This podcast episode centers on the exploration of hardware hacking, emphasizing the significance of continuous learning and community engagement within the hacker culture. I am joined by the esteemed Joe Grand, a prominent figure in the hardware hacking domain, who shares his extensive knowledge and experiences. Throughout our conversation, we elucidate the importance of collaboration and mentorship as pivotal elements that foster innovation and drive progress in the field. Grand reflects on his own journey, highlighting the challenges and triumphs he has encountered, ultimately inspiring listeners to embrace their curiosity and pursue their passions in technology. As we delve into the nuances of hacking and security, we hope to ignite a fervor for exploration and knowledge-sharing among our audience.

In this episode, Joe Carson interviews Joe Grand, a renowned hardware hacker and educator. They discuss Joe Grand's journey into hacking, the importance of community and collaboration in the field, and the evolution of technology and security challenges over the years. Joe shares his early experiences with computers, his transition from engineering to hardware hacking, and the pivotal role of the Loft in shaping his career. The conversation also touches on the founding of @Stake (ATstake, Inc.) and the challenges of balancing passion with corporate expectations in the cybersecurity industry.

In this conversation, Joe Grand discusses his journey in the hacking community, including his experiences designing badges for Defcon, the importance of artistic engineering, and the impact of live hacking events. He shares insights on parenting in the digital age, the significance of legacy software security, and the challenges of vendor communication. Joe also highlights his current projects, the learning process through failure, and resources for aspiring hackers, culminating in a discussion about his involvement in a film related to cryptocurrency.

Takeaways

• Community and collaboration are vital in the hacking world.
• Hacking is a continuous learning process; you never know everything.
• Early experiences with computers often start with games and curiosity.
• The Loft provided a transformative experience for Joe Grand.
• Transitioning from engineering to hacking can be a natural progression.
• AtStake was a significant step in Joe's career, merging hacking with business.
• Finding purpose in teaching others about hardware hacking is fulfilling.
• The importance of viewing security from an adversarial perspective.
• Hacking and engineering can complement each other in unique ways. Joe Grand returned to design the Defcon badge after years away.
• He emphasizes the blend of art and engineering in hacking.
• Live events showcase the real-time problem-solving process in hacking.
• Parenting involves guiding children through the digital landscape.
• Not all hacks need to be groundbreaking to be significant.
• Legacy software security remains a critical issue.
• Effective communication between vendors and hackers is essential.
• Current projects focus on refining fault injection techniques.
• Learning through failure is a vital part of the hacking process.
• Documentation is crucial for replicating and building on work.

Chapters

• 00:00 Introduction to the Podcast and Guest
• 01:43 The Journey of a Hardware Hacker
• 05:16 The Importance of Community in Hacking
• 09:50 Early Experiences and Hacker Origins
• 14:41 Transitioning from Engineering to Hardware Hacking
• 18:16 The Loft: A Transformational Experience
• 23:51 From Passion to Career: The AtStake Journey
• 30:56 Finding Purpose in Teaching and Hacking
• 33:21 Reviving the Defcon Badge Design
• 34:47 Exploring Artistic Engineering in Hacking
• 35:44 The Impact of Live Hacking Events
• 37:33 Parenting in the Digital Age
• 39:28 Lessons from Hacking Time
• 42:48 The Importance of Legacy Software Security
• 46:37 Vendor Communication and Security
• 48:58 Current Projects and Future Directions
• 51:51 Learning Through Failure
• 54:54 Resources for Aspiring Hackers
• 58:56 The Intersection of Hacking and Film

Additional Resources:

https://grandideastudio.com/

https://www.youtube.com/watch?v=o5IySpAkThg

https://www.imdb.com/title/tt27307826/

The latest episode features an in-depth conversation with Joe Grand, a prominent figure in the realm of hardware hacking. Grand, who is affectionately known in the community as 'kingpin', shares his extensive journey from a curious young hacker to a seasoned professional dedicated to teaching and inspiring others in the field. The discussion is rich with insights about the evolution of hacking culture, the significance of community engagement at conferences, and the intrinsic motivations that fuel a hacker's passion for exploration and innovation. Throughout the dialogue, Grand emphasizes the importance of continuous learning and adaptation in a rapidly changing technological landscape, noting that the challenges faced by hackers today echo those from decades past. This episode serves as a testament to the resilience of the hacker community and the collaborative spirit that drives individuals to share knowledge and skills, ultimately fostering a safer digital environment for all.

Takeaways:

• The podcast explores the journeys of individuals in the hardware hacking community, emphasizing the importance of sharing knowledge and experiences.
• Listeners are encouraged to attend conferences and engage with fellow hackers to enhance their learning and stay inspired.
• The discussion highlights the significance of community support in overcoming challenges encountered in the hacking and engineering fields.
• Throughout the episode, the speakers reflect on the evolution of technology and the recurring security issues that arise with new innovations.

Hello, everyone. It's awesome to have you back for another episode.

