963: Hardware Hacking with Matt Brown

Scott and Wes chat with YouTuber and security consultant Matt Brown about breaking into IoT devices, extracting firmware, and decoding the hidden tech inside everyday gadgets. Matt shares his methods, the legal boundaries, and the wild stories behind his most interesting hacks. Show Notes 00:00 Welcome to Syntax! 01:21 Curiosity in Hacking 03:28 Understanding IoT Devices 07:15 Brought to you by Sentry.io. 07:40 Linux vs Microcontrollers 10:11 UART Console Access 13:56 Firmware Extraction Techniques 14:19 Guessing Usernames and Passwords 19:22 Extracting Password Hashes 23:15 Legal Considerations in Hacking 30:06 Where does the inspiration come from? 31:20 Using Logic Analyzers 37:45 CAN Protocol in Automotive 45:42 Influence of Lewis Rossman 54:05 Sick Picks & Shameless Plugs Sick Picks Matt: Key Person of Influence Shameless Plugs Matt:Matt Brown on YouTube, Brown Fine Security Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Wes Bos?

  Welcome to Syntax. Today, we have Matt Brown on. He is a YouTuber and security consultant who specializes in pen testing IoT hardware. He has a YouTube channel that's filled with fascinating videos. So, for example, he found dozens of unsecured police license plate cameras, and they had a video feed, had a stream of all of the data, which include the license plates, the car make and model, and the GPS coordinates. He's active smart grill and extracted the firmware from that, and he's dove into the network activity of dozens of cheap Chinese cameras. And recently, he let Claude Code rip on one of them, which was really interesting. So, we've had him on today to talk about how all of this hardware hacking stuff works, the legality of it, and hopefully a few interesting stories. Welcome, Matt. Thanks for coming on.

• 0:43Speaker 01

  Thank you for having me.

• 0:44Wes Bos?

  Yeah. So, I've been watching your YouTube channel for, I don't know, probably for about a year now. I'm not sure how I stumbled upon it, but you have these really good breakdowns of how you can take a piece of hardware and then just dig into how it works, or find some pieces of interesting pieces that you may not necessarily know, or buying something that's from like a different industry, like the police license plate readers, and then you could just buy one yourself, and then just dig into it, and you find all the API endpoints, and then you realize, oh, this is maybe not as secure as we thought it would be. So, how do you even get into all of this stuff?

• 1:25Speaker 01

  That's a great question. I guess the chief kind of hacker mentality of curiosity, and letting that lead you in the discovery of information and knowledge has always been a thing that I've done since my youth. So, you know, back in my high school and college days, you know, messing around with computers at my school, things like that. I've always been interested in going to thrift stores. Back when I was in high school, I would go to Goodwill, which is a US-based thrift store. I don't know if they have them outside the United States.

• 2:02Wes Bos?

  Yeah, we have them in Canada.

• 2:03Speaker 01

  Oh, sweet. So, I would just go buy used electronics and take them apart and see if I could like take them apart, put them back together, see how they worked. And that led me deeper and deeper down the hardware hacking rabbit hole, where now I, on my, on my channel...

• 2:22Speaker 01

  I like to just buy used devices, take them apart, and usually I'm after two things. I'm usually, like you said, interested in kind of revealing knowledge that might have security applications in the software. Funny, the funny thing is, there are people that are like deep hardware silicon, silicon hardware security researchers, and that's actually not really my thing. Usually hardware hacking is like a means to an end to hack on software or hack on APIs to reveal, you know, APIs that I wouldn't have known existed, maybe, unless I dug into a piece of hardware.

• 3:00Wes Bos?

  Okay, that's, that's really interesting to me because like, in, in the web development world, we love spelunking into the dev tools, you know, you open up the network tab and you see what's going on, or we have an app on the desktop called Proxyman, and that will allow you to monitor traffic that's coming in and out of it. And some of us dip into like, maybe even like Wireshark, where you get a little bit past like just HTTP traffic and into some of the lower level stuff. But once, once it ends on like something running on your machine, or maybe something running on like your phone and you proxy your phone's traffic through your computer, that's kind of where it ends for me of like dipping into it. And there's always like these like, like you get a camera, or you get like this thing

• 3:45Wes Bos?

  that you connects to your wifi, and I'm always curious like, man, like, what are the API calls happening there? And it's, it's kind of tricky. So like, let's say you pick up a piece of hardware, what are your like first steps for sort of breaking that down, trying to find out what the APIs are?

• 4:02Speaker 01

  Yeah, so if I'm looking at kind of your standard IoT device that is going to make calls out to some backend server on the internet. Most of the time, that's going to be wrapped in TLS, right? So just opening it up in Wireshark, I'm going to get a hostname and nothing more. I'm not going to get any endpoint information. I'm not going to like, because what we want, right? Is we want it to be like the network tab on in DevTools. We want to actually see the requests and the responses. Because then as security, you know, from a security or maybe just a tinkering perspective, maybe you want to write your own application that interacts with the backend, right? Kind of some kind of a third-party thing.

• 4:47Speaker 01

  There, there's all sorts of applications of this, this hardware hacking work. And so there's a couple of avenues. One is if we can get a root shell on that device, if we can, if we can, if we can gain control over the device, then we could potentially put a, our own CA certificate in the trust store of that device. Kind of like if you've ever used Burp Suite or any of these proxying tools to look at web traffic from your web browser, you have to go in either to your computer's trust store or the browsers, like Firefox has its own independent trust store. Chrome uses the OSs.

• 5:31Speaker 01

  And you have to add the proxy certificate to allow it to terminate that SSL, that TLS communications.

• 5:39Wes Bos?

  So that's why when like you get like a laptop from your employer and they install their own certificate, they're able to, even though the website you're going to may, maybe HTTPS, they're still able to see every request that's, that's coming through there because they literally are putting a secured certificate in the, the chain, right?

• 5:57Speaker 01

  That's exactly right.

• 5:58Wes Bos?

  Yeah.

