development practices in IoT-related open source projects - Contributors: Onboard security researchers interested in responsible disclosure - Sponsors: Fund hardware security research and vulnerability remediation efforts #### WordPress - Core: Evaluate IoT integration security for WordPress-powered devices and kiosks - Security: Assess implications of WordPress running on embedded systems and edge devices - Documentation: Create guides for secure WordPress deployment on IoT infrastructure ## 🧪 Hypotheses - Most IoT security vulnerabilities originate from software implementation flaws rather than hardware design issues - UART console access provides root shell access on 70% of consumer IoT devices due to debug interfaces left enabled - Firmware extraction success correlates inversely with device cost and manufacturer security maturity - Legal protections for security research vary significantly by jurisdiction and device ownership status ### 📊 Methodology - Systematic survey of IoT devices across price points and manufacturers to test UART accessibility hypothesis - Statistical analysis of firmware extraction success rates versus security implementation metrics - Legal framework comparison across jurisdictions for security research protections ### ❓ Questions - How can IoT manufacturers balance debug accessibility for development with production security requirements? - What percentage of consumer IoT devices implement proper secure boot and firmware integrity verification? - How do emerging regulations like IoT security labeling programs affect manufacturer security practices? ### 🔮 Future Research - Automated firmware analysis pipelines for large-scale IoT security assessment - Machine learning approaches to identify vulnerability patterns in embedded software - Standardized IoT security testing frameworks for both researchers and manufacturers ### 💡 Implications - Practice: Developers must consider physical access scenarios in IoT threat modeling - Policy: Need for stronger IoT security standards and manufacturer accountability frameworks - Security: Hardware access fundamentally changes attack surface analysis for connected devices - Education: Security curriculum must include embedded systems and hardware attack vectors - Funding: Investment needed in IoT security research tools and responsible disclosure programs ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade #### 👀 Visual learners - Present: PCB diagrams, oscilloscope traces, firmware extraction workflows - Improve: Interactive hardware teardown visualizations, pin identification guides #### 🔊 Aural learners - Present: Detailed verbal explanations of technical processes and methodology - Improve: Audio-described hardware hacking demonstrations, podcast-style technical discussions #### 🗣️ Verbal learners - Present: Clear analogies (UDP socket for UART), technical terminology definitions - Improve: Glossary of hardware hacking terms, comparison tables for tools and techniques #### 🧩 Kinesthetic learners - Present: Hands-on hardware teardown examples, step-by-step UART connection guide - Improve: Virtual lab simulations, interactive firmware analysis exercises #### 🧠 Logical learners - Present: Systematic methodology, decision trees for tool selection - Improve: Flowcharts for attack methodology, troubleshooting decision matrices #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion of legal and ethical considerations - Improve: Collaborative hardware hacking projects, peer review of security findings #### 🧘‍♀️ Solitary learners - Present: Detailed technical documentation, independent research methodology - Improve: Self-paced learning modules, reflective exercises on security implications #### 🌿 Naturalistic learners - Present: Ecosystem thinking about IoT device interconnections - Improve: Environmental impact discussions of device security lifecycles ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive technical explanations - Improve: Alt text for hardware diagrams, audio descriptions of visual demonstrations #### Keyboard navigation - Present: Standard web navigation patterns - Improve: Skip links for technical sections, keyboard shortcuts for video controls #### Contrast and readability - Present: High contrast text, clear technical terminology - Improve: Larger text options for detailed technical diagrams #### Text resizing and reflow - Present: Responsive design for technical content - Improve: Scalable technical diagrams, flexible layout for code examples #### Media and captions - Present: Detailed transcript with technical terminology - Improve: Visual descriptions of hardware manipulation, synchronized highlighting #### Forms and interactions - Present: Clear labels for technical parameters - Improve: Accessible tool selection interfaces, error handling for technical inputs ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global perspective on IoT device availability and legal frameworks - Improve: Examples from diverse manufacturing regions, international law considerations #### Inclusive language - Present: Technical but accessible terminology, avoided military metaphors - Improve: Plain language summaries of complex technical concepts #### Neurodiversity support - Present: Structured technical explanations, clear methodology steps - Improve: Multiple explanation formats, visual aids for abstract concepts #### Representation - Present: Diverse examples of device types and use cases - Improve: Inclusive examples of security researchers and use cases #### Psychological safety - Present: Emphasis on legal and ethical considerations - Improve: Clear guidelines for responsible disclosure, community safety standards ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Clear logical progression from physical access to software exploitation - Inductive strength: Generalizations based on extensive device testing experience - Causal reasoning: Establishes clear cause-effect between hardware access and vulnerability discovery - Analogical strength: Effective comparisons between IoT and web security methodologies #### Fallacies - No significant fallacies identified: Reasoning remains grounded in practical experience - Ethical considerations: Appropriately addresses legal and ethical boundaries #### Tone of voice - Overall tone: Educational and technical, emphasizing responsible security research practices ### 🛡️ DARVO Analysis - Deny: No denial patterns present - transparent about capabilities and limitations - Attack: No attacks on critics - acknowledges legal and ethical boundaries appropriately - Reverse victim/offender: Not applicable - focuses on defensive security research - Emotional cues and rhetoric: Professional and educational tone throughout ## 🎯 Conclusion Matt Brown's hardware hacking methodology provides crucial insights for IoT security, demonstrating how physical device access enables comprehensive software vulnerability analysis. His systematic approach from UART console discovery through firmware extraction reveals that most IoT security issues stem from poor software practices rather than hardware flaws. For practitioners, this highlights the importance of considering physical access scenarios in security design and implementing proper secure boot processes, debug interface management, and firmware integrity verification in IoT deployments. