#698 – Hardware Security with Matt Brown

Chris Gammell: This is the Amp Hour Podcast. Released July 17, 2025. Episode 698. Hardware Security with Matt Brown. Welcome to the Amp Hour. I'm Chris Gammell of Contextual Electronics.

Matt Brown: And I'm Matt Brown of Brown Find Security and the Matt Brown YouTube channel.

Chris Gammell: Hey, Matt. Welcome. Welcome to the show.

Matt Brown: It's great to be on the show and to, yeah, just have a chat about the cool world of IoT and IoT security.

Chris Gammell: Yeah. Making and breaking. Let's get into it. Yeah. So I've been following your channel for a while now and just like, I love how you're digging into stuff. One of your recent series around like your IoT smoker. I think that's like, that's great because it's like, we keep buying these off the shelf products and we think like, what the hell is going on in the hood? And you're actually looking under the hood. So maybe we could just start there. What, what, you know, what are you, what are you trying to do when you are reverse engineering, when you're digging into it, when you're trying to decompile firmware, things like that.

Matt Brown: Yeah. So, yeah, like you mentioned with the, with the charcoal smoker video, it's, it's like you can't buy some of these classes of devices, home appliances now without it having, you know, Bluetooth or wifi enabled and integrated into the device. So, uh, sometimes I make strategic, uh, home purchasing decisions around, Ooh, it'd be fun to reverse engineer this thing. But, uh, I, yeah, when, when I, when I look at one of those devices, I kind of look at it like I'm trying to get inside of the head of whoever designed it. Right. The, the, the team that built designed and built that system. And the first thing I want to do is figure out how it works. Um, there's, there's parts of, you know, like, like, I don't know if we're going to be able to define the word hacking. There's different definitions of that word, but kind of the, the original definition of, you know, hardware hacking and things like that is, is to take something apart to understand how it works and then maybe to make it do something that it wasn't intended to do. And, uh, those, those things that are unintended may or may not be security vulnerabilities. Uh, and so I, I really love taking something apart, seeing is this, does this run Linux? Is this a microcontroller? And then, uh, digging in and then always asking, you know, Hey, can I get the firmware off of this? Can I reverse engineer it? And, uh, just slowly piece by piece, I can start to unravel. Uh, how does this system tick? How does it work?

Chris Gammell: You know, the manufacturers, I don't know about you, but I, I am a cheapskate. I will buy the bottom of the barrel. And like you said, you basically don't have a choice. So now it's like, okay, I'm buying from, you know, the bottom of the barrel. It still has this stuff in there. There's some kind of cloud component to it. And like, I don't know if I trust, you know, some of the high end vendors to do this stuff. Like Jeff Geerling had that thing about the Bosch, a wifi dishwasher thing. And it's just like, I, so I don't trust the big companies, let alone the no name, small companies. And then I'm probably buying it straight out of China. That's fine. I'm okay with that. But now the stuff is transiting back to China or some random AWS instance. As you show in this video, it's just like, I don't know who's making this stuff. Right. And it matters even more than it used to.

Matt Brown: Uh, yeah, absolutely. And what's kind of funny, you mentioned a Jeff girlings video. I saw his video and then I also was in the market for a dishwasher and through complete. Coincidence. I happened to go to home Depot and buy like the same family of dishwasher. So maybe, maybe there'll be a video in the future about me taking apart my dishwasher. If, uh, if my household can withstand that when it's, when the charcoal smoker is down and out, then it's like, okay, that's mostly like a me problem. But if the dishwasher that's that, that, that, that could grind the whole household to a, to a halt.

Chris Gammell: Right. I guess you, you always have the manual method, uh, for both smoking and, uh, dishwashing, but the latter actually could take up a significant portion of every day. And I think it would be, if you take it apart, you gotta, you gotta, you gotta rectify the situation by, by hand washing those dishes.

Matt Brown: Exactly. Exactly. I actually had to use my charcoal smoker yesterday and I was like, oh yeah, I need to put the computer module back inside of it in order for this thing to work. Um, but yeah, you're, you, you made a really good point about how. Now, you know, you know, all the way, you know, up and down kind of the product, uh, space, everybody is integrating, you know, some form of IOT, some, some sort of, you know, they want their device to be a smart device because they think that that's going to get an edge in the marketplace or something like that. I do think that there's a market out there for dumb devices. Like, like, like, like, like, I think people like me would love a TV. That's not a smart TV. That's just a TV. Right. I think now you kind of have to, I was actually like looking at this the other day and it's very hard if you're looking in the consumer space. I think if you look at in the commercial space, like TVs that would go in like a business, you know, like an office space, those you can find like dumb TVs and stuff like that. But, um, it's, it's really hard in, in the kind of normal consumer market to, to find those, that device.

Chris Gammell: I think that's a good point actually, and I think that actually drives some of the, the, it's really about like money, right? It's like, uh, okay. So we have to sell into the same market. That's, you know, now we're trying to price match at the bottom of the range. How do we do it? How do we still make our margins? It's like, oh, well, this TV is now ad supported. This Amazon Kindle is now ad supported. Oh, they, they control that category, but just consumer expectations, the, you know, people sorting by lowest price first, Chris saying these, the cheapskate, right? All of these things. And then it's like, I don't know if I would pay a premium though. I don't know. Are you willing to do that to, for like dumb devices?

Matt Brown: Yeah. The, the, the TV is one I'm, I'm really starting to starting to think about, but, but, but in other, in other cases, no, like, uh, it's, it's, it's usually a non-factor, right? Like, like I want a dishwasher that washes my dishes well. And whether or not it has, you know, this smart capability, uh, the same thing with my oven, my oven is, I got a new oven. And then a few weeks later I saw that there was like a new SSID when I was like scanning around. Oh wow. And I'm like, Oh, there's just, there's just an access point. There's just an open AP that's broadcasting on this like Samsung device. Probably. It's probably for the initial setup process. A lot of times it'll open up a little wifi AP and that's how you hand it over the credentials to your network. So it can connect.

Chris Gammell: I have always, you know, I used to work at a cellular MVNO and I like, I was convinced this was now eight years ago, seven, eight years ago, but I was like convinced that device makers were going to try and like improve the consumer experience and put like a cheap cell module in there just for initial configuration. And then like, you know, just thinking about like my parents are getting older. They probably don't even know the wifi password sort of thing. It's just like, just get it set up, get it booted up. Maybe you don't keep cranking data, but you know, you give it like 50 megabytes of data for setup and troubleshooting. And then that modem is just completely dormant. And I have not seen that. Maybe, maybe you've seen it as you start cracking stuff open.