• 5:59Speaker 01

  So we can effectively do the same thing in the hardware world. If we, if we, if we obtain a root shell or we're able to, you know, modify that firmware somehow, modify the running device and put our cert into the trust store. And I say trust store. We have to do some reverse engineering. Sometimes it's like a common Debian system where it's going to be in Etsy SSL certificates or something like that. That's really common. Sometimes it'll be super hardcoded into a binary that you kind of have to do some reversing and modifying of the system to figure out how to put yourself in that chain of trust. But once we put ourselves in that chain of trust, then we can use a transparent or an

• 6:44Speaker 01

  intercepting proxy, which Burp Suite and Kaido, they do have a mode where you can enable that and allow it to proxy your traffic. Now then, you have to do some network shenanigans, maybe with IP tables or something with your router to convince your device to route its traffic through this system that has a transparent proxy. But at that point, we are able to see all the contents of that HTTP communication.

• 7:15Scott Tolinski?

  And if you want to see all of the errors in your application, you'll want to check out Sentry at sentry.io/syntax. You don't want a production application out there that, well, you have no visibility into in case something is blowing up and you might not even know it. So head on over to sentry.io/syntax. Again, we've been using this tool for a long time and it totally rules. All right.

• 7:39Wes Bos?

  And like what's usually running on these devices? You mentioned Debian. Are a lot of these things just running Linux on them or does it depend?

• 7:48Speaker 01

  Yeah, so in the IoT world, there's kind of two categories of devices. There are more traditional Linux-based devices and then there are microcontrollers. And so you'll often see these used in different applications. If you need like a low-power application, if it's a battery-powered device. Now, these lines can blur, of course, but generally speaking, if you have low-power, battery-powered device, those are oftentimes going to be microcontrollers, which are a whole nother game in terms of how to do that firmware modification.

• 8:24Wes Bos?

  Like an ESP32 or like one of those Raspberry Pi Picos or something like that?

• 8:30Speaker 01

  Exactly. Yeah. And that's, yeah, the Raspberry Pi world is a great distinction. So Raspberry Pi Pico, microcontroller, regular, traditional Raspberry Pi is going to be a, a microprocessor that runs Linux.

• 8:42Wes Bos?

  A mini Linux computer.

• 8:44Speaker 01

  Kind of operating system. Exactly. So in the Linux case, that's, that's what you're going to find most of the time. If you're, if you're targeting routers, IP cameras, most of the time, those are going to be Linux. Now, that is changing because people like battery-powered cameras. They like lighter weight devices that don't need to be plugged in. And so you are seeing some advancements in microcontrollers in that, in that space. For Linux devices, yeah, it's, it's oftentimes going to be just a very kind of custom, like, I call it like an SDK where a chip provider will provide an entire build system that will include a kernel and the, all the root file system necessary to boot Linux.

• 9:29Speaker 01

  And then on top of that, a device manufacturer will build all their custom business logic in the form of some kind of a daemon that will run and that will communicate out to the cloud.

• 9:41Scott Tolinski?

  And what language is that stuff written in typically?

• 9:45Speaker 01

  Mostly it's C. You'll see some C++. In very odd cases, you'll see some higher level languages like Python being used. But it's, it's mostly a bunch of C code that is ripe for finding, you know, command injection, buffer overflow type vulnerabilities that are, that are kind of commonly plagued those languages. Yeah.

• 10:10Wes Bos?

  Okay. So you get something and like, how do you even get root access to that thing in the first place? So you plug it in via USB. Often it will just like go into the mode where it's just like mounts as a USB drive or, or acts as a camera. How do you get the lower level, which is access to like the firmware that's running on this thing?

• 10:29Speaker 01

  Yeah, so typically what I'm gonna do is I'm gonna open up the device. And the first thing I'm gonna look for is the UART console header or debug pins on that device. It's typically going to be a four-pin header or connector that might not even be populated, right? They might, for their debug version or their kind of development version of that device, they might actually have a header populated. Whereas in production, they might try to like, take that component out just to save a little bit on their bill of materials cost for the device. But you're gonna look for that connector.

• 11:12Speaker 01

  And that's where, kind of in my videos, I talk about how there are these USB to UART adapters. And those are gonna be set to a certain voltage. 3.3 volts is like the most common one you find out there. And when you connect up to, you know, the TX and the RX line, so it's just an asynchronous, uh, physical communication. My analogy I like to talk about is it's kind of like a physical UDP socket, right? It's, you can, you can send and receive data across this, these physical wires. And then on the device, that can be connected up to a couple of different things. So on a Linux device, that's typically gonna be connected to the console.

• 11:56Speaker 01

  And so if you are connected properly and you power on your device, you're going to start to see the bootloader logs roll by. And maybe you can enter, maybe you can like smash a key and interrupt that boot process. If we let it boot up fully, maybe they're, they're, uh, you know, dumb enough to just leave a logged-in root shell, right? They don't even make you log in, or maybe there is a login prompt, right? Uh, and this is where we start to rabbit hole into different ways to turn the situation into that root shell. Uh, so, so, uh, it's, it, there's, there's a lot of different tricks, uh, you can do. But if you have that console access, you can oftentimes turn it into a root shell.

• 12:41Wes Bos?

  That's so fascinating to me because like you open up any electronics, you're often going to see a couple of little dots that'll say TX, RX and ground, right? And those are your UR connections.

• 12:52Speaker 01

  Yep.

• 12:52Wes Bos?

  And you can buy on Amazon, you buy like a $5 little USB converter, where you just attach to those pins. I know there's some, probably some more advanced like things, but at the very basic, you're trying to connect those three wires to a USB. And then you can directly connect to that from your computer. And then when you turn it on, the way I know about this is I did a, putting JavaScript on my Roomba video. And if anyone's like looking to get into having fun, the old crappy Roombas are like $6 at a thrift store. And there is full documentation and there's a PIN header right on the, on the top of the Roomba. You don't even have to open it up and you can connect directly to it. And then when it boots up, you can see all of the logs.

• 13:38Wes Bos?

  And then you can just start sending and receiving commands from it. And there's libraries out there that will help you both send what the commands are, you know, as well as receive things like the battery temperature and the, how fast something is driving, all that interesting stuff.

• 13:55Speaker 01

  Oh, that's so cool.

• 13:57Wes Bos?

  Yeah, but so like, I'm curious, like that's like, that was really well documented for me, right? Like Roomba, Roomba wants you to hack them, which is kind of a bummer now Roomba's falling for bankruptcy. But like, what do you do to figure out what these commands are when someone doesn't want you to hack with it?