And as always, I'm always looking for awesome, you know, amazing people in the industry to bring their knowledge and share stories with you, to keep you educated, keep you passionate. And, you know, if you're kind of looking for another area to expand into, this is always a great possibility for you to learn some new techniques.

And I'm joined by an awesome legend in the industry, somebody who I share the same first name with, which is also great. So welcome to the show. Welcome Joe Grant to the episode.

We're give the audience, you know, I'm sure most people are familiar with you, but if you want to just give the audience a bit of background about you, who you are, some fun things, what you get up to.

Yeah, yeah, sure, yeah. Thanks for. Thanks for having me. Thanks, everybody, for listening. My name is Joe Grand. Some of you might know me as kingpin.

Depending on how old you are, I guess that's sort of the delineator between generations. But yeah, I'm a hardware hacker and spend a lot of my time sort of exploring hardware and breaking hardware. But really my passion is teaching, so.

So I do a lot of traveling around the world, both public conferences and private events, and teaching about hardware hacking and sort of trying to just dump my knowledge on other people and sort of see if they can hopefully get inspired by that and kind of build on that and just create more things and hack more things. So, yeah, hacker is.

It's all I've ever known and it's just, you know, I'm just lucky that it's turned into something that I can actually do as a career.

That's fantastic.

I think one of the things is, you know, for me, I always, when I go into conferences and events and I do a lot, I've done see my badges in the background of tons of speaking.

But one of the things I always, when I go to conferences, I'm always looking for people who inspire me and I get educated from or learn something new. So definitely, always every conference I go to, I'm always looking for you on the agenda to see if there's.

To make sure that I have the possibility to attend. So all the times it's always great, you know, to your point, is the education and that's for me is. Is that's what I value from.

From going to the conferences to learn things.

That's exactly. I mean, we were talking right before we started recording is I happen to be in a couple weeks ago for something else.

And a friend of Mine was like, you know, bsides, London is happening. And I'm like, oh, my God.

So got to stop at B sides and see Iceman and see Daniel Cuthbert and see all these other people and meet a whole bunch of new UK hackers that I hadn't met and just left that one day so charged, like, to go back and hack on things. And just because you get to. You sort of absorb this energy of everybody else's excitement.

And that's what keeps me going as a hacker, is you never know everything.

And when you go to a conference, it's very humbling when you see all these other people with these amazing skills sharing things, and that's really such a fun part of it. So I'm glad that you're inspired by my stuff, and I'm inspired by lots of other people's stuff, and it's sort of this, like, giant snowball.

I feel like that keeps growing.

Absolutely.

For me, it's one of those things is that, you know, there's certain areas that I look into and I try to learn, but it's the community around us that we surround ourselves with that, you know, there's. I. I won't not know everything, but I want to have the connection with somebody who can help me when. When I run into problems or challenges.

As I mentioned, one of the things I got into hardware hacking was basically when my Proxmark broke. Um, and I was just like, I was so frustrating.

And it was like I. I did a firmware flash and completely bricked it, and to the point where I was just like, oh, no. And I knew I. I had a bus pirate sitting around somewhere, I thought. And then in order to fix the Proxmork, I had to update the bus part.

And it was just one of those kind of, you know, continuous things.

And ultimately then, you know, getting help from people around me that had wrote blogs or wrote information about how to take you through the steps to the point where I actually fixed it. And I was so happy with learning something new that it gets out of excitement and passion.

Again, absolutely super satisfying.

I feel like there's always, like, with stuff I work on, just like you said, there's sort of this necessity of, like, all right, I got to learn something so I can fix it. And it's the same thing with hacking of, like, there's so many different ways to go and so many different things you can hack on.

You know, whether you're looking at hardware or software, network, whatever, even within those areas, you could spend a career looking at one Attack vector of one thing.

So a lot of times it's sort of like if there's some interesting curiosity of like I need to figure out how that works or, you know, somebody needs help with something, I'm going to now learn this new technique that I can use to help them. Yeah, I love that. There's just this never ending pool to learn from and so many ways to go. Like it really is never going to get old.

You know, I feel like, yeah, there's always something to do and that that's important.

Absolutely. And the way technology is moving, it's getting more and more.

Yeah.

There's always acceleration and then you end up with some of the same sort of security problems and failures because as new generations of, you know, engineers and designers repeat the same problems, but then you also get this incremental sort of increase in new technologies to look at.

Yeah, I mean just thinking about, you know, 20, 30 years ago as a, you know, a young punk kid at the Loft versus now and how technology has changed so much. But a lot of the security stuff and sort of the hacking approach is still the same.

It repeats over and over again. It's just a continuous.

One of the things we were talking about earlier, you know, was, which we'll get into in more detail was what you're talking DEFCON last year, which was the, you know, hacking time, which I.

And it's going to go back to the same thing that if you go back, even when I started, when I, you know, I started my journey was from gaming into hacking.

Okay.

Because I was from Belfast, I could afford, you know, you know, the latest games, I couldn't buy them new. So I was always finding ways around whether having to type them in BASIC and get them to run myself. Yeah.

Or having to find ways in order to slice and spice tapes and. Yeah. Trying to get or changing time so that you go back and the license would continue. So the same kind of things just keep popping up.