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad Purpose: Stage CEE units that become Literature notes. Split level: H3 ### [H1] Hardware access enables software vulnerability discovery > [!quote] Hardware Hacking with Matt Brown by [[Matt Brown]] via [[Syntax]]. Published 2024. Accessed 2024-12-28. > "Hardware hacking is like a means to an end to hack on software or APIs" Physical device access reveals software vulnerabilities invisible through network analysis alone. [view highlight](https://youtu.be/SpPd0Q6dmYI?t=495#H1) #hardware-security #vulnerability-research ID:rw_hw001 ### [H2] UART console provides direct system access > [!quote] Hardware Hacking with Matt Brown > "Look for TX and RX line, it's kind of --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=SpPd0Q6dmYI)* **[00:00]** Welcome to Syntax. Today we have Matt Brown on. He is a YouTuber and security consultant who specializes in pen testing IoT hardware. He has a YouTube channel that's filled with fascinating videos. So, for example, he found dozens of unsecured police license plate cameras. And they had a video feed, had a stream of all of the data, which include the license plates, the car make and model, and the GPS coordinates. He's hacked a smart grill and extracted the firmware from that, and he's dove into the network activity of dozens of cheap Chinese cameras. And recently he let **[00:31]** cloud code rip on one of them, which was really interesting. So, we've had him on today to talk about how all of this hardware hacking stuff works, the legality of it, and hopefully a few interesting stories. Welcome, Matt. Thanks for coming on. Thank you for having me. Yeah. So, I've been watching your YouTube channel for, I don't know, probably for about a year now. I I'm not sure how I stumbled upon it, but you have these really good breakdowns of how you can take a piece of hardware, and then just dig into how it works, or find some pieces of interesting pieces **[01:02]** that you may not necessarily know. Or buying something that's from like a different industry, like the police license plate readers, and then you could just buy one yourself, and then just dig into it, and you find all the API endpoints, and then you realize, "Oh, this is maybe not as secure as as we thought it would be." So, how do you even get into all of this stuff? That's a that's a great question. I I guess the chief kind of hacker **[01:32]** mentality of curiosity and letting that lead you in in the discovery of information and knowledge has always been a thing that I've done since my youth. So, you know, back in back in my high school and college days, you know, messing around with computers at my school, things like that. I've always been interested in going to thrift stores. Back when I was in high school, I would go to Goodwill, which is a US-based thrift store. I don't know if they have them outside the United States, but >> Yeah, we have them in Canada. Oh, sweet. **[02:04]** So, I would just go buy used electronics and take them apart and see if I could like take them apart, put them back together, see how they worked. And that led me deeper and deeper down the hardware hacking rabbit hole, where now I on my on my channel I like to just buy used devices, take them apart, and usually I'm after two things. I'm usually, like you said, interested in kind of revealing knowledge that might have security applications in the **[02:35]** software. Funny The funny thing is, there are people that are like deep hardware silicon silicon hardware security researchers, and that's actually not really my thing. Usually hardware hacking is like a means to an end to hack on software or hack on APIs to to reveal, you know, APIs that I wouldn't have known existed, maybe, unless I dug into a piece of hardware. Okay. That's That's really interesting to me, because like in in the web development world, we love spelunking **[03:06]** into the dev tools, you know? You open up the network tab, and you see what's going on, or we have an an app on the desktop called Proxyman, and that will allow you to monitor traffic that's coming in and out of it. Some of us dip into like maybe even like Wireshark, where you get a little bit past like just HTTP traffic and into some of the lower level stuff. But once once it ends on like something running on your machine, or maybe something running on like your phone, and you proxy your phone's traffic through your computer, **[03:37]** that's kind of where it ends for me of like dipping into it. And there's always like these like like you get a camera, or you get like this thing that you connect to your Wi-Fi, and I'm always curious like, "Man, like what are the API calls happening there?" And it's it's kind of tricky. So, like let's say you pick up a piece of hardware. What are your like first steps for sort of breaking that down, trying to find out what the APIs are? Yeah, so if I'm looking at kind of your standard IoT device that is going to **[04:09]** make calls out to some backend server on the internet, most of the time that's going to be wrapped in TLS, right? So, just opening it up in Wireshark, I'm going to get a host name and nothing more. I'm not going to get any endpoint information. I'm not going to like cuz what we want, right, is we want it to be like the network tab. On on in dev tools, we want to actually see the requests and the responses, cuz then as security, you know, from a security or maybe just a tinkering perspective, **[04:40]** maybe you want to write your own application that interacts with the backend, right? Some kind of a third-party thing. There There's all sorts of applications of this this hardware hacking work. And so, there's a couple of avenues. One is if we can get a root shell on that device. If we can if we can if we can gain control over the device, then we could potentially put a our own CA certificate in the trust store of that device, kind of like if **[05:12]** you've ever used Burp Suite or any of these proxying tools to look at web traffic from your web browser, you have to go in either to your computer's trust store or the browser's. Like Firefox has its own independent trust store. Chrome uses the OS's. And you have to add the proxy certificate to allow it to terminate that SSL that TLS communications. So, that's why when like you get like a laptop from your employer, and they install their own **[05:43]** certificate, they're able to even though the website you're going to may maybe HTTPS, they're still able to see every request that's that's coming through there, because they literally are putting a secure certificate in the the chain, right? That's exactly right. Yeah. So, we can effectively do the same thing in the hardware world. If we if we if we obtain a root shell, or we're able to, you know, modify that firmware somehow, modify the running device, and put our cert into the trust store. And I say trust store, **[06:15]** we have to do some reverse engineering. Sometimes it's it's like a common Debian system, where it's going to be in, you know, Etsy SSL, you know, cert certificates, or something like that that's really common. Sometimes it'll be super hardcoded into a binary that you kind of have to do some reversing and modifying of the system to figure out how to put yourself in that chain of trust. But once we put ourself in that chain of trust, then we can use a a transparent or an intercepting **[06:45]** proxy, which Burp Suite and Caido, they do have a mode where you can enable that, and allow it to to proxy your traffic. Now, then you have to you have to do some network shenanigans with maybe with IP tables, or something with your router to convince your device to route its traffic through this system that has a transparent proxy. But at that point, we we are able to see all the contents of those that HTTP **[07:15]** communications. And if you want to see all of the errors in your application, you'll want to check out Sentry at sentry.io/syntax. You don't want a production application out there that, well, you have no visibility into in case something is blowing up, and you might not even know it. So, head on over to sentry.io/syntax. Again, we've been using this tool for a long time, and it totally rules. All right. And like what's usually running on these devices? You