• 14:15Speaker 01

  Yeah, that's, that's a great question. And that kind of leads into the second activity. So if like, if the first activity is like finding that UR console, and if it doesn't immediately give you what you want, right? It doesn't just like drop you into a Linux shell. Maybe, maybe it leaves you at a login prompt and you're like, okay, how, how would I guess what the username and password is? Kind of the second activity then is firmware extraction in terms of hardware hacking. Again, always for that purpose of hacking the software. So this is like where we are able to, you know, with a hot air gun, I've got over. On the bench here, able to de-solder a chip. Sometimes you can read the chips in circuit, meaning you can leave it attached to the board.

• 15:00Speaker 01

  And you can attach a, you know, a universal, like a programmer, a firmware reader to a chip. Some chips are just not able to be attached to that way based on the physical layout of the chip. And so that's why I prefer to de-solder things. Also, you can run into some issues where if your in-circuit programmer reader can like, inject power, it can basically power the board and cause it to do a bunch of undefined things. So usually I'll-

• 15:31Wes Bos?

  Let the smoke out? Does that happen sometime?

• 15:34Speaker 01

  Uh, it can, it can, or it can just like mess with your firmware read is what's probably more likely to happen.

• 15:41Wes Bos?

  Okay.

• 15:41Speaker 01

  Because then you'll like power up the CPU or the MCU and it will try to start talking to the flash chip too, to read and write from it while your programmer is also trying to interact with it. And so you're like both like arguing over who has control over the flash chip.

• 16:01Wes Bos?

  Oh, I see.

• 16:02Speaker 01

  Yeah.

• 16:04Wes Bos?

  Okay, okay.

• 16:04Speaker 01

  So, so once you, once you remove that flash chip, you're gonna put it into a programmer. And then obviously you need to have a bunch of different kind of adapters to fit the different kinds of chips. But once we do that, and, and once we read that software off, you're usually left with a binary blob that is the entire contents of that flash chip. And so usually on a Linux-based device, that is going to contain multiple partitions, multiple file systems. And so that's when our handy tools like Binwalk are gonna come in handy for searching through that binary blob to extract out well-known file systems.

• 16:47Speaker 01

  So you'll, you'll see things, especially on more heavy Linux systems or like Android-based devices, you'll see like EXT4 file systems. There are also a lot of file systems that are made specifically for embedded devices like squash FS.

• 17:04Speaker 01

  There's a whole number of file systems that you'll never see outside of kind of the IOT space.

• 17:10Wes Bos?

  But these things are like, are like well-known. That's what was so interesting to me about this is that like, just like us web developers, we're reaching for like React and Node and all of these like well-known things. People who are making hardware are also reaching for well-known things. Often they'll take a chip off the shelf. That is like 80% of the way there. And because those things are well-known, then they are also a little bit easier to decrypt with tools like Binwalk. Is that true?

• 17:41Speaker 01

  That is true. Yeah. So Binwalk usually if you, the, the, the common flag you pass it is dash lowercase e, which is just, hey, extract is the extraction flag. Like say, hey, go through, go through this file and extract out all of the well-known file systems. And so if that works and you know, there's, there's a whole bunch of caveats of, you know, sometimes a manufacturer will try to be cute and like slightly modify a file system specification. But most of the time they don't do that. And you're left with the contents of like maybe the root file system and maybe a, another partition. So most of the time on these OT devices, there'll be multiple partitions and the root file system will be read-only.

• 18:25Speaker 01

  Kind, kind of as a, a reliability mechanism, right? To, to keep creep and, and errors from making the system unbootable. And so, and then you'll, you'll have data stored in another partition. And those are all of the things that you need to then go start searching through the file system for binaries. You might want to throw into a reverse engineering tool. Or say the, the Etsy shadow file to grab password hashes out of. And then you can try to crack those password hashes to go back to your UR console to attempt to log in.

• 19:01Wes Bos?

  Okay. Man, that, this is so fascinating to me. Sorry Scott, I'm not letting you.

• 19:07Scott Tolinski?

  No.

• 19:07Wes Bos?

  I haven't let Scott talk at all.

• 19:09Scott Tolinski?

  I don't do any of this stuff. So Wes is the hardware hacker on this show. So I'm just kind of like listening and soaking it in. So, no, I appreciate, I appreciate your insight Wes.

• 19:21Wes Bos?

  All right. Oh, good. So like, like what's the next step then? So like, once you've dumped this firmware and you've used binwalk to sort of look through it, like what are you then looking for?

• 19:32Speaker 01

  Yeah. So like I said, if, if I, if my goal is still, like if I haven't accomplished that root shell goal yet, then I might look for things like, you know, the shadow file. And then I might grab those password hashes, those Linux password hashes, and throw them into hashcat, use my GPU to, to try to crack those passwords. And so if that's successful, then that gets me in. If that's not successful, there's kind of the next step down the rabbit hole of attempting to modify that firmware image. So if there's, if there's a password that I can't crack,

• 20:12Speaker 01

  but, but there's a shadow file, maybe I could replace it with, with, with, with a hash that I do know the corresponding password to. And then if I can package all the file systems back up into that binary blob, and then use my programmer to write back to the chip, and then solder the chip back onto the board.

• 20:34Scott Tolinski?

  Oh my gosh.

• 20:34Speaker 01

  Then, assuming there's no kind of secure boot controls, there's no integrity controls on the system, uh, which you're seeing more devices that have those, but some of them, there, there's still lots out there that don't have those kind of controls.

• 20:50Wes Bos?

  Can I, can I tell you a story of one time I accidentally did that?

• 20:54Speaker 01

  Yeah.

• 20:55Wes Bos?