It's just sometimes a different format or a different platform and so forth.

That's right.

So what's your hacker origin? Where did you start? When did you want to be a hacker to get. Or did you kind of realize that after a while of doing something that you were a hacker?

What was the journey there?

So this, like I got involved so early, I didn't know what a hacker was. The term hacker, like it was used in the early days a little bit. Sometimes the media would call it cracker or whatever.

Like you'd have, you'd have people that associated with hackers. But there wasn't real, I don't think a very formal community. You had sort of still some subsets of hacker groups in the early 80s.

So I just took it over and just fell in love with having that machine to be able to interact with. And like you, I started with games.

I would type in, you know, basic programs for magazines and I would connect to bulletin board systems and do war dialing, you know, as well. But connect to bulletin board systems, find people trade games with war dialing to find interesting systems.

As I got older, figured out how to make free phone calls so I could call bullet board systems further away. And it was just this curiosity and something I just, I don't know, I just really associated with it and connected with it in some way.

And I remember like using some very early.

I don't even know if it was a hex editor, but some program where you could modify, you know, because a lot of the crack screens would have strings in there and I would change the strings, but you wouldn't type in ASCII text. You had to type in the hex value for that. So I remember having like a, like a, a highlighter pen is all I had.

And I was writing, oh, it looks like If I change a 41 to a 42 that turns to an A or whatever it is. And I would write all those down. And then I would have it say like I was called Black Ninja was my first name.

And instead of hacked by whatever it was like hacked by Black Ninja. And so that was sort of my first experience of kind of modifying things. But yeah, being a hacker, it wasn't. I had no direction.

It was just what I love to do. And the, the older I got at, into my teenage years, the more I realized how abnormal my passions were compared to like people at school, right.

Like I didn't do sports, I used a computer and I started getting this power, which I really loved, even though I didn't. I didn't abuse it directly against individual people, but I knew I could.

Like if somebody was giving me trouble at school or somebody didn't like, it's like, well, I could, you know, if I wanted to pull your parents credit rating card and go shopping and cause you all sorts of trouble with your phones and everything, which I did cause A lot of trouble, but, but it was more, it was less focused on an individual. But I liked that, that power. And it just sort of progressed from there of sort of exploration.

I really just wanted to be an engineer because that was a career path where I could design electronics and, and that was a defined path, like being a hacker, being a cybersecurity researcher. Like those terms didn't exist as a.

And it was just, it was just an IT guy. IT guy.

It was an IT person who happened to do some security. Right, exactly. And the, the engineering side and the electronic side really fascinated me also.

And I think because the computer systems at the time were easy enough to understand, hardware wise also. So at the same time as writing programs, I was building electronic projects out of magazines and modifying those.

So it was just this natural progression. And I've never really had any other desire to do anything else.

And I remember talking, talking to a friend of mine who's a professional musician and travels around with, you know, a lot of different bands that I'm sure some listeners have heard, heard of. And, and to see him, I asked him the same question. I'm like, how did you get involved? Like, when did you know that you wanted to do music?

And he's like, oh, like, you know, when I was 8 years old, as soon as I touched the piano, I knew. So I think it's.

A lot of us kind of had that passion, discovered it early enough where computing was so unique, where it wasn't surrounding us all the time. It was special and it was something that other people didn't have and I just loved that. And then it went from there.

But yeah, that was sort of the beginning of like discovering bulletin board systems and other people like me where I could interact with but not have to be in person. Which, especially as a, as a little kid, it was just like this world that I had access to that, that I knew other people at school didn't.

Absolutely.

It reminds me of even when I was at school as well, one of my kind of things that, that got me going because every day I'd go into the classroom and we'd have computer class and I would go in, put, you know, charge everyone to put games on the computers and charge them one pound a game or something. Yeah, I put a game on and I'd be like £15 at the end of the day because, you know, 15 people in the class got.

That's a good racket. I used to sell ASCII art printouts of naked ladies when I was probably 10 years old for $2 a piece.

And I had those hidden in my friend's house underneath his parents computer desk. And one day they all went missing. So I think the parents discovered our. Our illicit sales.

But it was for me that. That was exciting. You know, you got into and.

And then the IT admin would discover all the games and delete them that night and going oh, how did they all get on? And. And then you start afresh the next computer class. It was like. It was like a clean slate and you sold.

It's like having a vm. You just start over.

And for me it was. It was a way to kind of fund my gaming passion as well. So ah, that was the kind of way because.

Because then you know, to a point is, you know, the hardware side is my first computer was an Atari 800XL. Okay.

Mine was a 400. So nice.

Yeah.

A better thing.

It actually was but you know, it wasn't a game but it was actually a computer. It wasn't a console. It was actually something. And for me, I think that was where I was about 7 or 8 at the time.

And it was where that was for me that was really what got me interesting. And learning BASIC and learning the gaming to a point. You know, you type in the basic code from the magazine. Yeah. It wouldn't work.