mentioned like Debian. Like are a lot of these things just running **[07:46]** like Linux on them, or is it it does it depend? Yeah, so in the IoT world, there's kind of two categories of devices. There are more traditional Linux-based devices, and then there are microcontrollers. And so, you'll often see these used in different applications. If you need like a low-power application, if it's a battery-powered device. Now, these these lines can blur, of course. But generally speaking, if you have low-power battery-powered device, those are often **[08:16]** times going to be microcontrollers, which are a whole a whole 'nother game in terms of how to do that firmware modification. >> ESP32, or like a one of those like Raspberry Pi Picos, or something like that? Exactly. Yeah, and that's and yeah, the Raspberry Pi world is a great distinction. So, Raspberry Pi Pico, microcontroller. Regular traditional Raspberry Pi is going to be a a microprocessor that runs Linux. >> A mini Linux computer. Operating system. Exactly. So, in the Linux case, that's **[08:49]** that's what you're going to find most of the time. If you're if you're trying to get in routers, IP cameras, most of the time those are going to be Linux. Now, that is changing because people like battery-powered cameras, they like lighter-weight devices that don't need to be plugged in. And so, you are seeing some advancements in microcontrollers in that in that space. For Linux devices, yeah, it's it's often times going to be just a very kind of custom like I call it like an SDK, where a chip provider will provide an entire **[09:21]** build system that will include a kernel and all the root file system necessary to boot Linux. And then on top of that, a device manufacturer will build all their custom business logic in the form of some kind of a daemon that will run and that will communicate out to the cloud. And what language is that stuff written in typically? Mostly it's C. You'll see some C++. In very odd cases, you'll see some **[09:54]** higher-level languages like Python being used. But it's it's mostly a bunch of C code that is ripe for finding, you know, command injection, buffer overflow type vulnerabilities that are that are kind of commonly plagued those languages. Yeah. Okay. So, you get something and like how do you even get root access to that thing in the first place? Say you plug it in via USB, often it will just like go into the mode where it's like mounts as a USB drive or or acts as a camera. How do you get the lower level **[10:25]** which is access to like the firmware that's running on this thing? Yeah, so so typically what I'm going to do is I'm going to open up the device and the first thing I'm going to look for is the UART console header or debug pins on that device. It's typically going to be a four-pin header or connector that might not even be populated, right? They they might for their debug version or their kind of **[10:55]** development version of that device, they might actually have a header populated whereas in production they might try to like take that component out just to save a little bit on their on their bill of materials cost for the device. But you're you're going to look for that connector and that's where kind of in my videos I talk about how there are these USB to UART adapters and those are going to be set to a certain voltage. 3.3 volts is like the most common one you find out there and when **[11:27]** you connect up to, you know, the TX and the RX lines, so it's just an asynchronous physical communication. My my analogy I like to talk about is it's kind of like a physical UDP socket, right? It's you can you can send and receive data across this these physical wires and then on the device that can be connected up to a couple different things. So, on a Linux device that's typically going to be connected to the console. And so, if **[11:57]** you are connected properly and you power on your device, you're going to start to see the bootloader logs roll by and maybe you can enter maybe you can like smash a key and interrupt that boot process. If we let it boot up fully, maybe they're they're you know, dumb enough to just leave a logged in root shell, right? They don't even make you log in or maybe there is a login prompt, right? And this is where we start to rabbit hole into different ways to turn **[12:28]** the situation into that root shell. So, so it's it's there's there's a lot of different tricks you can do, but if you have that console access, you can oftentimes turn it into a root shell. That's that's so fascinating to me cuz like you open up any electronics, you're often going to see a couple little dots that'll say TX, RX and and ground, right? And those are your UART connections and and you connect you can buy on Amazon you buy like a $5 little USB converter where you just attach to those pins. I **[12:59]** know there's some probably some more advanced like things, but at the very basic you're trying to connect those three wires to a USB and then you can directly connect to that from your computer and then when you turn it on the way I know about this is cuz I did a putting JavaScript on my Roomba video and if anyone's like looking to get into having fun, the old crappy Roombas are like $6 at a thrift store and there is full documentation and there's there's a pin header right on the on the top of **[13:30]** the Roomba. You don't even have to open it up and you can connect directly to it and then when it boots up you can see all of the logs and then you can just start sending and receiving commands from it and there's there's libraries out there that will help you both send what the commands are, you know, as well as receive things like the battery temperature and and and the how fast something is driving all that interesting stuff. Oh, that's so cool. Yeah, but so like I'm curious like that's like that was really well documented for me, right? Like Roomba **[14:02]** Roomba wants you to hack them which is kind of a bummer now Roomba's filing for bankruptcy. But like what do you do to figure out what these commands are when someone doesn't want you to to hack with it? Yeah, that's that's a great question and that kind of leads into the second activity. So, if like if the first activity is like finding that UART console and if it doesn't immediately give you what you want, right? It doesn't just like drop you into a Linux shell, maybe maybe it leaves you at a login prompt and you're **[14:32]** like, okay, how how would I guess what the you know, the username password is? Kind of the second activity then is firmware extraction in terms of hardware hacking. Again, always for that purpose of hacking the software. So, this is like where we are able to, you know, with a hot air gun I've got over on the bench here, able to desolder a chip. Sometimes you can read the chips in circuit meaning you can leave it attached to the board and you can attach a, you know, a **[15:02]** universal like a programmer, a firmware reader to a chip. Some chips are just not able to be attached to that way based on the physical layout of the chip. And so, that's why I prefer to desolder things. Also, you can run into some issues where if your in circuit programmer reader can like inject power, it can basically power the board and cause it to do a bunch of undefined things. So, usually I'll >> out? Does that happen sometime? **[15:34]** It can. It can or it can just like mess with mess with your firmware read is what is what's probably more likely to happen. >> see. I see. Okay. Because then you'll like power up the CPU or the MCU and it will try to start talking to the flash chip, too, to read and write from it while your while your programmer is also trying to interact with it. And so, you're you're like both like arguing over who has