  I had bought a, this was probably like 12 years ago, and I had bought a camera off of, uh, I think AliExpress or, or Deal Extreme back in then. And it was like the Chinese version of a very popular North American brand. Um, and I was like, I wonder if I can just load the firmware from the North American one onto the. Chinese one. So I went on GitHub and I found somebody had dumped the firmware from one of the North American cameras. So I just dumped that on my camera, booted it up, paired it to the North American app, no problem. And all of a sudden, I see video from somebody

• 21:34Wes Bos?

  else's camera. And I was like, oh, no, like, this is, it must have like, a like, it must have like, flashed the MAC address or some sort of identifier. And it was like, in someone's bedroom. So I unplugged it. And I've never, to this day, plugged that camera back in again. Because I was like, I don't know if I just, what I just did was illegal, or whatever. But I was just trying to get it added to my own thing. And it started streaming in someone else's video. And I was like, I was almost kind of scared there. And I just, I have never plugged it in again. I think I tossed it a couple of years ago, because it was kind of scary. But that's something that could happen, right?

• 22:11Speaker 01

  Oh, yeah. So that's, yeah. So going back to the, how there's commonly like, a root file system, that's, that's kind of, you know, unmodifiable. And then, there's the data partition. So what was probably wrapped up in that, in the data partition somewhere, is some kind of APIs, tokens, keys, that identifiers that corresponded to probably the person who made that repo and the firmware dump, right?

• 22:35Wes Bos?

  Yeah, yeah.

• 22:36Speaker 01

  And, and then, and then, and then you, by flashing that on to, on to your device, you basically, you basically cloned the device, right? And so, that is, an attack that, you know, that, that, that could be considered valid, you know, in some cases. Now, obviously, you need like, physical access, you need a firmware dump to somebody else's camera. So it's like, in a lot of cases, that won't be like, a security vulnerability, right?

• 23:05Wes Bos?

  Yeah.

• 23:05Speaker 01

  It's like, if I give my keys away to somebody else, it's like, okay, yeah, then they can,

• 23:10Wes Bos?

  Of course. They can enter your house. Yeah, okay.

• 23:14Scott Tolinski?

  Yeah. So with all of this stuff, like, where does that legality border exist?

• 23:20Wes Bos?

  Yeah. Have you ever had the police knock on your door?

• 23:23Speaker 01

  No, no, no, no police. I've had some strongly worded emails, but I haven't, I haven't been sued yet. So that's good. Knock, knock on wood here. So generally speaking, My understanding, I'm not a lawyer by the way, so this is not legal advice. Is if I own the device, right? I like, I'm always very careful when doing security research to like, if I'm hitting API, like cloud APIs, that's where I draw a very strict line to if I want to test, can like one device kind of access the stuff of another device? Then I'll buy two devices and I'll create, I'll create two accounts, right?

• 24:07Speaker 01

  And I'll try to do those cross account attacks on myself. Again, not legal advice, that might still be considered an unauthorized test. And then obviously the hardware is, that's my property when I buy it. There, there are some United States laws against reverse engineering. But at least today, they still all have carve outs for what is called good faith security research. So again, I'm not a lawyer and don't know the, the specific definition of that term, but I try to do my research in good faith. And, and to not, not to use it maliciously, not to attack other people.

• 24:48Speaker 01

  And so at least in the United States, we have the kind of those protections. I obviously don't know about, about other countries, what the situation is there.

• 24:58Wes Bos?

  All right. So where, where were we with the, the process of?

• 25:03Speaker 01

  I think, yeah, like what, what to do with the firmware extraction. So another thing that might, that might be interesting, especially to like, kind of like in getting into the web topic is, so the first kind of theoretical IoT device we talked about was where the device reaches out to a cloud server via its APIs. But also a lot of times these devices will have their own embedded web servers on them. They'll have, or, or other network services that can be connected into, right? So maybe, maybe there's a mobile application and let's, let's talk about a video camera, right? So in the video camera use case, you could think of, okay, I want to be able to access my camera remotely. And so.

• 25:44Speaker 01

  When I'm away from my home on the mobile app, that that data has to go up through the cloud server. But if I'm in my house, now there's a lot of latency, there's a lot of video latency in that first case. So maybe when I'm in my house, I'm on the same network, I want it to stream directly from from phone to camera. And so a lot, a lot of video cameras will do this, they'll have a way that that it can sense that. And the mobile application can directly connect to a service that's running on the device. And so, once I have that firmware, I can usually find the binaries that are hosting those web servers or those custom binary protocols that are running on the device.

• 26:29Speaker 01

  And the the web servers are especially interesting because sometimes you'll see kind of standardized servers that use like CGI, like Light HTTPD, which will, so so Light HTTPD will manage kind of the basic web stuff, but then it will make calls to a binary, to like a C program that will actually like execute when you make a web request to certain endpoints. Also, you'll see people roll their own web server and web application all in one binary, which is, which is always fascinating because then they're, they're doing all the raw,

• 27:12Speaker 01

  they're writing, they're rolling their own web server many times. And so there's all sorts of, you know, potential security issues there. And then the application, actually, the the business logic is all implemented all in one binary.

• 27:25Wes Bos?

  That, that's exactly what I did with my Roomba. The the React JS code, the web server, the WebSocket server and the like lower level communicate, send bytes to the the Roomba, that was all in a single binary. So that's, that's generally not a good idea, you're saying?

• 27:44Speaker 01

  No, I, it, it, like, I guess what I'm saying, in the IOT world, there's not like.

• 27:51Speaker 01

  There's some standards, but it hasn't coalesced as much as the traditional web world, I guess, around a certain set of frameworks and standards. There's a lot of different people who had their own ideas about how to implement a web server and/or a web application. And it just leads to a lot of security bugs where each case is different. It's not like I can run, like, it's not like I have a security tool that audits, like, React applications and then I run, I run that tool and then I find Volns, like, common mistakes people make with that framework.

• 28:31Speaker 01

  There's not like, just oftentimes, it requires custom reverse engineering of each web server slash web application on each device to really uncover if there's anything that's not being done correctly.

• 28:45Wes Bos?

  Oh, man. All right, so you, you have access, you figure out what the API endpoints are. And then like, what's your process for trying to replicate what these, these things are? Do you then bring that to your, just to your computer? Or then, or do you try to like, put a custom firmware on the device?

• 29:02Speaker 01

  Yeah, that kind of depends. Usually I'll try to extract some of that logic out, right? Like, like, you want to figure out how the authentication is being done. And even that you'll see being done in kind of a multitude of ways. You'll, it might be using, you know, mutual TLS authentication with the kind of like client, client certificate auth, or, or, you know, some kind of API key that's on the device. If I can get that off the device and replicate it in, you know, Python or, or in my own browser, that's something that I like to do a lot. But, uh, yeah, a lot of times it's just like making little custom Python scripts on my,

• 29:45Speaker 01

  on my desktop side to, to emulate the device and its calls. And then I can fiddle with, you know, hey, can, like, I have, I have a device on this account and a device on this account. Can device A access or make API calls as if it was device B?