And then you found out the next release of the magazine that there was a Kaipo and. And it was so frustrating. You get troubleshooting yourself.

So where did you transition to, you know, from you want to be an engineer into the hardware side? Because it's a very.

I think you know what I remember was a lot of it was to do upgrades to get a better sound card and graphics card and memory and disk space. That was kind of where, you know, in the hardware side what got you more into kind of like looking into more detail ultimately becoming your career.

Yeah. I'm trying to think if there was like a defining moment. I do remember.

So one of my first circuit boards that I made was something called a ring busy device. So you could plug it into your phone line and you could still use the phone as normal.

But if somebody tried to call your house, they would get a busy signal. It was kind of a way of like, you know, you could block salespeople from calling at dinner time or whatever.

But I thought it was awesome because I could use it to prevent my teachers calling the house to talk to my parents or the telephone operator or whoever else, you know, voicemail, Owner of some voicemail system we were hacking. Whatever. They couldn't call so they couldn't talk to my parents.

And I remember building that and it was just so cool to be able to use hardware to control something. But it ended up just being just like with computers.

Like it was this natural progression of I was designing or I was building electronics out of magazines. And then I would learn how those were done. Kind of like looking at code and modifying code. I was looking at hardware and modifying hardware.

And then I started building my own stuff. Sort of mischievous things. I built a stun gun.

I built a, A high, high pitch sound generator that I built into like a little Altoids box, like a Mintz box, and brought it into the classroom. This was, I think sophomore year at that point in high school.

And turn it on and it would have this high pitched sound that would bounce all over the room and nobody could figure out where it was coming from, which I thought was hilarious. I built like a laser listener system to try to try to pick up sounds that were hitting windows and reflecting.

So I just started tinkering with things kind of in this mischievous. Because I had this mischievous sort of mindset. And I was kind of a troublemaker in school and outside of school.

I was involved in skateboarding and punk rock and all these things that were not normal in society, which I'm just now learning. Sort of why I've gone into the. Why I was attracted to those things. But the mischievous hardware was kind of the same thing.

And as I got to be a teenager, I was doing credit card fraud and I was buying, you know, computers and reselling things. But then I would, I would also like just build. I would also like clone cell phones. So I reverse engineer cell phones to figure out time.

They were amps. So an analog kind of standard, you know, in the U.S. where you had your ESN and your MIN, which is your telephone number. So you had those two.

If you had those, you could reprogram those to another phone and then essentially sell that to a drug dealer or whoever, and they could use somebody else's account until that other person, you know, the legitimate person, discovered that.

So I was doing that in high school a little bit Kind of using my hacking, my mischievous hacking mindset with designing hardware again knowing that I was going to be an engineer because that was the career path. And I loved, loved designing things. I'd always just, you know, wanted to have products out there.

And getting into a professional hacker came a little bit later on in that process when, when all of us at the Loft Soul, you know, started at stake, where that was the catalyst of like, okay, let's try to do this full time and then go from there.

But it was really the hardware hacking started because I was designing hardware and was an engineer first in that case, but, you know, a hacker as well.

So what was, what was the journey like from, you know, in the Loft? I guess that was the transition from it being a passion to somewhat being.

I just gotten arrested for breaking into a telephone company building with some other people that I was in a different hacking group with kind of nationwide hacking group. So that was sort of this, this peak time of my troublemaking and then I got in trouble.

And then the guys in the Loft, who I was already familiar with from the Boston hacker scene, they, they took me in under their wing.

And it really was this transformational period because I was, I was still a teenager, but I was old enough to realize that what I was doing, troublemaking wise, was not going to lead me down a positive path. And when I got arrested, I was very, very lucky that I did not end up in juvenile hall, in the court system and all of these things.

I was the only one actually that was not charged because I was underage. Everybody else I was with was older and some of them faced jail time and it was, it was pretty bad. So it was a real eye opener.

The Loft to me was such an important part of my life because I was a teenager in a very formative time. And now I had all of these mentors, whether they knew it or not, and I still talk to them.

I was like, why would you let a 16 year old punk kid into the space?

Like they never sort of, I never understood why me compared to other people, but it really, it really saved me in a lot of ways and it taught me a lot also because now I'm in a group that our only purpose of the group at the, at the time in these early days was to have a hangout spot and mess with technology and explore things Set up our own networks and hack on them and play Network doom with all the computers. It was just a really cool place to go. And for me, a safe haven where I had somewhere to go. And. And these guys were kind of my. My parental guidance.

And I learned from them. When we would go to some meetups and some conferences, I'd see like, okay, Count Zero is giving a talk about this. Here's how he's presenting himself.

Oh, there's, you know, Brian Oblivion is sharing some information that he figured out with some other people. Just seeing that. That passion that they had of sharing information like we talked about at the beginning, that really stuck with me. And it.

It showed me the importance of being willing to share and being willing to lear skills in a positive way. So it was such an important thing. And then in, you know, a couple years in, actually it was eight years in to the. To the loft, we decided to.

To start at stake to see if we could be hackers full time. And this was a crazy thing.