Matt Brown: I've definitely seen some cell enabled devices, but those are, they're either, they're usually for the full life cycle of the device. It's not like a, just for the setup process. And then it, and then, and then that goes dormant. Um, yeah, I, I, I, I know that cars. Nowadays, it's like hard to get a car that doesn't have, you know, a 4g modem. And even if you're not paying for, uh, the, the 4g hotspot inside of the car, the question is like, okay, well, are they sending diagnostic data back, you know, over that link or something like that? Um, yeah, it's, it's interesting, but you're, you're, you're right. And especially with, uh, yeah, like, like I also, you know, we'll go home and help parents out with, uh, technology related things.

Chris Gammell: And, uh, as nerds, it is our, it is our birth.

Matt Brown: It is, it is. It's like every, every Thanksgiving and Christmas on the holidays, right. You just know that you're like, all right, gotta, gotta get ready to, you know, clean some viruses off the computers and, uh, you know, help, help out, set up a printer or something like that.

Chris Gammell: Yeah. Actually, my, uh, my sister's boyfriend took on the, we're gonna migrate my parents to one password. And I was like, oh, like just a password manager more.

Matt Brown: And I'm just like, oh, cause then they can like share it, they can share it with you. Right. Yeah, exactly.

Chris Gammell: Yeah. Oh, I just meant like then he's gotta answer the questions. Like he's doing the right thing. It's really great of him. Nice. You're, you're outsourcing, you're outsourcing the, yeah, exactly. He's my IT group at the local, with the locals. Yeah.

Speaker ?: Yeah.

Matt Brown: Yeah. No, but you're right. There's no, there's no standards like, like with, with all this IOT stuff, right? Uh, it's almost like now we're talking about, uh, AI slop. It's like, there's, there's a lot of slop in the IOT world as well.

Chris Gammell: Uh, yeah, it's all over the place. Yeah. Well, let's, let's talk a little bit more about kind of digging under the hood on that smoker specifically. I was really interested in, you know, I'd love to talk about like, just bringing it back to best practices as well, because I work for an IOT company. Uh, I've learned a lot of things like that, things that people do well, things that people do poorly. But like, uh, one thing that stood out to me in that smoker video was they had the private keys stored in flash. Is that right?

Matt Brown: Yeah, that is.

Chris Gammell: It just seems like that's like the number one, no, no, right? That's like keys to the kingdom right there in flash.

Matt Brown: Yeah. Um, to some degree, I think it always comes down to what is your, the threat model. That's some, that's a question of security. People always like to like to go out and ask the universe. Well, what's your threat model? Uh, so with, with a charcoal smoker, uh, is, is it like one of the most security critical devices? Maybe, maybe not. Maybe, maybe not.

Matt Brown: Um, but, but you're, you're right in, in terms of like a general best practice. The question is, where are you going to store those keys? Right. So in that system, it was an ESP 32, uh, is, was, was the main, you know, chip that's, that's driving the smoker. And now I believe there is, you can do in the ESP 32. I'm, I, I was learning a lot about, uh, you know, ESP 32 hacking on this project. And so I believe it is an option in their SDK to encrypt flash, which was not the case, right? This flash was all unencrypted. And so, yeah, the private keys were stored in there. Um, but what to me was one of the even more alarming things from a life cycle, from the, from the, uh, you know, kind of device life cycle process is those keys were not rotated when I would like add the grill and then remove it and then add it to another account. Right. So, so you even have some kind of, uh, so, so, so, so it was, it was clear that those keys just stayed in there across a factory reset. And then, uh, that device ID was kind of always locked to the set of, uh, in this case, it was like, it was doing mutual TLS authentication with the AWS server. So it's a key in a certificate pair that is kind of tied to the identity of the serial number of the grill.

Chris Gammell: Okay. Well, let's, let's do define some terms too, for, you know, former hardware dummies like myself. How about that? I'll just, uh, Chris, Chris, five years. Yeah. 10, 10 years ago. Uh, so in this case, so a certificate, a key private key, public key, those sorts of things. Like what, what are these things and, and how, how would people normally be using them?

Matt Brown: Absolutely. So, so whenever you hear the words, uh, you know, private key, public key, and, or certificate, you can, you can mostly think of those as interchangeable. Those terms, certificate and private key or public key. Sorry. Uh, but, but we can, they're, they're not exactly the same, but we can think of them in that category as they're, they're two, it's a two way. Uh, well, let me back up. So, so asymmetric encryption is where you encrypt something with one key. You can decrypt it with the other, the other key. And so that with that private and public key, anything that is, uh, is encrypted with a private key can be decrypted by the public key and, and, and, and vice versa. And so the way that that is used on this grill is there is an authentication scheme, uh, in, in TLS where, where a client can authenticate themselves. They can prove that they are who they say they are by, uh, basically answering a challenge, uh, basically encrypting some piece of data with their private key. And then the server side having the corresponding public key can decrypt it. And if they find the expected value that effectively proves that the client that sent them that data, that they possess the private key. And that's how, that's how authentication is performed in this case.

Chris Gammell: And then symmetric versus asymmetric. So symmetric is both sides have a, have the same private key. Is that right?

Matt Brown: Yeah. So symmetric, you know, symmetric key encryption is sometimes called shared key encryption where, yeah, the same key is used to encrypt as well as decrypt the data.

Chris Gammell: And so, um, it says more like a username, password type of thing. Yeah.

Matt Brown: Yeah. Almost it's. Yeah, exactly. Where both sides know the same piece of C, you know, secret information. And then you always have the, you always have the question of, well, well, how do you safely distribute those, those symmetric keys to each side? Right.

Chris Gammell: So the paper, I believe, right. You write it down, put it on a sticky note right next to the, right next to the smoker. Exactly. Exactly.

Matt Brown: Exactly.

Chris Gammell: So, okay. So, so then, uh, and then just to go back to threat model real quick as well. So, so you said the threat model for this one was probably wasn't that bad, I think you said, but is it like kind of what is accessible if you do get ahold of that key? Is that, is that the threat model? Yeah.

Matt Brown: The threat model is like, what type of attacks do you consider that you're trying to defend against? I guess is, is kind of like what threat, what a threat model is. Right. So I, I, I always like to illustrate with this with like a couple examples. So, um, one is I'm, and I'm going to, I'm going to give two polar extremes of kind of like theoretical situations. And I think this always helps, uh, with the threat model question. So one, let's say there's a camera, like an IOT camera, and it's like inside of a house and it's situated in a place where it's going to see whoever approaches that camera. And it, and let's say it's really good. And it sends like an image of the person up to the cloud really fast. Right. And let's say there's a, a, a, a vulnerability where if you get physical access to this device, you can, uh, you can do something to, to completely take over the device. But first I need to get physical access to the device. Right. Um, it, it could be possible that the manufacturer of that camera would be like, yeah, but that's not in our threat model. Right. Because the, the thing that you're trying to be.

Chris Gammell: Because we loaded it up with C4 and it blows up if anyone touches it.