• 30:02Wes Bos?

  Okay, I see.

• 30:04Speaker 01

  Yeah, that's fascinating.

• 30:06Scott Tolinski?

  What gets you inspired to look at stuff specifically? Like, how do you pick a project that you're working on? Is it just you see something and you have a question? And like you mentioned, your innate curiosity kind of takes over?

• 30:21Speaker 01

  Yeah, I guess, yeah, I guess it is that curiosity. And I'm always like looking for challenges in new industries. Right? So like, like, like right now, like this is something I haven't even made a video on yet. But I'm kind of getting interested in drone technology and drone hacking. And so then there's a whole bunch of like, skill sets that that that involves. So I might look for different devices to like, help me build a certain skill set. Right? So there's been times where I've purposely sought out devices that I think will have a certain kind of microcontroller or a certain component that I want to learn more about.

• 31:02Speaker 01

  And so I'll kind of try to cherry pick the hardware to to teach me something. Because honestly, making content, making the videos is one of the best ways that I learn. And I get better as a professional by just, yeah, trying to do something new.

• 31:20Scott Tolinski?

  Yeah.

• 31:20Wes Bos?

  What about doing more like man in the middle detection? So I'm thinking about right now, we have, I've got a fleet of these like 12 volt Fisher Price cars that our kids drive on. And we have one that's called a wild thing, where it's kind of like a little wheelchair you sit in. You have two joysticks. It I found on the side of the road in the trash and it didn't work. It was erratic. So I replaced the main like motherboard on it with a brand new one and it still didn't fix it. So I was like, oh, the the joysticks themselves have little daughter boards on them, like tiny little boards. And and I'm not at a point now where I'm like, how do I figure out what the daughter board is sending to the main board?

• 32:03Wes Bos?

  That's is that something that you dip into as well? It's not really API, it's more lower level. I think about like, the button to talk to my garage door is not simply just like a closing a loop of electricity. It's it's sending some sort of data. How would I figure out what that data is?

• 32:19Speaker 01

  Yeah, that's a great question and that is, that is stuff that I do. And the tool is going to be a logic analyzer. That's, that's going to help get you insight into those digital communications that are happening. Kind of like, like between different chips on a PCB or between two different PCBs. So, uh, yeah, so you typically a logic analyzer is what's going to help you. And, and then connecting up to the, to those lines, right? So if we go back to the, to the case of the U art console, right? Those, that's just digital communications, but there's like, there's not yet another end connected to it.

• 32:59Speaker 01

  Right? So sometimes if I'm trying to, uh, even debug a U art, uh, kind of interface. May, maybe it has a really weird, uh, baud rate, uh, like a symbol rate for, for, for how, for how fast it transmits. Sometimes then I have to go back a step. I, I, I have to set aside that USB to, to your adapter for a second. And actually connect up a logic analyzer. So the best way to think about a logic analyzer is if, if, if, if we know what a multimeter is, right? A multimeter measures voltage, right? And a multimeter is slow, right? So it's like I connected up to like a circuit.

• 33:38Speaker 01

  It might say, if I connect it up to like a U art, uh, where, where a digital signal where it's oscillating between zero volts and 3.3 volts, then a multimeter, it might like, it might like give you a little fluctuation. If there's some data being communicated, but it's going to be really slow.

• 33:56Wes Bos?

  Yeah.

• 33:56Speaker 01

  But a logic analyzer can sample a lot faster and can give you a nice, clean, kind of a square wave. That is, that represents that digital signal. And then, yeah, go ahead.

• 34:08Wes Bos?

  Is, is that what like an oscilloscope is? I see it over your shoulder right now.

• 34:13Speaker 01

  So, so yeah, no, that's, that's a great like thing to put on the spectrum because on, on the kind of spectrum of sample rate, multimeter, super low, logic analyzer kind of sits in the middle, and then oscilloscope is like super fast sample rate. So it's kind of like figuring out the right tool for the right job, but they're, they're kind of all sampling, you know, the DC voltage and giving you kind of a readout of, of what that situation is. So most of the times to, to interpret a digital signal, you don't need to go as far as an oscilloscope. Usually a logic analyzer.

• 34:51Wes Bos?

  And a logic analyzer will also record it. So you could like, I could hook it up, hit the button, or like, like, like pull the controller back and then go back and look at it and say it sent, like it sent just like highs and lows. Is that, is that what it's sending?

• 35:07Speaker 01

  Yeah, exactly. So the most common one out there that, that, that goes with us. So Salie makes a lot of very nice, they're a little more expensive, logic analyzers. You can also get little ones for like $10 that are kind of like knockoffs on Amazon and it, it will work with their software as well. It's called like Logic 2 is the name of the software. And yeah, it will give you a graph that you can, you can zoom in and out on the signals and then it will include all of these analyzers, right? So if you're like, okay, I think this is a serial communications, then you can, you can kind of add the analyzer and it will, let's say if it's like transmitting like just ASCII data back and forth, like a kind

• 35:51Speaker 01

  of that UR console situation would, you can have it interpret and, and you'll see like over a set of eight bytes, it, it can put the symbol. It can say, okay, this is the letter A that's being transmitted.

• 36:06Wes Bos?

  Oh, okay.

• 36:07Speaker 01

  If you're interpreting that correctly and you can, and that's where you can kind of test hypotheses to be like, I think this is a UR signal and I think the signal rate is this. There's also other protocols that can be used like, you know, like SPI or I squared C. There's, there's these different digital protocols that, you know, use one or more wires to communicate a digital signal.

• 36:36Wes Bos?

  Okay, cuz so GitHub Universe had a badge that was like a little PCB has a Raspberry Pi microcontroller on it. And there's a little, I only recently learned it's not I2C, it's I squared C. But that's often where you can buy like a microphone, or a little display, or something that also sends I squared C communication. It's a kind of a nice hot plug thing.