control over the flash chip. Oh, I see. Yeah. Okay. Okay. So, so once once you once **[16:06]** you remove that flash chip, you're going to plug you're going to you're going to put it into a programmer and then obviously you need to have a bunch of different kind of adapters to fit the different kinds of chips. But once we do that and and once we read that software off, we you're usually left with a binary blob that is the entire contents of that flash chip. And so, usually on a Linux-based device that is going to contain multiple partitions, multiple file systems and so, that's when our **[16:36]** handy tools like binwalk are going to come in handy for searching through that binary blob to extract out well-known file systems. So, you'll you'll see things especially on more heavy Linux systems or like Android-based devices you'll see like EXT4 file systems. There are also a lot of file systems that are made specifically for embedded devices like SquashFS. There's there's a whole number of file systems that you'll never see outside of **[17:08]** kind of the IoT space. But these things are like are like well-known. That that's what was so interesting to me about this is that like just like us web developers we're reaching for like React and Node and all of these like well-known things, people who are making hardware are are also reaching for well-known things. Often they'll take a chip off the shelf that is like 80% of the way there and because those things are well-known then they are also a little bit easier to decrypt with tools like binwalk. Is **[17:39]** that true? That is true. Yeah. So, so binwalk usually if you the the common flag you pass it is dash lower case E which is just, hey, extract is the extraction flag. Like say, hey, go through go through this file and extract out all of the well-known file systems. And so, if that works and you know, there's there's a whole bunch of caveats of, you know, sometimes a manufacturer will try to be cute and like slightly modify a file system specification, but most of the time they don't do that and you're left with the **[18:13]** contents of like maybe the root file system and maybe a another partition. So, most of the time on these IoT devices there'll be multiple partitions and the root file system will be read-only kind kind of as a a reliability mechanism, right? To to keep creep and and errors from making the system unbootable. And so, and then you'll you'll have data stored in another partition and those are all of the things that you need to then go start searching through the file system **[18:44]** for binaries you might want to throw into a reverse engineering tool or say the the Etsy shadow file to grab password hashes out of and then you can try to crack those password hashes to go back to your UART console to attempt to log in. Okay. Man, that this is so fascinating to me. Sorry, Scott, I'm not letting you I haven't let Scott talk at at all. I don't do any of this stuff. So, Wes is the the hardware hacker on this show. So, I'm just kind of like listening and **[19:16]** soaking it in. So, no, I I I appreciate I appreciate your insight, Wes. All right. Oh, good. So, like like what's the next step then? So, like once you've dumped this firmware and you've used binwalk to sort of look through it. Like what are you then looking for? Yeah, so like I said, if if I if my goal is still like if I haven't accomplished that root shell goal yet, then I might look for things like, you know, the shadow file and then I might grab those **[19:47]** password hashes, those Linux password hashes and throw them into hashcat, use my GPU to to try to crack those passwords. And so, if that's successful, then that gets me in. If that's not successful, there's kind of the next step down the rabbit hole of attempting to modify that firmware image. So, if there's if there's a password that I can't crack, but but there's a shadow file, maybe I could replace it with with with with a hash **[20:18]** that I do know the the corresponding password to. And then if I can package all the file systems back up into that binary blob, and then use my programmer to write back to the chip, and then solder the chip back onto the board, >> then it would assuming there's no kind of secure boot controls, there's no integrity controls on the system, which you're seeing more devices that have those, but some of them there there's still lots out there that don't **[20:49]** have those kind of >> All right. Can I Can I tell you a story of one time I accidentally did that? Yeah. >> Um I had bought a This was probably like 12 years ago, and I had bought a camera off of uh I think AliExpress or or DealExtreme back in then, and it was like the Chinese version of a very popular North American brand. Um and I was like, I wonder if I can just load the firmware from the North American one onto the Chinese one. So, I I went on GitHub, and **[21:21]** I found somebody had dumped the firmware from one of the North American cameras. So, I just dumped that on my camera, booted it up, paired it to the North American app, no problem. And all of a sudden, I see video from somebody else's camera. And I was like, oh no. Like, this is I must have like a like it must have like flashed the MAC address or some sort of identifier. Um and it was like in someone's bedroom. So, I I unplugged it, and I have never to this day plugged that camera back in again cuz I was like, I don't know if I just what I just **[21:52]** did was illegal or whatever, but I was just trying to get added to my own thing. Um and it it started streaming in someone else's video, and I was like I was almost kind of scared there, and I just I have never plugged it in again. I think I tossed it a couple years ago cuz it was kind of scary, but that's something that could happen, right? Oh, yeah. So, so that's Yeah, so so going back to the there how there's commonly like a root file system that's that's kind of, you know, unmodifiable, and then there's the data partition. So, **[22:23]** what was probably wrapped up in that in the data partition somewhere is some kind of APIs, tokens, keys that identifiers that corresponded to probably the person who made that repo in the firmware dump, right? >> Yeah. Yeah. And and and then and then in and then you by flashing that onto onto your device, you basically you basically cloned the device, right? And so, that is an attack that, you know, that that that could be considered valid, you **[22:54]** know, in in some cases. Now, obviously, you need like physical access. You need a firmware dump to somebody else's camera. So, it's like in in in in in in in in in in in in in in in in in in in in in in in in >> enter your house, yeah. Okay. Yeah. So, I with all of this stuff, like, where does that legality border exist? Yeah, have you ever had the police knock on your door? No, no, no. No police. I've I've had **[23:25]** some strongly worded emails, but uh I haven't I haven't been sued yet, so that's good. Knock knock on wood here. So, generally speaking, my understanding, I'm not a lawyer, by the way, so this is not not legal advice, uh is if I own the device, right? I like like I'm always very careful when doing security research to like like like if I'm hitting API like cloud APIs, that's where I draw a very strict line to if I want to test can like one device **[23:58]** kind of access the stuff of another device, then I'll buy two devices, and I'll create I'll create two accounts, right? And I'll try to do those cross account attacks on myself. Uh again, not legal advice. It that might still be considered an unauthorized test. And then obviously, the hardware is that's my property when I buy it. Um there there are some United States laws against reverse engineering, but at **[24:28]** least today, they still all have