Matt Brown: Yeah. Yeah. Right. Um, another version. Oh, another version that I tell it that's, that's maybe a better illustration is, you know, to say like, oh, maybe there's a vulnerability where if you, if you have physical access, you can make it so that the camera can't communicate with its, its cloud server in the backend. And I always say, well, yeah, I can do that with a baseball bat too. Right. So, so, so at that point you're like, okay, maybe we don't care about that physical access threat in that case and situation. The, the polar opposite, the polar opposite example is a crypto wallet, a crypto wallet. The, the, the thing, the one thing that it's supposed to do is that if someone else gets possession to that wallet and they don't have the pin code or, or, or, or some kind of credentials to be able to decrypt your private keys on there, which effectively are storing all of your cryptocurrency, if an attacker can obtain your, your, your cryptographic private keys by having physical access to that device, the whole game is up, right? The, the, the, the threat, the, the, the, the device's threat model has been completely defeated. And so I always like to talk about those two polar extremes because there's some times where we care about physical access attacks. And there's some cases where you're like, okay, yeah, let's try to make it as hard as we can, but maybe it doesn't matter as much. So the grill, I would put it in this kind of medium position because a grill is usually stored outside. Right. And so that's usually stored outside your house. And so it's, it's maybe a little more feasible that somebody could just come and like rip the computer module out of your grill. Um, but, but also maybe you're like, eh, as long as you can't remotely attack the device, then someone might consider it secure.

Chris Gammell: I mean, I would think about getting your wifi credentials. I mean, wifi is not the most secure, but generally pretty secure. So you could get wifi credentials off of it. It seemed like you did that very easily. I'm going to say you in all these cases. I don't know if I could do this. Uh, and, uh, yeah, other than that, yeah. Then your AWS keys as well, but then what data? Uh, other than like your meat smoking patterns, uh, I'm gonna leak, uh, yeah.

Matt Brown: My, my, my secret temperature that I, that I smoke ribs at or something like that. Right.

Chris Gammell: Right. Right. Right. But, but then to put in a, a, a different spin on that, it's like, you might not say the same thing about an HVAC, cause then you could truly have like, uh, you know, how often the system's on, you can correlate with like basically being home or something like that. Right. There's, there are, there are certain correlations you can make with pieces of data that could make that data more valuable that you might not have otherwise.

Matt Brown: A hundred percent. Yeah. Yeah. People have done studies on, you know, your power usage. There's all sorts. Yeah. Yeah. These, uh, these sort of side channels to knowing if you're home or not, or if you're away on vacation. Right. There's there, there, there are some, there are some threats that could exist there for sure.

Chris Gammell: Okay. So then in this case, if this was a $5,000 smoker, uh, controller, the controller that's, that's running the smoker, what would be the best case scenario? What would be the most secure way that they should be doing this stuff?

Matt Brown: Yeah. So kind of what I would say is the, the top level of security there is that there would one be secure boot that would prevent, uh, you know, modified firmware to be upload, to be loaded onto the device. And the other thing that secure boot or E E well, okay. So like secure boot arm trusts. So there's like arm trust zone, or there are external sources of, uh, security, like a, like a TPM or some kind of a security module that is able to store, uh, cryptographic keys. And those cryptographic keys could then be used, uh, as like a secure way to encrypt the flash storage. Um, because I believe on the ESP 32, most ESP 32s there, it's like, it's inside of a shield, right? But underneath the shield of that little ESP 32 module, there is actually an external, like, like a discreet flash chip. And so even if you like disable all the debugging capabilities of the device, you can still open that up, de-solder that. Right.

Chris Gammell: Keep pencil and you're in, right?

Matt Brown: Yep.

Chris Gammell: Yeah. I've done that by accident a lot of times actually.

Matt Brown: Right. Right. And so you can, you can pull that off and you can, you know, you can put that into, into a flash reader and you can read the contents off, but, uh, if you have a different place other than that flash chip that your, your, your encryption credentials are stored that are encrypting the contents of the flash, then, uh, then you're basically requiring that an attacker have like a zero day. So here I'm kind of thinking in more of a Linux system context, cause that's actually more of my expertise, but it, you're requiring them to have some greater exploit to be able to gain access to the running system, to be able to extract those keys. Uh, and, and, and so that, that makes it a lot harder to be able to get the decrypted content in this case that would protect, you know, your wifi credentials and, uh, you know, the, the AWS keys as well on the device.

Chris Gammell: Uh, I have a piece of hardware that I've designed and this has a tech six Oh eight. And I've had that on multiple devices in the past. And that to me is like, it is a, it's a pain in the ass if I'm being honest, but it is like, so like, and one thing I never understood about it either is like, it's I squared C part. Right. I'm like, but you could just like, look at the traffic going much like that spy flash, right? Like you just look at the traffic, but I didn't quite understand kind of like how it all works, but it was kind of, you explained it before where the server sends a challenge, the private key is stored. You generate it in the chip. It never, ever leaves that chip. And then you're just doing things like you're adding the challenge into that. It spits the challenge back out. You're adding in a CSR or sorry, what is it? Like you, sorry, you trigger a CSR request, certificate, signing request, and you send that to the server. And then you get certificates back down. It's just like all this back and forth that is very, was very non-intuitive to me at first. And it's, it's very apparent why people don't do it. It is, it is a pain in the ass, you know, like, that's right.

Matt Brown: Yeah. I've actually worked with those, those chips a few times and I played around with a development board for one, uh, for a while. I never ended up doing a video on that, but that would be a fun, uh, rabbit hole to go down again. And you are, you are correct that, uh, at least by default on those chips, uh, whatever, whether it's like a CPU or like an MCU that's communicating with that secure element, uh, usually those, you know, I squared C or whatever protocol it's communicating with. Sure. Yeah. You can, you can hook up a logic analyzer and you can see all the communications. And there are a couple ways that you can add security to that. One, like you said, is using it the correct way where most of them in the SDKs, the, the private key is like, it's like right only like, like an attacker could overwrite. They could like put their, they could like, you know, they could always like erase it from

Chris Gammell: all existence. Yeah. Yeah. Yeah.

Matt Brown: They could do that. And that, and that is, that is sometimes an attack vector. Right. And another way you can think about it is that I could just pull that chip off the board and put mine, my, my, you know, secure element on there. And there is a way to encrypt the, the, like the digital signals that are going, uh, over those I scored C lines, um, and, and to effectively have some encryption and authentication. Right. And then, and then you basically have to put some kind of a hard coded, a shared, a shared key, uh, you know, symmetric, and it's doing symmetric encryption here in this case, uh, between your firmware on your MCU or on your, you know, Linux, you know, system or whatever. And then on the secure element, and that will affect you. And then you'll, and then, and then what will happen is the MCU is basically authenticating like, Hey, am I communicating with the right secure element and not an attacker secure element that they placed into there?

Chris Gammell: And that's sort of like the root of trust stuff. We've had root of trust people on here talking in the past as well. Like, how do you even know that the secure element secure, right? That's like the getting all the way to the bottom.