• 37:02Speaker 01

  Yeah, yeah. And so those logic analyzers are what to use when you like, like you're like, okay, I think it's using one of those well-defined protocols, but I don't know which one it is, right? It's kind of your first step to uncovering that mystery. And then, once you do that, then you can use kind of a dedicated tool that speaks whatever the protocol is. Like in our USB to Uart example, if it's a serial, if it's serial communications, that's what Uart is, right? It's a, it's a, it's a form of, it's a two-way, you know, serial asynchronous serial communications.

• 37:46Wes Bos?

  Is this what like tuners are doing in cars as well? Because in your car, you've got like an OBD port, and there's all kinds of pins on that thing. And then you can get some guy to like, tune your Dodge Ram or whatever, right, to roll coal? Is that what they're doing here?

• 38:02Speaker 01

  Yeah. And so that's, that's another protocol, more or less. But they're probably going to be, again, using a dedicated tool because they know what protocol that it, it's going to be CAN.

• 38:12Wes Bos?

  CAN bus, yes.

• 38:14Speaker 01

  Yeah, yeah. CAN is the protocol that pretty much all automotive stuff uses to communicate. So you know, your wheel sensor can communicate to the ECU and all the other components in your car can read the messages of what's going on in the car. And so that's, that's what that ODB2 port is giving you access to. So you could use a logic analyzer, but in that case, pretty much, everybody knows they're like, okay, it's going to be speaking CAN, so we can use a CAN-specific tool. The logic analyzer is the generalist tool. And then usually you, you figure out what, what, what language, what protocol those physical, those digital communications are using.

• 38:59Speaker 01

  And then you, and then you use a purpose-built tool to kind of hone in on that.

• 39:04Wes Bos?

  That's cool. I've always wondered that because in like the Tesla world, there's all these like aftermarket accessories that will like pop the passenger door open or like recline the passenger or turn the back lights on. And people just add buttons wherever they want. And it's because they're just, they're adding this little module somewhere in the can stream and I guess intercepting those requests and or sending them down the pipe if they need to.

• 39:29Speaker 01

  Yeah.

• 39:30Wes Bos?

  That's cool. Have you dug into any of the car hacking stuff yet? Or is there plenty on your bench to work on?

• 39:36Speaker 01

  Yeah, yeah, that that that hasn't been an area of focus yet. I, like I said, I'm curious about everything. So it's just a matter of managing that curiosity. Haven't gotten quite into the automotive world yet.

• 39:54Wes Bos?

  Do you have any like crazy stories of of things you've done recently that is kind of fun? Or even just like, like hardware IRL, like I, every time I see like a massage chair or like an arcade claw machine, I'm always trying to hit combinations of buttons or like trying to like reset it like I, or the the in-screen entertainment systems and the plane are always trying to hit the buttons and figure out what that is.

• 40:19Speaker 01

  Yeah, I think I had a post on X about that. I was, I was like flying back. I think it was from DEF CON and like, I was able to figure out like, like I wasn't able to get a full escape back to like the Android, but you, but like those, most of those in-screen displays are are Android.

• 40:36Speaker 01

  In fact, I like, this is a little bit of context into the the industry that I'm most familiar with, but most like security panels at home that have a nice display, not like a super old, like crappy LCD display, but a proper display on them. Those are usually running Android as well.

• 40:53Wes Bos?

  Ah, interesting.

• 40:54Speaker 01

  But, uh, yeah, those in, those in-screen displays, uh, I was able to like enter a game and then like it would, it would show the home, like the go home button. Or, or, or the, or the like, the button in Android to like access your other running applications. And you like, you could spam that really fast and like, it would escape back to the, like, just the, the app selection menu, but it didn't let you escape any further.

• 41:20Speaker 01

  Yeah.

• 41:21Wes Bos?

  Oh, that's so fascinating. I also had a post on X a while ago, asking like what these things are built in. We had a couple of people from the industry chime in as to like what they're built in. And it was, it was a really interesting read, just to get a peer into these, how all of this stuff works, especially on a plane, you know, it's, it's a fairly closed loop system, because the shows are on a drive on the plane.

• 41:43Speaker 01

  Oh, yeah. No, no, no, that stuff is, uh, is super fascinating. Yeah, with hardware, I'm always, I'm always looking around me in the world for targets. So I'm, I'm like that weird person that's like in a coffee shop and I'm like, oh, they have that brand of security camera running, you know? And, uh, but I think you mentioned my grill video, because that's, you know, I, I, I had that smart grill for probably like a couple of years and I was, and I've always been like, oh, man, I should really rip this apart, but I don't want to break my grill. Uh, so, so that, that was a fun adventure and that always leads me to like eBay, right? Like eBay is just, uh, is just a great place for me to go find a bunch of weird used, uh, in industrial technology or, or consumer technology, uh,

• 42:28Speaker 01

  to, to always hack on.

• 42:30Wes Bos?

  That's it. So tell us what you did with the grill, though. I think that was pretty interesting.

• 42:34Speaker 01

  Yeah. So, so that was, yeah, it was just a fascinating experience because first, I, again, the motivation is like, I use my grill. I don't want, I don't want to like accidentally brick my grill because I'm like trying to do firmware extraction on it.

• 42:46Wes Bos?

  Yeah.

• 42:47Speaker 01

  And so I, I, so, so I went on eBay and I found a replacement computer module that was supposed to work as a drop-in replacement for, for my grill. And so I, I, you know, I went and I started to do the analysis on that. And I was like, this, this is weird. This like doesn't properly connect out to the internet. And so then I was like, all right, I just need to go do it on my own grill. And so, and so I ripped them off and I was comparing apples to apples. And it was like a different hardware, uh, revision, which is really fascinating. So I don't know if that was like, the, the thing I bought

• 43:31Speaker 01

  on eBay was someone, uh, bought that device, you know, like that device was, uh, some kind of a development unit or some kind of a unit that didn't pass QA. And they're like, oh, I'm going to make some money by, by reselling this on eBay.

• 43:47Wes Bos?

  Yeah, I was always curious about that as well as like, how hard is it for people just to create like aftermarket boards for these things? Is that something that happens?