Like, at this point, there were consulting companies starting to do cybersecurity, but there still weren't hacker groups doing it. I remember we. We tried to negotiate with one large consulting company, and as part of.

Part of this conversation we were having with them, we were like, okay, we're going to prove our worth by doing a pen test on you while we're doing negotiations. And they didn't really think anything of it. So, like, Mudge and some of those guys did some network hacking.

I did some voicemail hacking, and we did some physical security stuff, but I ended up hacking the voicemail of one of the guys that we were negotiating with, leaving a message for. For receiving a message from the other guy we were negotiating with.

So they were talking about us, and in the voicemail, they're basically like, well, you know, blah, blah, blah, stock options. We can meet their demands with this, this, this. But I still don't know about Joe and Brian.

Like, the hardware guys of the team, they didn't know what to do with hardware hackers. And they're like, but if, you know, they're part of the deal, they're part of the deal, whatever.

But we basically heard them talking all of this shit about us. If. Sorry if I'm not allowed to use the word, you can beep it.

You know, I don't. I don't. I don't beep anything.

And they, they. And. And the guys, when. When. When they went to do this sort of meeting at the end about like, okay, here's the. You know, pen test review.

And they played the voicemail back to these guys and their eyes widened and needless to say, the deal did not go through.

But that's when we realized how different the corporate world was from the hacker world from, you know, they were looking for business billable hours, blah, blah, blah, where we were more like, no, let's do this.

Like, there has to be some element of this public service of finding vulnerabilities and forcing companies to fix them and letting, you know, empowering the users. Because that's what the loft ended up being about.

Of, of like, you know, putting, putting less trust in the corporations because, you know, well, we know that designing secure products is hard and we tried to be, you know, give them some time to like, fix the problems. But a lot of times back in the day, vendors didn't want to hear it at all.

It was, There was missing accountability.

That's right.

They can, you know, they weren't transparent, accountable for, you know, and if they discover something, they would, you know, try to minimize the cost aspect of it for as long as they could.

That's right.

If they even.

If they even acknowledge that it would be a problem. So that was something that people just didn't quite understand.

So we met with a couple different people and eventually ended up joining forces with some venture capitalists that wanted to form a cybersecurity company but wanted hackers involved also. And this ended up being at stake, which is kind of the seed where so many people grew from in the industry.

I didn't have a great time there, mostly because we went as the law from this very flat hierarchy kind of thing to an actual organization have. I had. And I have a problem with authoritarian, authoritarian authoritative figures and people telling me what to do.

And when it ended up being my friends telling me what to do, who are now the vice president of security who is now telling like, it just didn't. It didn't sit well with me and it didn't feel right.

We did have a great time setting up the company, doing research, but ultimately, like every corporation, especially venture, venture backed up. They wanted billable hours to make money.

And I didn't want to be a consultant per se because I knew what my skills were and my skills are not in that consultant role. I like to sort of be shielded from that and do my work on my own in our lab. And it just didn't. It didn't end up working out.

Some of the guys got fired from the loft with really lame excuses and the rest of us didn't Band together and kind of support each other in that kind of unionized way which we should have of like, wait, why are you firing him? That's not right. We're going to, we're going to also leave.

You know, like, we just didn't do what we should have done as a group of friends, which I really regret still. And. But it taught me a lot.

Thousand three, I left and became independent and was like, I'm going to focus on what I, you know, my, my ethics as a hacker and as a person.

And I was young enough and dumb enough, you know, I didn't have any responsibilities besides paying rent and eating food that I could take some risks. And like, I'm going to design some products and sell those. I'm going to give some talks at whatever conference.

But it was still young enough and early enough in the security world where nobody really knew what was going to happen. I just didn't like the feeling of the big corporations selling. Selling security in a way that it just, it just didn't feel right to me.

You kind of lose the site where it becomes more about the revenue than actually solving problems. Absolutely. Yeah. That's, it's. It's finding, it's always finding that balance.

I think it's finding the balance, you know, to, you know, being a researcher primarily and curiosity and driving that passion, which is, you know, which becomes the career. And I think it's always finding that balance between where companies. It's really about.

They're there to make the world a safer place and that it's all about making sure they're solving problems that people have. And then at some point in time, if, you know, whatever comes in is. They lose that. That insight. Because I was at one at stake.

I was acquired by Symantec. I was at Symantec for a period of time.

Okay. Oh, wow.

So. And for me, I end up. I left because of that same reason is that I had so many ideas.

I was going to the CT office, CTO office, and I was knocking on the door saying, this is a, this is a problem that many people have that would be great to spend time solving this. And I remember the time it was like, you know, we're too busy doing kind of structural changes that we don't have the Time, Right. That was me.

It was like you lose the sight of solving the problems that people have.

Yeah. And you know, we started off as, not to get too deep into it, but we started off as like, yes, At Stake hires hackers.

And then, you know, we were getting pushback from customers of like, ooh, but our hacker is good or bad. We want, you know, somebody in a fancy suit to come help us with security.