carve-outs for what is called good faith security research. So, uh again, I'm not a lawyer and don't know the the specific definition of that term, but I try to do my research in good faith and and to not not to use it maliciously, not to attack other people. And so, uh at least in the United States, we have kind of those protections. I obviously don't know about about other countries what the situation is there. All right. So, **[24:59]** where where were we with the the process of I think, yeah, like what what to do with the firmware extraction. So, another thing that might that might be interesting, especially to like kind of like in in getting into the web topic, is So, the first kind of theoretical IoT device we talked about was where the device reaches out to a cloud server via its APIs. But also, a lot of times, these devices will have their own embedded web servers on them. They'll have or or other network services that can be connected into, right? So, maybe **[25:31]** maybe there's a mobile application, and let's let's talk about a video camera, right? So, in the video camera use case, you could think of, okay, I want to be able to access my camera remotely. And so, when I'm away from my home on the mobile app, that that data has to go up to the cloud server. But if I'm in my house, now there's a lot of latency. There's a lot of video latency in that first case. So, maybe when I'm in my house, I'm on the same network, I want it to stream directly from from phone to **[26:01]** camera. And so, a lot a lot of video cameras will do this. They'll have a way that that it can sense that, and the mobile application can directly connect to a service that's running on the device. And so, once I have that firmware, I can usually find the binaries that are hosting those web servers or those custom binary protocols that are running on the device. And the the web servers are especially interesting cuz sometimes **[26:33]** you'll see kind of standardized servers that use like CGI like lighttpd, Yeah. >> which will uh so so lighttpd will manage kind of the basic web stuff, but then it will make calls to a binary, to like a C program that will actually like execute when you make a web request to certain endpoints. Also, you'll see people roll their own web server and web application all in **[27:04]** one binary, which is which is always fascinating cuz then they're they're doing all the raw they're writing they're rolling their own web server many times. And so, there's all sorts of, you know, potential security issues there. And then the application the actually the the business logic is all implemented all in one binary. That That's exactly what I did with my Roomba. The the React JS code, the web server, the web socket server, and the like lower-level communicate send bytes to the the **[27:36]** Roomba, uh that was all in a single binary. So, that's that's generally not a good idea, you're saying? No, I I like I guess what I'm saying in the IoT world, there's not like there's some standards, but it it hasn't coalesced as much as the traditional web world, I guess, around a certain set of frameworks and standards. There's a lot of different people who had their own ideas about how to implement a web **[28:08]** server and or a web application, and it just leads to a lot of security bugs where each case is different. It's not like I can run like it's not like I have a security tool that audits like React applications, and then I run I run that tool, and then I find volns, like common mistakes people make with that framework. There's not like just often times, it requires custom reverse engineering of each web server {slash} web application on each device to really **[28:41]** uncover if there's anything that's not being done correctly. Oh, man. All right. So, you you have access, you figure out what the API endpoints are, um and then like what's your process for trying to replicate what these these things are. Do you then bring that to your just to your computer or then or do you try to like put a custom firmware on the device? Yeah, that kind of depends. Usually, I'll try to extract some of that logic out, right? Like it like you want to figure out how the authentication is **[29:12]** being done, and even that you'll see being done in kind of a multitude of ways. You'll uh it might be using, you know, mutual TLS authentication with kind of like client client certificate authen- auth- uh or or, you know, some kind of API key that's on the device. If I can get that off the device and replicate it in, you know, Python or or in my own browser, uh that's something that I like to do a lot. But yeah, a lot of times, it's just like making **[29:43]** little custom Python scripts on my on my desktop side to to emulate the device and its calls. And then I can fiddle with, you know, hey, can like I have I have a device on this account and a device on this account, can device A access or make API calls as if it was device B? Okay, I see. Man, that's fascinating. What get What gets you inspired to look at stuff specifically? Like what do How do you pick a project that you're working on? Is it just uh you see something and you **[30:15]** have a question and like you mentioned your your innate curiosity kind of takes over? Yeah, I guess Yeah, I I I I guess it is that curiosity and I'm I'm always like looking for challenges in new industries, right? So like let let like right now like this is something I haven't even made a video on yet, but uh I'm kind of getting interested in drone technology and and drone hacking. And so then there's a whole bunch of like skill sets that that that involves. So I might **[30:47]** look for different devices to like help me build a certain skill set, right? So there's been times where I've purposely sought out uh devices that I think will have a certain kind of microcontroller or a certain component that I want to learn more about. And so I'll kind of try to cherry-pick the hardware to to teach me something because honestly making content, making the videos is one of the best ways that I learn and and I get better as a professional uh by just uh yeah, trying to do **[31:18]** something new. Yeah. What about uh doing more like man-in-the-middle um detection? So I'm thinking about right now, we have I've got a fleet of these like 12-V Fisher-Price cars that our kids drive on. Um and we have one that's called a Wild Thing where it's it's kind of like a little wheelchair you sit in you have two joysticks. It I found it on the side of the road in the trash and and I didn't work. It was erratic. Um so I replaced the main like motherboard on it with a brand new one and it still **[31:48]** didn't fix it. So I was like, oh, the the joysticks themselves have um little daughter boards on them like tiny little boards. And and I'm I'm not a point now where I'm like how do I figure out what the daughter board is sending to the main board? That's Is that something that you dip into as well? It's not really API, it's more lower level. I think about like um the button to talk to my garage door is not simply just like a closing a loop of electricity. It's it's sending some sort of data. How would I figure out what that data is? **[32:19]** Yeah, that that's a great question and that is that is stuff that I do. And the tool is going to be a logic analyzer that's that's going to help get you insight into those digital communications that are happening kind of like like between different chips on a PCB or between two different PCBs. So uh yeah, so you typically a logic analyzer is what's going to help you and and then connecting up to the to those lines, right? So if we go back to the to the case of the **[32:50]** UART console, right? Those that's just digital communications, but there's like there's not yet another