• 43:57Speaker 01

  Yeah, well, and then like part of the the security world that is not usually the the like security flaws that I'm looking for. Cause the these are I'm not as concerned about, but there is a lot of anti cloning work in the security community. And so, uh, so they are are trying to prevent firmware extraction, right? They're trying to or or or they're trying to put some piece of the puzzle in a place. Maybe maybe it's in some kind of internal, um, you know, storage inside of the CPU. Or it's a microcontroller where they can actually lock the debug connection and the firmware is like locked inside the microcontroller.

• 44:43Speaker 01

  And they'll do that to prevent cloners from from just, you know, reading out the firmware and then and then producing a a compatible unit.

• 44:54Wes Bos?

  Yeah, it's it's a hard thing because like part of me, like I have a CDU that's 20 years old. And you you go on AliExpress and buy an entire like computer. It's called SPI for your CDU. And for like 80 bucks, you can, if if you for some reason have blown your 20 year old computer, you know, on your CDU, you can just get a brand new one and and slap that thing in, um, which is great for like right to repair, but also awful for like someone could steal your CDU and just slap in a new, you know, slap in a new computer unit. And that thing is is untraceable now. It's a it's a tricky area.

• 45:32Speaker 01

  It it really is. And I, yeah, I've I've gotten asked those questions before and like, like, I'm not an expert. I'm I'm really interested in the whole right to repair movement. I I actually start, I would not have started my YouTube channel if it hadn't been for Lewis Rossman, actually. It for for kind of a funny reason. So I hate video editing. I'm not good at it. And so I watch, I would like watch his videos. And I'm like, this guy gets a ton of people watching border pair videos unedited, sometimes like an hour long video. And I was like, okay, so like long form content, clearly not dead. And, you know, attention spans in the hardware slash technical domain, there's an interest for that.

• 46:17Speaker 01

  So that's kind of what led me to start my YouTube channel and make it just a format where it's, it's more or less unedited and long form. So I'm, I, yeah, I, I have a lot of, lot to thank Lewis for and yeah, definitely interested in the movement. Yeah.

• 46:33Wes Bos?

  Although he did start that paperclip movement, which like the worst people that comment on our YouTube channel are all of a paperclip.

• 46:40Speaker 01

  Yeah. Oh my God.

• 46:43Speaker 01

  Okay. It's so funny because I haven't watched Lewis in like, in a while, right? Just because I, I'm busy with other stuff. And so I would see all these like paperclips in my, in my YouTube comments. And I'm like, what is going on? Are these like, is this like a bot farm?

• 46:58Wes Bos?

  Yeah, we thought it was the same guy.

• 47:00Speaker 01

  Yeah. Yeah. Yeah. And I was so, I was so confused. And then I was like, oh, and then like I, I finally like tracked it back. I'm like, oh, this is like a Lewis Rossman thing.

• 47:14Wes Bos?

  All the paperclips, please leave a comment right now. We need to see you.

• 47:21Wes Bos?

  Anything we haven't hit on that you, you'd love to cover?

• 47:25Speaker 01

  Um, no, no, this is, this is really cool. I'm just, uh, yeah, glad to get to chat and, uh, share something, uh, interesting.

• 47:34Wes Bos?

  I've got, I got one more question for you. And this is, this entire podcast is very self-serving. I only want you on so I can ask you questions directly without having to pay for your time. No, I'm just joking, but, um, so for Christmas, we're getting our kids laser tag. And as far as I understand that that's RF, um, like it sends an RF single. And I was thinking like, I want to build a nuke, um, that like, I want to build some device where I hit a button and it does RF in every direction. And just like boom, gets all the kids and they're all dead. You know, how fun would that be like? What, what would even be my first step to building something like that?

• 48:15Speaker 01

  Yeah, so this is something that I, this is a domain that I've recently started to produce some videos on. So that is going to be kind of some, yeah, some radio protocol or reverse engineering. And so a software-defined radio, an SDR, is probably going to be step one. Also, the thing is, if it's RF, you can do a lot of open source intelligence gathering through the FCC. So the FCC website, and there's like a third-party site, I think it's like FCCID.io that just like scrapes the FCC website.

• 48:52Wes Bos?

  Oh, I love it. You can see internal photos of everything.

• 48:55Speaker 01

  Exactly. Well, and the other thing they'll document on there is the frequency, the radio frequencies that are being used. And that saves you a lot of like scanning around with your SDR. If you know what it's transmitting on, then you can listen. And you're going to need an S, now to actually do the replay attack part of it. You're going to need a radio that can transmit. So the simple RTLSDR that everyone starts with, which is great. Those can only receive, they can't transmit signals. And so you're going to need something like a HackRF, maybe. And so the HackRF even has really simple programs that will record a signal and try to replay it.

• 49:36Speaker 01

  So assuming that, you know, there's not some super advanced security going on with the laser tag system. If you can just capture a signal, right, like record and then shoot and then shoot, like shoot the gun at the antenna. And then record that signal and then try to replay it and see if it has the effect that you're looking for.

• 49:59Wes Bos?

  Man, I think I have something like that. It's either RF or IR. I bought it to, I think Scott might have done this as well. We have like these like little AC units that don't have like a Wi-Fi chip in them. But you can just like point the remote at it and train it, right? I should look into that.

• 50:16Speaker 01

  Yeah, I actually got one for my projector screen. Oh, that'd be awesome.

• 50:22Scott Tolinski?

  Wes hacking to cheat at laser tag with his kids is uh

• 50:26Wes Bos?

  Definitely, definitely. And like, there's no chance it's like, like encrypted, is it?

• 50:32Speaker 01

  I highly doubt it, highly doubt it. Now, now, now what might happen is like each gun might have its own like, like a part of the signal that's different. If, if it has any kind of like scoring system, right? Because then you need to know who shot who. And so, there might be something that is encoded. I doubt it's encrypted, but there might be some part of the communications that is identifying, that's like unique to each gun. But maybe you don't care about that if you're wanting to nuke. Well, then you should do it with your gun, because you probably can't, in the system, you probably can't shoot yourself. And so, you would be immune if you captured your own gun's signal and then sent out the nuke. Yeah.

• 51:15Wes Bos?