So there was still this disconnect that the company didn't really know how to handle. And probably the best example is Dan Geer, who was our CTO at the time. An amazing person. He's been involved in cybersecurity since the beginning.

Way before us, or whatever it was called back then, more cryptography based stuff. And he had written a paper warning about these dangers of monoculture, of relying on one individual company using all of their products.

In this case it was Microsoft. And that was a groundbreaking paper that is still referred to today.

But he wrote it while he was the CTO of At Stake and Microsoft was a customer of At Stake and he got fired because of that. He was basically bringing to light a bunch of dangers with people relying on things that we're seeing today. Right.

Look at what happened with CrowdStrike.

CrowdStrike, yep. Even though it was an IT issue rather than just for the security company,.

It was everybody relying on one thing or a lot of these, what is it?

Log 4J or like a lot of these massive problems that happen are because everybody is relying on one thing and a lot of times there is no other option to paralyze with something else.

Yeah.

Because in Estonia it was that the fear of land invasion, it's called the doomsday scenario. And at that point in time they realized that the dependency and even the Estonian land was a risk.

That was the actually land of Estonia was actually where the risk was if there was an invasion. That's where you had the vulnerability. It's like the dependency that you have. You have to realize what's your dependencies.

And that's when Estonia came up with the idea of data embassies to then move because you couldn't go to cloud because the sovereign law prevented moving your citizens sovereign data to cloud environments. So they came up with data embassies, decentralized Entire government in embassy locations outside of the country.

Right.

So you remove that dependency because that becomes a single risk.

Right.

That, you know, how do you mitigate?

Interesting solution. So, yeah, you know, it was, it was an interesting experience for me.

I had actually come from a professional engineering environment, so before we started At Stake, I was working as a professional engineer because that was my, that was my path at the time when we all quit to be hackers full time. That's when we sort of, you know, I think At Stake proved that security was important and it proved that we could start doing security research.

And we did give some talks for no other reason other than to share information. Right. It wasn't, it wasn't that every talk was. Was a logoed, branded thing.

Like we would write advisories for things because we could not because we were using it in a customer project. But yeah, I basically just ended up going on my own. And that's when I started doing more hardware hacking and less engineering.

And that just sort of came out of. I was doing some consulting work, but then it came out of. Of like, wait, maybe I can combine these skills.

And then ultimately it was, it was Jeff Moss, the dark tangent through. I had known him since I was a teenager and I did the early DEF CON badges, which was more electronic, exposing people to electronics.

But then really when he started doing trainings at Black Hat and was like, hey, you should do a hardware hacking training.

That's really what set it off of like, okay, I can combine my engineering mindset, my hacker mindset, and people pay me to talk about stuff that I love.

Like, this is the best thing ever, and I get to do some creative design work and teaching methods, different ways of teaching things to people at different. With. At different skill levels and everything. And it just really like, clicked for me of like, this is what I love to do.

And I mean, I'm immensely grateful. I think a lot of us wouldn't be here without sort of Jeff's foresight. Way back in the day.

Things have grown arguably out of control with how huge everything is. But it really. I'd never, like, I was not the one that was like, I'm going to start doing trainings. I'm going to be a professional hacker.

Like it's always been. I feel like a lot of times somebody else may be planting a seed or suggesting like, hey, you should do this, or even looking like, yeah, looking.

From the outside and seeing kind of your, let's say, you know, the values that you have and kind of passion in certain areas sometimes it's just that they see it from a different perspective.

That's right.

And be able to, you know, say, you know, and they might also have insights from other areas that they're seeing as growing and, And. And see that you've got values that would be beneficial. You know, they're in. In the training side as well, so. Absolutely. Yeah.

And it is. Right. I mean, a lot of times, you know, the stuff. The stuff that I teach, I don't consider groundbreaking knowledge.

It's just knowledge acquired in a way that maybe other people haven't.

So when I go to speak to engineers, they have the engineering mindset of, like, making sure the product can be designed and working under budget and be released security. A lot of times, you know, as we know, either. Either isn't thought about or is tried to be patched on later or whatever it is.

So I just try to bring them that sort of mischievous side of thinking about it from an adversarial perspective.

And if I'm teaching hackers or, you know, penetration testers, then I'm bringing in more of that engineering side of, like, here's how an engineer has to design something, and here's how we can exploit what their take, what they have to do as engineers. Yeah. I mean, it's. It's super fun, and I'm glad that, you know, I was eventually able to find something that I actually liked doing.

Still. My favorite badge of all time from defcon, is that the pendant, the one with the. That was. It was such a very different concept. And also was the.

Was it the. The wireless communication? So, yeah, and it was. Yeah, that was definitely a very different perspective on.

That was DEFCON 27. So that was. That was a number of years. That was nine years after I had retired from designing badges, which was DEFCON 14 through 18.

I designed those. But then the Dark Tangent needed help, and he's like, hey, can you design the badge? And I was like, I don't know. I was stressful.

But we met and like, you know, he's a hard guy to say no to, and he's so passionate about it, and he had some great ideas. I got to try a lot of new techniques with engineering using his money, so I didn't have to take any risk.