Matt Brown: Yeah. And, and that, and that, and that's a little bit beyond my pay grade, but I know there's all sorts of services out there where, uh, yeah, you, you can basically, you know, send them, send them your keys and they'll ship you a bunch of secure elements with them, you know, burnt, burned in there. And there are, there are verification processes that you can, that you can put it through to make sure that they're legit and that they haven't been tampered with.

Chris Gammell: Yeah. I think the other thing that confused me a little bit about all this stuff is that like, like public keys are okay to like, so now you and I are like, we're kind of project together and we have a shared server and I want to put my public key for SSH access, right? Like you could see my public key. The server can have that public key. It doesn't really matter that the public key is out there. It's just the ability to then rewind and put a new one later, right? That's kind of the main idea there.

Matt Brown: Yeah. So that's a great analogy is that, uh, in the SSH key context, right? You can, you can, you can post your public key on your website. You can give it out to the whole, whole world. And there's not a security problem with that. The security problem is if somebody that shouldn't trust a public key takes it and puts it and uses it in a trusted way. Um, and, and I actually do this in a lot of, in some videos on, on my channel where, uh, a, a device will reach out to a server and it will, it like, like if you go into your web browser and you type in google.com and you hit enter, well, what your web browser is doing is Google sends you its certificate and then it's signed by, uh, there's a root of trust, right? It's signed by a authority that your web browser or your operating system trusts. And then it verifies that chain of trust. And so, uh, but if, if someone were to trust, you know, an untrustworthy CA or in the case of the SSH key, if somebody were to just trust an attacker's public key, then it, then the system that uses that effectively uses that for authentication, right? Cause the, the SSH client is going to perform authentication because they have the private key and then, uh, they could get into that server. Uh, if, if the, if that key was trusted on the server and in a similar way, uh, if I, like I do this with IOT devices where I want to see inside of the TLS traffic, that's, that's going, that's going over the network. Um, and I actually did this in the last grill video where I did a firm, I did firmware modification because, and I replaced the CA certificate, that root of trust inside of the grills firmware with my own, that I have the corresponding private key to, which means I was able to forge a certificate for, you know, whatever the AWS.

Chris Gammell: I'm AWS now. I'm Azure now. Yeah. Yeah.

Matt Brown: And then you can use that and put that in an intercepting proxy program. And then I can intercept and see inside of that TLS traffic. In this case, it was using MQTT or if it's, you know, traditional HTTPS, then it would be HTTP inside of that tunnel.

Chris Gammell: Yeah. That's great. I think I really liked how you were showing why your shark too. I mean, just like why your shark is a kind of high level tool, people hear it, but then it's like, it just looked, I mean, honestly, it just looks like gobbledygook until you actually start applying keys and looking at the different layers. And like, there's such a rich ecosystem of just like stacks on stacks on stacks. Like, yeah, I, I'd used it for like open thread stuff in the past and just, you know, all the different layers all the way down. And then at the end is like, no, you need to decrypt this. Then you do it and it's fine. There's the data. It's great.

Matt Brown: Yeah. It's a, it's an excellent tool. That's actually the first, when I was in high school, I got my first ever like cybersecurity or computer book and it was a book on Wireshark. And, uh, and that's actually like what was, was my like first step into this world of, you know, networking and devices and things like that. So yeah, I've been using it for a while.

Chris Gammell: When you mentioned you came from the Linux space. So then like from, from your perspective and kind of, kind of moving from Linux down into smaller and smaller devices, how, I guess, are you still chasing kind of the, the Linux kind of hacking type of things as well and vulnerabilities in that space, or is it more focusing in the IOT microcontroller space? Cause that's maybe has more interest for you.

Matt Brown: I'm definitely interested in both, but there are some challenges in the hardware hacking of microcontrollers space that I've been trying to push myself into because, because it is hard and the hardest thing is with a Linux device. There's always extra, the flash, the storage is always external. And so there's always some way to read it out. Right. I just, I, I mean, I have a collection of a bunch of different kinds of firmware readers, but as long as I obtain the correct type of firmware reader, I will be able to read that firmware. Now, sometimes some of it is in, is encrypted. We talked about that. That is difficult and all. But at least I can get the stored flash content on a Linux based device because it's external to the CPU. But in the microcontroller world, sometimes microcontrollers have external flash and then you're like, yes, it's easy. I get to, I just get to do the same thing I do on a Linux based device. But when there's internal flash on the microcontroller and then, then, then you're like, okay, did they leave the debugging on? That's the first thing.

Matt Brown: And you're like, you're crossing your fingers. And for a while, my skillset was if, if they disable debugging, then I'm not going to get the firmware. Right. If, if there's not external flash or if they, you know, if they don't lock out the lock out the debugging, then I'm not going to get the firmware. And that's where, uh, fault injection comes, comes into play to, uh, attacks against certain microcontrollers and certain microcontroller families to, uh, to glitch the device into a state that will divulge that firmware. Okay. So that's something I've just been starting to learn more about.

Chris Gammell: In both these cases then. So you have the firmware just to stick in the Linux space for a second. So you, so you, you were able to dump these, you have, you get a full file system dump. It's say it's unencrypted. Like, do you still have to decompile at that point? Or is it more like just a file system read and you can start to see what's like, cause maybe they're scripting or something in there.

Matt Brown: It, it really depends on the device, but most of the time it's gonna, it's gonna involve binary reverse engineering in. In, you know, Ghidra, uh, in, in IDA pro something like that. Right. Uh, so most of the time you'll dump the firmware and it'll, it'll, it's just, you just get one, you know, blob of data from that firmware dump. And then it's gonna involve usually using something like bin walk to try to automatically extract file systems and things like that out. Um, sometimes if I, if I do have, uh, a basic kind of UART terminal. Connection to that Linux device. Most of the time Linux on boot. In the boot up logs, it'll print out the partition table, uh, and kind of all the offsets. Right. And so you can then use that and, and kind of use the DD program to, uh, carefully carve out each of the file systems from that image that you've dumped. And then you can man, and, and sometimes bin walk the, the automatic firmware extraction will fail. And sometimes you kind of have to go to this more manual route. But then once you get a file system, once you, you have like a folder structure that has, you know, your, your, you always get that little dopamine rush when it unpacks correctly. And you see like Etsy, you know, user, var, you know, you, you, you, you, you, all, all the telltale signs of your, your, your route. Give me a bin. Give me a bin. Give me a bin. Give me a bin. Exactly. Exactly. And then it's like, okay, where are the binaries on the system? And of course it's probably going to have, you know, busy box and all of your typical Linux commands. And those are the things you don't really care about. You want the, the custom software, right. That, that runs the web server or something like that. And so usually I I've seen a couple IOT devices that run like Python. You mentioned like, can you just get scripts and things like that? And there will be bash there. There definitely will be bash scripts that will perform, you know, device initialization and things like that. And so some devices use more bash than, than others, but usually you get to a point where there's a binary and that's the binary that runs the web service or whatever other service on the device. And then you need to load that, that binary into some reverse engineering tool to start to decompile it and to look for the stuff you're interested in.