  Oh, man. I, I think the first thing that ever got me interested in this is years ago, somebody figured out that you can take this like, kid's diary from the 90s. It was called the like, I am me, or something like that. It was like this little thing, and it had an RF transsemer, because you could go between them. But somebody figured out that you can just make it go on loop and send every garage door code out. And this was before garage doors had like rolling codes. So this was like, like, like 30 year old garage doors would just open. Which is, at our cottage, we have one, it just randomly opens and we've, we haven't pinned it down as to what it is, but it's somebody's key fob for their, like Dodge caravan or something, just causes our garage door to open.

• 51:59Speaker 01

  Yeah, that's Sammy Camcar, his work. And he's got a DEFCON talk that I highly recommend.

• 52:06Wes Bos?

  Oh, man.

• 52:06Speaker 01

  Stuff. Yeah.

• 52:07Wes Bos?

  I want to go to DEFCON.

• 52:08Speaker 01

  He's done some crazy stuff now. So he is getting into, uh, laser, uh, using lasers to transmit sound. And he had a project where he could make an Amazon Alexa unit receive audio with a laser through a window.

• 52:30Speaker 01

  So he could, so he could transmit audio through a window, like, like if it was in somebody's house, like to the Amazon Alexa and it would, the, the, the vibrations, like the, the signal that's sending through the laser.

• 52:43Wes Bos?

  Like an unmodified Alexa, they would just, the vibrations would play, oh, that's terrifying. Holy hell.

• 52:49Speaker 01

  Yeah. Yeah, he's, he's getting really deep into laser technology now. He's got some like homebrew, like, like laser technology, uh, that's like, yeah, you gotta, you gotta, you gotta wear proper eye protection.

• 53:03Wes Bos?

  So, so my last question is IOT stuff, do you have it any, that the classic thing is like, I keep my IOT next to, next to my bed with a gun. Do you run any smart home stuff after all you've seen here?

• 53:18Speaker 01

  I do, I, yeah, I'm, I'm maybe not as doomsday as like most people about it. Uh, I, I like, I've got, I don't know, like, I'm, I'm just kind of a network nerd anyway. So I do have like networks, some not, not overly like paranoid, but I do have some network segmentation that I keep.

• 53:38Wes Bos?

  Okay.

• 53:39Speaker 01

  You know, some devices on a different network. And so, um, yeah, and it's just a matter about, you know, choosing what your, your risk profile is. I, I have some devices, I don't have a lot of devices, so it's, it's, it's, it's kind of a compromise in the middle. And obviously I'm always playing around with things in my, in my kind of like test lab here, so I've, I've always got some, some weird traffic going out.

• 54:02Wes Bos?

  That's great.

• 54:04Scott Tolinski?

  Uh, Matt, that was, uh, really enlightening for me personally, considering I, I don't get my hands dirty with most of this stuff. So I, I've really, really enjoyed hearing all of this. So, uh, now is the part of the show where we get into sick pics, which is something that you're just enjoying in life right now. It could be anything from a podcast, a YouTube channel, product, whatever. Is there anything that you're just really feeling right now?

• 54:30Wes Bos?

  Yeah, so I totally forgot to tell you about this. Usually, we have like a whole document we send ahead, but I did it a different way this time.

• 54:38Speaker 01

  No, no, no. This is this is really good. So kind of my my side interest is has been business lately. So so so I've been, you know, running my my my my side business. And I've been just getting more interested in in how to run a business effectively. So reading books like Key Person of Influence by Daniel Priestley. Just yeah, just some general business books to kind of up my game in that area. Funny enough, my my undergrad is kind of in business. But it was because like management information systems like our my IT degree was in the College of Business at my college.

• 55:18Wes Bos?

  Oh, that's exactly what I went to school for. I went to school for business technology management, which is exactly like not enough coding, but more on the business side of things. But

• 55:30Speaker 01

  It was really because I didn't want to take Calc three and like all in physics. Oh, yeah. Why I why I chickened out of CS, but that's another story.

• 55:40Wes Bos?

  That's great. I have never read that one. Key Person of Influence. I can check that out.

• 55:44Speaker 01

  Yeah, and it really like I really like that book because it talks about how you can use, you know, your like, like, I'll never call myself like an influencer or whatever. But but it talks about how you can use your your public presence, your content, to build a business that kind of syncs with the rest of your life. And so the cool thing for me is I feel like it kind of follows the journey that I've gone on over the past two years. Because I made my YouTube channel. When I started my YouTube channel, I was like, if over the lifetime of the channel I get 10,000 subs, I can like be like, mission accomplished. And obviously, it like rocketed past that.

• 56:28Speaker 01

  And so that caused me to just get reached out to by businesses to be like, hey, can can you do some consulting for us? And so the business just kind of grew out of the content. And so we're gonna we're just gonna see where that goes.

• 56:44Wes Bos?

  That's awesome. How long you've been doing your YouTube?

• 56:47Speaker 01

  About two years now.

• 56:49Wes Bos?

  Holy, and you're almost at 200K subscribers. That's amazing.

• 56:52Speaker 01

  Yeah, yeah, it's it's been a wild ride.

• 56:54Wes Bos?

  Yeah, wow. Well, congrats. Thank you so much for your time today.

• 56:58Scott Tolinski?

  Oh, whoa, whoa, whoa.

• 57:00Wes Bos?

  Oh, sorry. Never mind. Go ahead, Scott.

• 57:03Scott Tolinski?

  Also, the last thing is shamelessly plugging. So is there anything you would love to plug to our audience to make them aware? So we'll link up your YouTube channel. It's a fantastic subscribe. Anything else you want to plug?

• 57:17Speaker 01

  Yeah, just if anyone is in the need for hardware pen testing, that's like the one thing that I do at my business. And so brownfindsecurity.com is where you can find info on that.

• 57:29Scott Tolinski?

  Nice. Sick.

• 57:31Wes Bos?

  Right on. And that is YouTube is just Matt Brown. It's M A T T B R W N.

• 57:36Speaker 01

  That's right. Yeah, no.

• 57:38Wes Bos?

  As well. Yeah, you can click the link in the show notes, but if you're just typing it in, you'll find it in there. Cool. Well, thanks again for all your time. This is super interesting. I appreciate all your, all your time.

• 57:48Speaker 01

  Thank you. It's been a great, great time.

• 57:51Scott Tolinski?

  Thanks, Matt.