That was a really hard project, but I wanted to try to do something. Yeah. Incorporate some natural elements and a little more artistic. Like, I don't consider myself an artist.

I'm a hacker where I look at actual artists and I'm like, I can't even imagine how they did that. But trying to bring some of that artistic element in with the natural, you know, the quartz crystal and then the near field magnetic induction.

Like, I'd always look for something new that I could learn from. Again, talking about motivation, you know, doing the DEFCON badge was the motivation to try something new and learn something new.

And the NFMI stuff was cool, and it was contactless, but it wasn't Bluetooth, it wasn't WI fi. It was different. So I thought that would be fun to sort of expose the audience to. And. Yeah, I'm glad you liked it. It was fun to see everybody. It was.

It was looking at, you know, the traditional way you've got a hanging. Just seeing people's creativity about how they wear it was actually impressive as well.

Yeah.

So that was definitely. Definitely one of my favorite. And going back to one of the things I kind of want to move into, as well as some of the talks you've given.

Again, my favorite of all time is the Colonel Khan talk, which was. Which was watching you running around with soldering irons and, you know, trying to get the temperature up. And I think it was the heat gun.

And that was the Colonel Con Live. So that was, I think, during lockdown,.

Or it was during lockdown. It was where Colonel Kahn switched to doing the first virtual event.

And then they had this kind of live session from morning till evening where the speakers would get two cards and you had to choose one, and each one would be a different challenge. Yeah. And it was. So I think the thing is that when you see a lot of people doing these types of things on social media, they're so edited and so cut.

Yeah.

That you don't get to see the thought process.

And it's very overwhelming because it's like, why did they. How are they doing this? Why are they so successful?

What?

You're right. You don't get to really see the truth about it.

And I think Colonel Khan was that Live was actually showing the thought process about running. You're running into problems and then thinking about, how do I solve that problem? And, you know, rather than watching you do it. Exactly.

Yeah. Yeah.

Even just watching you running around with the GoPros trying to get the right angle and stuff. It was awesome.

That was such a fun experience. And I remember sitting there watching Chris Eagle do his. Chris was reverse engineering sitting on the couch and, like, talking about being inspired.

Like, it's because I've known Chris for a long time, too. But to be. To be able to see people in their element, it was so. It was so fun. So then when it was my turn, it was like, all right, I got to step up.

And that was a wild challenge of like, yeah, all this hardware hacking and trying to explain it as I was doing it. And everybody's typing stuff. Yeah, very chaotic and super fun. And I loved how they delivered a pizza to me also, as I'm doing. It's pretty awesome.

You know, it was. It was really fun. And my kids got super jealous because they're like, why did Daddy get a pizza and we didn't get pizza?

And I'm like, well, Daddy's hacking.

As your kids getting into hacking or not? Or what's. What's.

No, not really. They think it's cool. They're mostly aware of what can be done with hacking.

They're aware of what, you know, the dangers of the Internet and the dangers of big companies harvesting all your information. And they know how to use Tor. They know about VPNs, but they're mostly like, yeah, they're into gaming. And then they just have their. Their dreams of.

Of whatever they want to do, which is good. I would never expect somebody to follow in my footsteps, but I can imagine it would be hard to.

Unless you love what you do, it would be hard to sort of follow. Follow that. And I like. I like that they. They have their own dreams and their own goals and like, my. My job now as.

As a parent is to just support that. Right. Of whatever they want to support them, support them. And the worst that's going to happen is they make a mistake or they fail.

I can compare it all to, like, well, you know, my. My son is 16 now, and like, when I was 16, I was a mess and I had gotten arrested. Like, he's doing much better than I am, I think.

I think it's a good person, is that we keep. I tried to keep some of what I was doing at that age a little bit private.

They know everything. They know everything. And the same thing with some friends of mine that had some. Some like, very dark times with drug abuse.

We talk about that with our kids because they can see what happens, and luckily they've come out of that. But, like, those are. Those are things. Lessons that they might not. They might not listen to me directly. Right. Using examples of other things. But no.

So they're not super into it. They do help me with. With like, unpacking things and setting up classes and stuff sometimes.

But no, I mean, they know I'm just a total nerd, and I'm just in My office all the time doing something.

It's pretty awesome. I actually had, I did move my office away from home just to make sure I got this separate.

So one of the things, one of the things I loved was the talk that you did with Bruno last year at defcon. That was so, so much fun.

And again, when I was, I was watching it live in the audience, for me, I was saying earlier that it reminded me of the Captain, Captain Zap time. And hacking time has been something old school, been a long time.

You share a little bit about kind of the whole buildup of that, that talk and the research and stuff that went into it.

Yeah.

So I think what's interesting about that, mentioning from, you know, again, every hack has to be this groundbreaking thing and a lot of times there's this expectation when you give a talk at a conference, it has to be a brand new zero day, something, something, something. What I was trying to do with that talk is show, yes, like hacking time, modifying time.

And I'll explain that this is a decades old problem and we're still seeing it come up in different ways. And just because we're not doing something groundbreaking doesn't mean it's not important.