Chris Gammell: Yeah. And so like, uh, just to tie it back to your video. So like you have about a couple of security cameras and some security cameras, usually Linux space.

Matt Brown: Is that, is that a, I would say 99% of the time I've seen a couple of them that are lower power. It, I, I guess the, the, the real thumb is if it's battery powered, it's, it's 50, 50. There are some battery powered Linux devices, but most of the time, how big a battery talking here, right?

Chris Gammell: Yeah. Yeah. Yeah. Right.

Matt Brown: Right. There's, there's some pretty cool ones out there that will like sit in a low power state and then there'll be some MCU powered, uh, like, uh, motion detection, motion detection or an AI algorithm. And then it'll flip to the, to the, to the Linux side after that. But, uh, for the most part, it's going to be one or the other. And most, most cameras are just Linux based. Yeah. That makes sense.

Chris Gammell: Okay. Yeah. I mean, just the data throughput and stuff like that, it would probably be, well, we, we talked before the show, like, I think some of the newer parts are definitely getting into that space. Like I was talking about NXPs, you know, kind of mid range stuff, but they still, it's the, it's still kind of messy in that messy middle, you know?

Matt Brown: It is. And there, and there are, I think the way to do it is that there is a lot of custom silicon out there that you see in the, especially in the video space. And so if you were going to do a microcontroller, you would probably have, uh, a very specialized chip that had a video and K encoding capabilities, uh, that where you didn't have to like run it in your kind of general code that where there was special, uh, silicon or even an external kind of component on the board that would handle that encoding. And that's probably how you would, how you would end up being able to pull that off on a microcontroller based device. Okay.

Chris Gammell: So then best practices, Linux devices, microcontroller devices, seems like still encrypting flash. That seems like a, a good plan. Yeah. Turning off debugging. It's things that make Matt mad are probably good things for product decisions. Don't expose J tag, hydrogue arts.

Matt Brown: Exactly. Exactly. And there, and there are starting to be some regulations that are coming definitely out of Europe that are, that I think are gonna, are gonna push device manufacturers, uh, even the unwilling ones in that, in that direction.

Chris Gammell: Is that like CRA? Yeah. CRA.

Matt Brown: And it's like the EU red is like the governing body. I, I, I, I feign ignorance a little bit on it, but I've, uh, I've observed it from afar. The things that are going on there.

Chris Gammell: It's like, well, I mean, it's, it's like, uh, you know, you gotta, you gotta pay attention because it's good. Otherwise it's gonna smack you up inside the head at some point and be like, oh yeah, we should've been looking out for that one. Yeah. You know, like, especially as a product maker, I feel like it's probably that they're probably pushed much more than someone doing the vulnerability testing. But then at the end of the checklist is probably like, and CRA, you know, like, are you paying attention to that? Yeah. That'd be just across the devices that you, you look at, are you seeing stuff go one direction or another? Is there more Linux stuff? Is there more microcontroller stuff? I mean, micros are getting more capable, but maybe that doesn't mean, maybe it's still just product decisions and constraints.

Matt Brown: Yeah. I think like that, that, that battery powered thing, I, that's just, that's just my gut of what I've seen in terms of devices that I've taken apart over on my workbench is that there are a ton of cool new, uh, devices that communicate that are either like Bluetooth or Bluetooth only. I think a lot of times, and this is obviously not strictly the case, but a lot of the times, if it has wifi, then it's more likely to be a Linux device. But if it's just Bluetooth or Zigbee or Z-Wave, some of these, uh, short, you know, short range or even, you know, medium to long range, uh, RF, you know, communication devices. Yeah. Yeah. Yeah. Laura, those are oftentimes microcontroller based devices again, because they just want it to kind of sip power and be bad and, and, you know, be powered off of a battery. And so I think that's where the market is kind of segmenting, but on the other side, there's this demand for AI on the edge that, that I think has a big play, right? Cause AI and ML on, on these devices, it used to be that that data got shipped off to some backend server with a bunch of GPUs in it. And then it would do all of that. And maybe you'd get your, you know, your security notification, uh, you know, it'd be five or 10 seconds after the event happened. Well, people don't want that. They want, they want, they want stuff to happen quick. Right. And so everybody's trying to put their AI stuff on the edge on these embedded devices. And so I think there's some devices where that might be the reason why they're still running like a heavier Linux based system. Um, because they're like, well, it's already consuming a bunch of power or, or they, they, they, they, they need those compute cycles to, to do all this, uh, to support these features that the market is demanding.

Chris Gammell: The power envelope thing is, is, uh, is a good, as a suit, astute observation for sure. Um, do you find, I'm not sure how you're judging kind of the quote unquote value of these things to you as a security researcher, but are Linux based devices more likely to have like vulnerabilities that are again, quote unquote worth more, um, to, to people like you?

Matt Brown: I think so because they are typically, or I think wifi is the bit once, once it has like an IP address, right. And it's a Linux based device. There's oftentimes just a bigger attack surface. Cause if I can attack something over the network, uh, if we think about the, the, there's this, uh, risk scoring system, the CVSS, and I do not know what that acronym stands for, but, but it's, it's kind of the, the, the de facto standard for risk scoring a security vulnerability. And the first thing that you fill out in the little calculator is the attack vector. And I believe the categories, if I can, there's remote, can you, can, can you exploit this remotely over the internet? Uh, and then that, that's going to obviously, uh, impact the risk score the most, right. If, if it's a remote attack and then there is local. Okay. So, okay. I have to be on the, I have to be on like a local network. I can't do it over the internet, but, uh, uh, maybe, maybe I'm on the same subnet as, as the other device. Okay. That's the next highest level of risk. Uh, and then you have adjacent, which is a lot of times where us IOT security researchers live. And that's like, can I exploit it over a, a radio, uh, some kind of RF based protocol, Bluetooth, Wi-Fi kind of all falls in that category. And then the last one is physical. I have to physically get my hands on the device in order to, uh, perform the attack in, in question. And so I think Linux based devices, just because people use all of the, all of the plethora of open source tools and the SDKs and the defaults, uh, that are available. Yeah. That's why I feel like there's higher risk volumes that sit on those systems because they tend to be, you know, more often remotely or locally exploitable instead of adjacent and physical.