end connected to it, right? So sometimes if I'm trying to uh even debug a UART uh kind of interface, may maybe it has a really weird uh baud rate like a symbol rate for for for how for how fast it transmits. Sometimes then I have to go back a step. I I I I have to set aside **[33:21]** that USB to to UART adapter for a second and actually connect up a logic analyzer. So the best way to think about a logic analyzer is if if if if we know what a multimeter is, right? A multimeter measures voltage, right? And a multimeter is slow, right? So it's like I connect it up to like a circuit, it might say if I connect it up to like a UART uh where where a digital signal where it's oscillating between 0 V and 3.3 V, then a multimeter it might like it might like give you a little fluctuation if **[33:51]** there's some data being communicated, but it's going to be really slow. Yeah. But a logic analyzer can sample a lot faster and can give you a nice clean kind of a square wave that is that represents that digital signal. And then Yeah, go ahead. Is Is that what like an oscilloscope is? I see it over your shoulder right now. So so yeah, no, and that's that's a great like thing to put on the spectrum because on on the kind of spectrum of sample rate, multimeter super low, logic **[34:24]** analyzer kind of sits in the middle, and then oscilloscope is like super fast sample rate. So it's kind of like figuring out the right tool for the right job, but they're they're kind of all sampling uh you know, the DC voltage and giving you kind of a readout of of what that situation is. So most of the times to to interpret digital signal, you don't need to go as far as an oscilloscope. Usually a logic analyzer will will work. >> logic analyzer will also record it, so you could like I could hook it up, hit **[34:56]** the button or like like like pull the controller back and then go back and look at it and say it sent like it sent just like a high highs and lows, is that's is that what it's sending? Yeah, exactly. So the most common one out there uh that that that goes with us So Saleae makes a lot of very nice, they're a little more expensive, logic analyzers. You can also get little ones for like $10 that are kind of like knock-offs uh on Amazon and it it it will work with their software as well. It's called like Logic 2 is the **[35:28]** name of the software. And yeah, it will give you a graph that you can you can zoom in and out on the signals and then it will include all of these analyzers, right? So if you're like, okay, I think this is a serial communications, then you can you can kind of add the analyzer and it will let's say if it's like transmitting like just ASCII data back and forth like a kind of that UART console uh situation would. You can have it interpret and and you'll see like over a set of eight **[36:00]** bytes it it it can put the symbol. It can say, okay, this is the letter A that's being transmitted. Oh, okay. If you're interpreting that correctly. And you can and that's where you can kind of test hypotheses to be like, I think this is a UART signal and I think the signal rate is this. Uh there's also other protocols that can be used like, you know, like SPI or uh I2C. There's there's these different digital protocols that uh you know, use one or more **[36:32]** wires to communicate a digital signal. Oh, okay. Cuz so GitHub Universe had a a badge that was like like a little PCB has a Raspberry Pi microcontroller on it. Um and there's a little I only recently learned it's not I2C, it's I2C. But that's often where you can buy like a microphone or a little display or something that also sends I2C communication. It's a kind of a nice hot plug thing. Yeah, yeah. And so so those **[37:04]** those logic analyzers are what to use when you like like you're like, okay, I think it's using one of those well-defined protocols, but I don't know which one it is, right? It's kind of your first step to uncovering that mystery. And then once you do that, then you can use kind of a dedicated tool that that speaks whatever the protocol is. Uh like in our USB-to-UART example, if it's a serial if it's serial communications, **[37:36]** uh that that's what UART is, right? It's it's it's a it's a serial it's a form of it's a two-way, you know, serial uh asynchronous serial communications. Is Is this what like tuners are doing in cars as well? Cuz in your car you've got like an OBD port um and there's all kinds of pins on that thing. Is and then that you can get some guy to like tune your Dodge Ram or whatever, right? To roll coal. Is Is that what they're doing here? Yeah, and so that's that's another protocol uh **[38:06]** more or less uh but they're probably going to be again using a dedicated tool because they know what protocol that it it's going to be CAN. So CAN bus, yes. Okay. >> CAN is is the protocol that pretty much all uh automotive stuff uses uh to to communicate. So you know, your your wheel sensor can communicate to the ECU and all the other components in your car uh can can read the messages of what's going on in the car. And so that's that's what that OBD-II port is giving you access to. So you could use a **[38:36]** logic analyzer uh but in that case pretty much everybody knows they're like, okay, it's it's going to be speaking CAN, so we can use a CAN-specific tool. The the the logic analyzer is the generalist tool and then usually you you figure out what what what language what protocol uh those physical those digital communications are using. And then you and then you use a purpose-built tool uh to kind of hone in on that. Oh, that's cool. I've always wondered that cuz in like the Tesla world, **[39:07]** there's all these like aftermarket accessories that will like pop the passenger door open or or um like recline the passenger or turn the back lights on. And people just add buttons wherever they want and it's because they're just they're adding this little module somewhere in the CAN stream and I guess intercepting those requests and or sending them down the pipe if they need to. Yeah. That's cool. Have Have you dug into any of the car hacking stuff yet or is there plenty on your bench to work on? Yeah, yeah, that that that that **[39:38]** hasn't been an area of focus yet. I like I said, I I'm curious about everything, so it's just a matter of managing that curiosity and haven't gotten quite into the the automotive world yet. Do you have any like crazy stories of of things you've done recently that's kind of fun? Or or even just like like hardware IRL. Like I every time I see like a massage chair or like an arcade claw machine, I'm always trying to hit combinations of **[40:08]** buttons or like trying to like reset it. Like I or the the in-screen entertainment systems on the plane, I'm always trying to hit the buttons and figure out what that is. Yeah, I think I had a post on X about that. I was I was like flying back I think it was from DEF CON and like I was able to figure out like like I wasn't able to get a full escape back to like the Android, but you but like those most of those in-screen displays are are Android. Yeah. In in in fact, I I like this is a little bit of context into the the industry **[40:40]** that I'm most familiar with, but most like security panels at home that have a nice display, not like a super old like crappy LCD display, but a proper display on them, those are usually running Android as well. >> Oh, interesting. But yeah, those in- those in-screen displays I was able to like enter a game and then like it would it would show the home like the go home button or or or or the or the like the button in Android to like access your other running applications and you like you **[41:11]** could spam that really fast and like it would escape back to the like just the the app selection menu, but it