Chris Gammell: I always think about like the, the fish tank that was like, you know, turned into a botnet or something like that. Right. Like the, or the refrigerator remote. Yeah. Yeah, exactly. Yeah. Yeah. Silicon Valley style. Like, uh, yeah. Uh, yeah. I think just something that could be used to zombie it to do something useful for that, for the person who has the vulnerability in hand, aside from just the account access and the, you know, there's the data access, I guess, image access in the case of a camera. So like, silly, for example, with the smoker, if someone did have access to that somehow remotely, would they be able to then use that to hop onto your network and maybe get to another device? Is that ever a possibility?

Matt Brown: That's sometimes a possibility. And I think it's just way more feasible on a Linux based device, uh, because on a microcontroller, it's, it's always a question of like, well, how, how do I get, how do I get remote code execution on one of those systems? There's just the path, the path to that kind of, uh, access is usually pretty difficult. But if we set that aside, yes, if, if you had remotely, if you could remotely execute code on the ESP 32, that's on my smoker, well, that smoker, when it's functioning and when it's not malfunctioning, uh, and, and when it disconnects from my wifi network all the time, but if it was, if it's properly connected, uh, to your wifi network, then yes, they could hop onto that, onto that network and then start attacking other devices. But yeah, you made a really good remote code is like the ultimate.

Chris Gammell: That's like the ultimate prize to be won.

Matt Brown: That, that, that is remote code execution is, yeah, it is the Holy grail. It's, it's on that scoring system that I mentioned that is always going to kind of land you into the, into the critical category of, of a vulnerability, uh, which, uh, I mean, that, that, that, that means a bunch of different things to a bunch of different people. Uh, like we were talking about before the show, I do, but I do a little bit of bug bounty. And so that, that typically translates in the bug bounty world into dollars, right? It's you're, you're, you're gonna get paid more for that vulnerability. But, uh, yeah, cause that, that usually means that you have full control over the device. You can, you can do effectively whatever, uh, you want to do on that device. Now, sometimes, uh, you might, you might get code execution, but you might be running as a lower privileged user, but, uh, a lot of the Linux IoT devices out there, everything runs as root. And so that's right.

Chris Gammell: Yeah.

Matt Brown: And so I have this, I have this running joke with everyone in the IoT world, uh, a privilege escalation isn't really that big of a deal because, uh, once you get code execution, you don't need to elevate your privileges from some lower privilege user up to root. You're just all, you're just already root.

Chris Gammell: So what about in the, uh, you'd mentioned kind of Bluetooth access, remote access over RF, and you've been, you had a really great video about the, uh, SDR stuff, but I'm kind of just curious about Bluetooth specifically. Cause I'm doing more of it these days. Like what are the things you see in that space that are good, bad, ugly? Yeah.

Matt Brown: So Bluetooth, especially Bluetooth, low energy is, uh, there, there's a lot of stuff that can go wrong with that. Bluetooth low energy is obviously it's way more user friendly, uh, built into the protocol is the ability to enumerate all of the services that a device has on offer. And so, uh, there is an app that is called NRF connect that you can download on iOS or Android, and you can just scan and you can see all of the Bluetooth low energy devices around you that are broadcasting constantly. And are advertising the services that, that they offer. And so, and then usually you can just happily connect to those devices and, uh, you can start, you know, re you know, and then the services all have these properties, which are, are, are more or less like permissions. And so they're, they're like things like read or write or, or notify, which is effectively like a, uh, it's like a pub sub, uh, type of, uh, a situation there. And so you can, you can enumerate all these services and then you can start trying to read or write now, maybe, you know, maybe there will be some kind of, uh, you know, protections in place. Uh, oftentimes what you'll see is that, uh, device manufacturers that have some existing type of serial protocol that they've already designed some binary protocol, they'll effectively implement that over Bluetooth low energy. Uh, there is no, there's no, uh, property. There's no way in Bluetooth low energy natively to do asynchronous communications, but you can effectively achieve it by using that notify service to receive data back from the device and the right service to send data to the device. And so oftentimes what I will find is I will basically get to a point where I'm reversing some binary, some custom binary protocol over Bluetooth in order to see if a device is vulnerable or not. Because, uh, basically I'll, you know, on my phone or using a Bluetooth sniffer, I'll, you know, get some packets that are going back, back and forth between, uh, two Bluetooth devices. And, and, and then, and then that's effectively what you see is you see a bunch of rights and you see a bunch of notifies on, and you you're like, okay, this is some kind of a binary protocol back and forth between the client and the server. And then you need to figure out how that works. And can I then connect to the device and send the same messages, uh, and, and, and, and affect the device in some bad way.

Chris Gammell: Yeah. That's it. It is interesting to, to kind of visualize it as like, if you just had an RXTX line going out like to a, you know, device, you know, a hundred feet away, it's like, oh, that's, it's like that except it's way easier to listen in than like putting a current clamp around those wires, you know, it's like, oh yeah. All right. And then, I mean, what are some of the things that you're able to do? So I, I'm looking at, you know, of course your, your videos, it looks like you have a scale scales are, so you're able to get like scale readings.

Matt Brown: Uh, yeah. So on the scale, I ended up reverse engineering the Android app that, that, so, so most of the time for all of these IOT devices, the client is a mobile phone, right? Cause it, with most of these devices, it's you had, there's some app that they have you download and then it connects to the device over Bluetooth. And so with that scale, I found that, you know, you go a million layers deep and there was some hard coded key, some hard coded symmetric key that is effectively being used as the authentication mechanism. And it was hard coded into the Android app, right? So it's not unique per, uh, device and client relationship, right?

Chris Gammell: So then like anyone buys any scale, it's always the same password. Basically.

Matt Brown: Exactly. And so I found that on the scale. So the scale had this feature that you could, that you could hop onto the scale. It let's say you left your phone in the other room and it were, or it was turned off or something. You could step on the scale and it would take your readings. And then you step off and the scale actually kind of has this, this pro you, you add your profile to it and the scale would actually know who you are based on like, you know, all the properties and the readings that it was taking. And so, and so it would store that data locally on the scale until the phone would come by later and sync and pull the data off of the scale. So what I found I was able to do is, is I was able to extract the data off of the scale that was being stored. Uh, again, authenticating with those hard coded credentials and performing a very esoteric encryption, you know, custom, it was a bunch of security through obscurity. Uh, where, where using that hard coded key, doing some really obscure encryption. And then, and then you send the right, you know, and then again, it was one of these write and notify in, in, in the Bluetooth space. And you just have to send the right message and then it will send back a message that meant you authenticated correctly. And then I could, and then after that I could send the requests to, to retrieve the data off the scale. Yeah.

Chris Gammell: That's what that's wild. Uh, I, I mean, so they're definitely security by obscurity. Like that is very common. It feels like in a lot of anything with an RF, they're like, oh, who would possibly, and it's like, well, Matt would, uh, among others. Right. I mean, like, yeah. And, and then I, I've talked about this on the show before. I I'm just flabbergasted at some of the things that are just like, well, nobody cares about this data. So like my toothbrush, like my toothbrush has Bluetooth and then like, so hook it into home assistant. It was literally like, I see a toothbrush. You want to claim this toothbrush? I'm like, yeah. Okay. I guess that's my toothbrush. And then it was like, Chris is brushing his teeth at 10 33 PM. And it was like, so Chris is home right now. Like this is broadcasting the world. And it was across my house, you know, just like, wow, what the hell, man? Yeah. It's the oral bead by the way, if you want to check that one out.