didn't let you escape any further than that. But Oh, that's so fascinating. I also had a post on X a while ago asking like what these things are built in. We had a couple people from the industry chime in as to like what they're built in and and it was it was a really interesting read just to get a peer into these how all of this stuff works, especially on a plane, you know, it's it's a fairly closed-loop system because the shows are on a drive on the plane. **[41:43]** Oh, yeah. No, no, no, that stuff is uh super fascinating. Yeah, with hardware, I'm always I'm always looking around me in the world for targets, so I'm I'm like that weird person that's like in a coffee shop and I'm like, oh, they have that brand of security camera running, you know. And uh but I think you mentioned my grill video cuz that's you know, I I I had that smart grill for probably like a couple years and I was and I've always been like, oh man, I should really rip this apart, but I don't want to break my grill. Uh so so **[42:14]** that that that was a fun adventure and that always leads me to like eBay, right? Like like eBay is just is just a great place for me to go find a bunch of weird used industrial technology or consumer technology to to always hack on. That's So tell us what you did with the grill though. I think that was pretty interesting. Yeah, so so that was yeah, it was just a fascinating experience because first I again, the motivation is like I use my grill. I don't want I don't want to like accidentally brick my grill because I'm **[42:45]** like trying to do firmware extraction on it. And so I I So so I went on eBay and I found a replacement computer module that was supposed to work as a drop-in replacement for for my grill. And so I I you know, I went and I started to do the analysis on that and I was like, this this is weird. This like doesn't properly connect out to the internet. And so then I was like, all right, I **[43:16]** just need to go do it on my own grill. And so I and so I ripped them off and I was comparing apples to apples and it was like a different hardware revision, which is really fascinating. So I don't know if that was like the thing I bought on eBay was someone bought that device, you know, like that device was some kind of development unit or some kind of unit that didn't pass QA and they're like, oh, I'm going to make some money by reselling this on eBay. Uh **[43:46]** Yeah, that was a fascinating >> that as well as like how hard is it for people just to create like aftermarket boards for these things? Is that something that happens? Yeah, well and then like part of the the security world that is not usually the like security flaws that I'm looking for cuz the these I I'm not as concerned about, but there is a lot of anti-cloning work in the security community. And so so they are are trying **[44:18]** to prevent firmware extraction, right? They're trying to or or or they're trying to put some piece of the puzzle in a place. Maybe maybe it's in some kind of internal you know, storage inside of the CPU or it's a microcontroller where it they can actually lock the debug connection and the firmware is like locked inside the microcontroller. And they'll do that to prevent cloners from from just you know, reading out the **[44:49]** firmware and then and then producing a a compatible unit. Yeah, that's that's a hard thing because like part of me like I have a Sea-Doo that's 20 years old and you you go on AliExpress and buy an entire like computer, it's called a SPI for your Sea-Doo. And for like 80 bucks, you can if if you for some reason have blown your 20-year-old computer unit on your Sea-Doo, you can just get a brand new one and and slap that thing in, which is great for like right to repair, **[45:20]** but also awful for like someone could steal your Sea-Doo and just slap in a new, you know, slap in a new computer unit and that thing is is untraceable now. That's a it's a tricky area. It it really is and I yeah, I've I've gotten asked those questions before and like like I'm not an expert. I'm I'm really interested in the whole right to repair movement. Yeah. I actually start I would not have started my YouTube channel if it hadn't been for Louis Rossmann actually. And for for kind of a funny reason. So I **[45:51]** hate video editing. I'm not good at it. And so I watch I would like watch his videos and I'm like, this guy gets a ton of people watching board repair videos unedited. Yeah. Like an hour-long video. And I was like, okay, so like long-form content clearly not dead and you know, attention spans in the hardware/technical domain, there's an interest for that. So that's kind of what led me to start my YouTube channel and make it just a format where it's it's more or less **[46:23]** unedited and long-form. So I'm I yeah, I I I have a lot of lot to thank Louis for and yeah, definitely interested in the movement, yeah. >> Although he did start that paperclip movement, which like the worst people that comment on our YouTube channel are all of a paperclip. Yeah, oh my avatar. Okay, it's so funny cuz I haven't watched Louis in like in a while, right? Just because I I'm busy with other stuff. And so I would see all these like paperclips in my in my YouTube comments **[46:54]** and I'm like, what is going on? Are these like is this like a bot farm? Yeah, we thought it was the same guy. Yeah. Yeah, yeah, and I was so I was so confused and then I was like, and then like I I finally like tracked it back. I'm like, oh, this is like Louis Rossmann thing. [Laughter] Yeah. All the paperclips, please leave a comment right now. We need to see you. Yeah. Anything we haven't hit on that you'd you'd love to cover? **[47:25]** Um No, no, this is this is really cool and just yeah, glad to get to chat and share something interesting. I've got I've got one more question for you and this is this entire podcast is very self-serving. I only want you on so I can ask you questions directly without having to pay for your time. No, I'm just joking, but so for Christmas, we're getting our kids laser tag and as far as I understand that that's RF. Like it sends an RF signal. And I was thinking like I want to build a nuke **[47:58]** that like I want to build some device where I hit a button and it does RF in every direction and just like boom, gets all the kids and then they're all dead. You know, how fun would that be? Like what what would even be my first step to building something like that? Yeah, so so this is something that this is a domain that I've recently started to produce some videos on. So that that is going to be kind of some yeah, some radio protocol reverse engineering. And so a software-defined **[48:30]** radio, an SDR, is probably going to be step one. Also, the thing is if it's RF, you can do a lot of open-source intelligence gathering through the FCC. So the FCC website and there's like a third-party site. I think it's like fccid.io that just like scrapes the FCC website. You can see internal photos of everything. Exactly. Well, the other thing they'll document on there is the frequency, the radio frequencies that **[49:01]** are being used and that saves you a lot of like scanning around with your SDR. If you know what what it's transmitting on, then you can listen and you're going to need Now to actually do the replay attack part of it, you're going to need a radio that can transmit. So the simple RTL-SDR that everyone starts with, which is great, those can only receive. They can't transmit signals. And so you're going to need something like a HackRF maybe. And so the HackRF even has really simple **[49:32]** programs that will record a signal and try to replay it. So, uh assuming that, you know, there's not some super advanced security going on with the the laser tag system, if you can just capture a