Matt Brown: Yeah. Yeah. Yeah. I actually, uh, for, for like a private client, I have tested, not, not, not that device, but I have tested a smart toothbrush before. They're a fascinating product line. I, yeah, I do not own a smart toothbrush. I own a lot of other smart devices, but not, not a toothbrush.

Chris Gammell: I just want an electric toothbrush. You can't buy them without this anymore. Like literally after, like, I think it's just, you know, maybe here's the business we start, Matt is Faraday cages for anything, you know, like phone, phone covers. Yes. It's like that same thing. You just make Faraday cages in every shape and size, and you just really get good at Faraday.

Matt Brown: Or, or something that like you, you, it's like a mold that you like that you form around your device and then it stays in that. Yeah. Yeah. Yeah. Yeah. I like this.

Chris Gammell: I like it. There's probably a business in there somewhere or, you know, like, uh, Faraday cages are us. Uh, I guess, uh, I think in, in that specific scenario, it's like, it doesn't seem like that valuable of data, but there is probably something there, you know, maybe not valuable enough to have a bug bounty on it or whatever, but, uh, I don't know, man.

Matt Brown: Yeah. And, and, and what I always tell people who kind of make that kind of argument of like, oh, I don't have anything to hide or, or I'm not concerned about this data. It's that there's probably somebody out there, some, you know, a journalist, a dignitary, right? Like, like there are people, and, and this gets back to that question of threat model. So devices can have threat models and then people can have threat models. And so some people have different levels of threats with different amounts of resources to go after, go after you. So it might not matter for like, you know, average Joe, but it might matter for somebody who's yeah, a little bit more, uh, important or has people out there that want to do them wrong. Yeah, exactly. Yeah. Yeah. Well, what about other,

Chris Gammell: uh, things, things that you use in your everyday? I mean, uh, so you mentioned Ghidra, you'd mention, I have these written down somewhere here, Ghidra, IDA pro something else, but like, those are software tools, right? What about like hardware tools, other things that you find that are useful? Like what's, what's in your toolkit that people listening might want to,

Matt Brown: to emulate? Yeah. So one that I have here is my, my ex Geku firmware reader. This is, uh, this is like probably the best, uh, price to value firmware reader that's out there on the market. And it's, it's, it's a Chinese device and it's got okay. Windows software for it. That's a, it's, it's a little finicky. Sometimes I definitely run it on a burner laptop. I would suggest that everybody do that. And, uh, that's isolated and doesn't have any of my other data on it, but, but it is a, like, like you just can't argue with the amount of chips, right? Because with these firmware readers, there are some that will sell you the reader for a big chunk of change, and then they will nickel and dime you for every, uh, every little reader. So this is a kind of a plugin system, a generic interface. And then there are all types of sockets to fit the, the, the million different packages of, of flash chips that are out there in the world. And so this tool really is, is my go-to and it is, um, it's by far the best there. There are some chips that it can't read. And then that's why I have a whole collection of other readers, but the X Geku, uh, this is the T 76. There's the T 56 and the older like T 48, but they're, they're, they're all really solid

Chris Gammell: firmware readers. Well, then you mentioned, uh, side channel type stuff. So you're using stuff for

Matt Brown: doing side channel attacks and stuff as well. Um, so, okay. So I have not yet gotten into side channel attacks yet. I've been doing some voltage glitching and for that, I actually have, uh, well, oh, and, and I've been doing, uh, also lately I've been exploring a little bit more. So there's voltage glitching and then there's also like electromagnetic, uh, like there's, there, there's like, you know, kind of like where you're sending like an EMP pulse, uh, effectively, uh, to the device. And so for that I have the Pico EMP and then I also have, I, I forget the name of, of the voltage glitcher, uh, that I have. And yeah, I, I, I can, I can give you that. I can give you that and we can put it in

Chris Gammell: the show notes. Okay. That's no problem. Um, yeah, we've, we've talked about other ones like, you know, chip whisperer on the past, just like one example that's like that. So yeah. Okay, cool. Uh, it seems like probes are a big one for you. It looks like you had the, the same,

Matt Brown: same ones that the, yeah. So the PC bite probes, those are, those are huge. And then I've had a number of different logic analyzers. I do have a Saley, uh, logic analyzer now that's kind of like the big brand name one. And, and, and, and you can't, you can't argue with the quality they do make, they do make really good equipment. Uh, there's obviously cheaper options out there that are knockoffs. Uh, and I've used those before and most of the time they work okay, but, but the Saley equipment is just very high quality and I really like that, that stuff. So what about other software thing?

Chris Gammell: I mean, I guess SDR is kind of just a, uh, recent example that you've been doing more SDR stuff as

Matt Brown: well. So that was a really interesting one. Yeah. So I, I recently acquired a USRP, the, the, the Edis brand, uh, or the, the model number is the B200. Uh, I have the NI version, but it's, it's, it's effectively a B200 software defined radio. And I've been, I've been doing some fun messing around with a, a dog shock collar. And, uh, I've also been trying to, uh, you know, demodulate and sniff Laura as well, just as a fun, as a fun exercise with that. But, uh, using GNU radio, trying to, trying to teach myself to make my own GNU radio graphs, which is definitely a learning curve, but I've got some good, I've got some good contacts that, uh, in the kind of RF space that are helping me out with that, which I am very thankful for. Yeah. Yeah. GNU radio,

Chris Gammell: the first time I was using it, I think it was with an SDR as well. Just like a simple, like one of the, the little dongle ones. And, uh, I just remember being like, I had, I had no idea what I was doing with like, just, just the installation process that had me running, running for the hills. So, it, uh, but yeah, then you can do a ton with it and you can really try a lot of stuff, you know, all the different, uh, modulation methods and things like that. So that's,

Matt Brown: yeah. And then the other software defined radio tool that I've gotten a lot of value out is universal radio hacker. And that allows you to, you know, record signals and then it's got some basic, uh, demodulation capabilities. So, uh, in my recent video, it was able to D logic modulate, uh, the FSK, uh, modulation that the dog shot color had. And then I was able to actually, you know, get ones and zeros and, uh, actually decode the packet structure that was being communicated over the air. And the cool thing was, is I could actually validate that I was demodulating and decoding everything correctly. Cause the dog shot color had like a level, a value of like, you know, one through 12 that I could set the little buzz. Uh, it does shock, but then there's also like a vibrate method if you don't want to shock your

Chris Gammell: dog and things like that. Yeah. Um, I mean, I was watching that and that was the, that's the exact same receiver as the ones that are the invisible fence. It's like, they just make the same kind and then it's like a handheld or the invisible fence. And then it's, you know, that sort of thing.