signal, right? Like record and then and then shoot and then shoot like like shoot the gun at at the antenna and then record that signal and then try to replay it and see if it has uh the effect that you're looking for. Man, I I think I have something like that. It's either RF or IR. I bought it **[50:03]** to I think Scott might have done this as well. We have like these like little AC units that don't have like a Wi-Fi chip in them, but you can just like point the remote at it and and train it, right? I should look into that. Yeah, I actually got one for my first generation Echo Spot. Oh, that'd be awesome. Jeff West hacking to cheat at laser tag with his kids is uh I'm going to bring that up. >> And like there's no chance it's it's like encrypted, is it? I I I I highly doubt it. Highly doubt it. Now **[50:35]** now what now what might happen is like each gun might have its own like like a part of the signal that's different. If if it has any kind of like scoring system, right? Cuz then you need to know who shot who. And so there might be something that is encoded. I doubt it's encrypted, but there might be some part of the communications that is identifying that's like unique to each gun, but maybe you don't care about that if you're wanting to nuke then you should do it with your gun because you probably can't in this **[51:06]** system you probably can't shoot yourself. And so you would be immune if you captured your own gun's signal and then send out the nuke. Yeah, yeah. Oh man, I I I think the first thing that ever got me interested in this is years ago somebody figured out that you can take this like kids diary from the 90s. It was called the like I Am Me or something like that. It was like this little thing and it had an RF uh transceiver cuz you could go between them, um but somebody figured out that you can just make it go on loop and send **[51:37]** every garage door code out. Um and this was before garage doors had like rolling codes, so this was like like like 30-year-old garage doors would just open. Which is at our cottage we have one it just randomly opens and we've we haven't pinned it down as to what it is, but it's somebody's key fob for their like Dodge Caravan or something just causes our garage door to open. Yeah, that's uh Sammy Kamkar, uh his work and he's got a DEF CON talk that uh yeah, highly recommend any of his stuff. **[52:07]** I want to go to DEF CON. >> He's done some crazy stuff now, so he is getting into uh laser uh using lasers to transmit sound and he had a project where he could make an Amazon Alexa unit receive audio with a laser through a window. So he could So he could transmit audio through a window like like if it was in somebody's house like to the Amazon **[52:38]** Alexa and it would the the the vibrations like the the signal that Like an unmodified Alexa, they would just the vibrations would play. Oh, that's terrifying. Holy hell. Yeah, yeah, he's he's getting really deep into laser uh technology uh now. He's got some like homebrew like like laser technology uh that's like yeah, you got to you got to you got to wear proper eye protection with all that. So So my last question is IoT stuff. Do you have it any that the classic thing **[53:10]** is like I keep my IoT next to next to my bed with a gun. Um do you run any smart home stuff after all you've seen here? I do. I Yeah, I'm I'm maybe not as doomsday as like most people about it. Uh I I like I've got I don't know. Like I'm I'm just kind of a network nerd anyway, so I do have like networks some not not overly like paranoid, but I do have some network segmentation that I keep, you know, some devices on a different network. And so **[53:42]** um Yeah, and it's just a matter about, you know, choosing what your your risk profile is. I I have some devices. I don't have a lot of devices, so it's it's it's it's kind of a compromise in the middle. And obviously, I'm always playing around with things in my in my kind of like test lab here, so I've I've always got some some weird traffic going out of my of my network. Uh Matt, that was uh really enlightening for me personally considering I I don't get my hands dirty with most of this stuff, so I really **[54:12]** really enjoyed hearing all of this. So uh now is the part of the show where we get into sick picks, which is something that you're just enjoying in life right now. Could be anything from a podcast, a YouTube channel, product, whatever. Is there anything that you're just really feeling right now? Yeah, so I totally forgot to tell you about this. Usually we have like a whole document we send ahead, but I did I did it a different way this time. No, no, no, this is this is really good. So kind of my my side interest is uh is **[54:44]** has been business lately. So so so I've been, you know, uh running my my my my my side business uh and I've been just getting more interested in in how to run a business effectively, so uh reading books like um Key Person of Influence by Daniel Priestley. Just uh yeah, just some general business books to kind of up my game in that area. Funny enough, my my undergrad is kind of in business, uh but it was it was because like management information systems like our I my IT **[55:14]** degree was uh in the college of business at my college, so >> that's exactly what I went to school for. I went to school for business technology management, which is exactly like not enough coding, but more on the business side of things, but uh It was really because I didn't want to take calc three and like all in physics uh is why why I chickened out of CS, but uh that's another story. Oh, that's great. I got to I've never read that one. Key Person of Influence. I'm going to check that out. Yeah, and **[55:45]** it and and it really like I I really like that book because it talks about how you can use, you know, your like like I I'll never call myself an like an influencer or whatever, but but it it it it talks about how you can use your your public presence, your content to build a business that kind of syncs with the rest of your life. And so the cool thing for me is I feel like it kind of follows the journey that I've gone on over the past 2 years because I made my YouTube **[56:15]** channel when when I started my YouTube channel I was like if over the lifetime of the channel I get 10,000 subs, I can like be like mission accomplished. And obviously it like rocketed past that. And so that caused me to just get reached out to by businesses to be like, "Hey, can can you do some consulting for us?" And so the business just kind of grew out of the content. And so we're going to we're just going to see where that goes. That's awesome. How How long have you **[56:45]** been doing your YouTube? About 2 years now. Holy. You're almost at 200k subscribers. That's amazing. Yeah, yeah, it's uh it's been a wild ride. Yeah. Well well, congrats. Thank you so much for your time today and whoa whoa whoa whoa whoa. Oh, sorry. Never mind. Go ahead, Scott. Also, the last thing is a shamelessly plugging. So is there anything you would love to plug to our audience to make them aware? So we'll we'll link up your YouTube channel. It's a fantastic subscribe. Um anything else you want to plug? **[57:17]** Yeah, just if anyone is in the need for a hardware pen testing, that's like the the one thing that I do at my business. And so brownfindsecurity.com is where you can find info on that. Nice. Sick. Right on. And the his YouTube is just Matt Brown. It's m a t t b r w n if you're going to type it in to YouTube as well. Yeah. You can click the link in the show notes, but if you're just typing it in, you'll find it in there. Cool. Well, thanks again for all your time. This is super interesting. I appreciate all your all your time. Thank **[57:49]** you. It's been a great great time. Thanks, Matt.