Matt Brown: Right. Right. But it was, it was really cool because I'm new to all of this RF stuff that I was able to confirm that I was D I was, I was not crazy and that I was doing the demodulation correctly. Cause I was actually able to see as I changed my transmitter level, I could see the, the number that I was decoding in a certain spot in, in the binary protocol that I could actually see that number incrementing by one. And that was just like, it's really fulfilling when you're learning something new, especially in the reverse engineering, reverse engineering world, when you have like multiple unknown variables that you're trying to kind of account for at the same time, and then you get something right. It kind of confirms your suspicions all the way in reverse that you kind of built upon.

Chris Gammell: So that was cool. Yeah. It's like finding the corner piece on a puzzle, huh? Exactly. Exactly. I'd love to just dig into that real quick. The, I do not have the stick to it in this, that it sounds like you definitely have. And it seems like it's like part and parcel of the security industry. Like the ability to just like, look at the same packet over and over again and find these decoding tools and stuff like it. Do you have any tips for a impatient person like me, a child of the internet as it were, how do you like, it sounds like you get dopamine hits from the finding it. So that,

Matt Brown: that sounds good. But what I do, I do. And I, so, so what's really funny about it for me is since I've started making YouTube videos, I think, and this is personally something about myself probably, is that I learn a lot and I push myself when I want to teach others something. So, uh, one of the cool things about my YouTube channel is sometimes I'll make a video about something that I'm brand new too. Now there's some of the topics that I, that I, that I teach and make videos about where I do feel like on like, especially the Linux attacking Linux devices, I feel like that's my, that that's my jam. That's what I'm really good at. But with this RF stuff, it's brand new and I'm learning a bunch of stuff and I just like to be open with people about that. But making the video pushes me to be like, okay, I gotta, I gotta figure this out or, uh, or there's not going to be a next video in the series sometimes. Uh, so, so after the first video, I was like, I was trying to do this replay attack and it wasn't working. And so actually yesterday I was, I was kind of like, okay, I need to get this to work. I needed to get this to work. And yeah, maybe it's the dopamine hit the, the, just, uh, of figuring things out and, and figuring out how stuff works that I really, uh, drives me to get stuff done.

Chris Gammell: Yeah. That's great. That's great. No, I think it's, it's paying off, man. Like it's, uh, I feel like, and then like that, you know, almost like that social contract of like the, you're saying you're going to do this thing and then like wanting to deliver on it. It's like, uh, I think then it's people listening might be like, all right, I guess I got to start a YouTube channel too. So

Matt Brown: it's interesting. So I just came back from the hardware IO conference and people that like speak and present at conferences, there, there's this one person that said like, yeah, like I really wanted to do this thing. And so I submitted a talk that like, and then, and then that maybe they hadn't like, you know, done all the pre-work yet to make sure that this thing would work. And then that like forced themselves, right? You're right. It's the social contract. It's like the commitment to something, uh, helps you to, uh, stay focused and accomplish it sometimes.

Chris Gammell: Yeah. I mean, uh, they only ask for abstracts. They don't ask for any proof that it works. Right. Exactly. I may have submitted abstracts to things that didn't work yet. Uh, yeah. And then, and then there's always that subtle move, you know, it was like where it literally didn't work and then it's lessons learned. Yeah. Yeah. Yeah. You need to change the title just, just slightly. Yeah. Yeah. How, how was a hardware? How was that conference? Is it worth going to it? It's, it's, it's kind of become my favorite

Matt Brown: conference and that's just because I, I, I, I do go to DEF CON. I'm going to go to DEF CON this year. DEF CON is the big conference in Las Vegas and there's just lots of people and it's a very wide breadth of interests that are at DEF CON, right? The cyber security space is so big and so vast, but hardware IO is cool because in the hardware security world, it's a really small world. It's like, like everybody knows each other. It's a very tight knit community. Uh, we, they, they all chat

Chris Gammell: and talk to each other. It's I try and get them on the podcast. Yeah. Right. Right. And so it was just a,

Matt Brown: a really cool to be among people that share the same passions and stuff like that. It's just, it was just a lot more focused and I would, I would draw the analogy to that whole conference. It's like going at DEF CON to the villages at DEF CON. There are these villages, which are kind of topic focused areas, right? There's the IOT village. There's the hardware hacking village. There's the social engineering village, right? There's a vast array of, of things to do focused around a specific interest or skillset or S or, you know, kind of subcategory within the cyber security world and hardware IO. It's just all the hardware security people in one place for, you know, three days of training and two days of a conference. And it was a blast.

Chris Gammell: It's been a couple of years now since I've been back to DEF CON and just thinking about it now, I'm just like one, the heat. And I'm like, Oh God. And then, but then like, yeah, just the crowds and the people. And it's like, it's so much fun, but it's, it's, it's own thing. You know, it's its own thing. It is. Yeah. What's your, what is the, where would people, maybe this is a good way to end. Uh, where should people find you both at DEF CON this year, if they were looking to find you and, uh, you know, and say hi and tell them how much you like your videos and then also online. How can people find you?

Matt Brown: Yeah. So at DEF CON, I will actually be doing a demo in the embedded systems village. And so we're going to be doing some, uh, EMMC chip off and, uh, firmware modification and then doing BGA reballing. Uh, again, this is one of these things where you, you commit to it ahead of time. We're like, okay, I really got to do this in front of people. We're going to be doing BGA reballing, uh, live, live, right? A live demo. Nothing could go wrong. Uh, but that's, that's where you can find me at the embedded systems village at DEF CON and online. My YouTube channel is, uh, you just, you just type Matt Brown into, into, into YouTube. And I'm the first one there. I'm not the UFC fighter, Matt Brown,

Chris Gammell: uh, but the other guy. Yeah. Okay. Yeah. He hacks on other stuff. Yeah. He hacks on people's ends in their shoulder bones and they're yeah. Yeah. And then you have a new, uh, IOT security newsletter that you're also starting up. Yeah. So I'm, I'm starting,

Matt Brown: I'm going to be shooting out, uh, the first post soon of my newsletter, the IOT security digest. And this is just going to be a place where I share my unique take on IOT security news, educational resources, tools in the open source community. And, uh, just kind of in that, in that spirit of sharing. Uh, so yeah, I'm signed up cause I want to know when something pops up in

Chris Gammell: this industry that I need to know about. It's just like, Oh, Oh, that's new. Yeah. Okay. Watch out. Watch out. Well, thank you, Matt. Thank you for being here. And, uh, thanks for your great videos. I always, I always, uh, look forward to your, your next one. So please keep up the good work and, uh, yeah, I'll come back anytime. Thanks for having me.

Speaker ?: Uh,