And even more so, just because the version of software that we were hacking on was older, 9 years old at the time, also doesn't make it any less important because people are still relying on, in this case, passwords that they had generated using this version of software. So we know this as security professionals. You know, not everybody upgrades their, their tools, their software, definitely not their hardware.

And just because there is a patched version of something doesn't mean everybody's going to start using it. And all of a sudden the world is safe from previous problems. So that was really the main lesson. This project came up where I had.

I'd kind of unintentionally gotten involved in kind of cryptocurrency wallet recovery where I'd hacked my first kind of project related to that was hacking the Trezor One hardware wallet for a guy that had lost $2 million or he was locked out of his Device, he had $2 million on it. And my wife was like, you should be filming this process. Because I was just kind of cranking away on my own in my lab.

And so I had a friend of mine who is a filmmaker film this video.

As I'm actually hacking it, the customer, this guy flies from New Jersey to Portland, where I live on the west coast of the US comes into my house, we do the hack, we record it and everything in real time. So talking about sort of the live, you know, kernel con live, this was a real time process and it opened up these floodgates.

That video went viral and it was really the first time I feel like we were able to show hacking or I was able to show hacking where most of my videos before then were like me with phone, just trying to get the info out there. But using my filmmaker friends, they were able to tell a very technical story in a really cool way.

And at the end of that video I was like, you know, if you're looking for help with other projects, let me know.

Unbeknownst to me that we would then get thousands of emails from people that were locked out of crypto wallets that had other data recovery problems that were scammed.

Like, I mean it's, it's been really interesting because it's sort of broken me out of my hacker bubble into seeing more of the world where I'd always really just been focused on my, my community and my people. So it was both good and bad. But I've done a lot more wallet recovery.

The value was up when he contacted us 1.6 right after we, when we were editing the video, it shot up to 3 million. It was a significant amount of money. And I turned down the project because I was like, well, he's using a password generator.

You imagine password generators, they're security based products. They're probably generating passwords properly.

I kind of, I gave the benefit of the doubt to the software vendor which talking about earlier at the law, like, wow, I probably shouldn't have done that. Anyway, I turned it down. And then a year later he reaches out again.

And I remember in my email to him, I'm like, the only way this is possible is if there's some sort of vulnerability in the password generator process. And didn't think anything of it until he contacted me again and it was like, okay, let's, let's look into this a little bit more.

And it does turn out that the way that the passwords were generated with this version, at least up to this version of the roboform password generator was based on system time and it would seed the pseudo random number generator with system time, do some manipulation of things that was kind of irrelevant but basically meant that once we reverse engineered this process, we could build a wrapper and generate all possible passwords that could have been generated in that time frame. So we basically, you know, we knew some information about when the customer had, had set up his wallet.

So we just generated lots and lots of passwords, created our word list of these supposedly random passwords that weren't, and then eventually cracked it. So it was, it was pretty eye opening and then doing the presentation and we made a video about that also which is on YouTube.

But when Bruno and I, who's my friend who we did the work together, when we were putting the presentation together, I wanted to really drive home that point of like, look, pseudo random number generator problems have been known for a long time. Weaknesses with those using time as a seed value or in any other way has been known for a long time.

So it was less about like look at this great new thing and more about here's. Here are the problems that exist, here's how we were able to use them. Here are the tools that we use.

Here are things that didn't work and just showing like these problems are never going to go away. They're just going to come up in different, in different ways of different products. But it was super fun. I loved it.

And roboform like the response, the vendor response. Nowadays you would imagine vendors to be acknowledging of problems and say, okay, yeah, sure, we fixed that.

And I couldn't find any prior kind of evidence of them working with hackers before, which is also worrying. Even looking in HackerOne and Bug Bounty places just couldn't find anything. So I was a little worried about how they're going to react.

I wrote up a whole disclosure thing and even though it was an old version, this was, you know, many years earlier, I still thought it was the responsible thing to do to let them know. And it. And they basically responded and said, oh, we fixed that problem. But they didn't explain how they fixed it.

And a journalist actually asked them, how did you fix it? They didn't say. The journalist also asked them, did you notify your customers about this problem if you knew about it? No response.

And people that I talked to who had used roboform back in the day did not get any sort of email explaining like, hey, we found this problem with how we generated passwords. We've now fixed that by doing xyz. So you can, you can rely on these passwords more.

By the way, if you've used our password generator to Generate passwords in the past, you should probably change those, which most people probably wouldn't anyway, but at least the vendor would be doing the right thing. None of that, basically. Crickets. So we don't know how that problem was fixed, which in my mind tells me it probably wasn't fixed.

It was probably obfuscated in some way that might just need some additional reverse engineering to figure out that vulnerability for more modern versions. So it was a little underwhelming in.

In how, you know, I really wanted to know, honestly wanted to know how they fixed it, out of curiosity, not because I was going to like try to use that against them. And I think they missed a really good opportunity to have a say in that.

Especially with the video that we made that has over a million views and no input from them. Like, it would be really cool if I could have conclud that video of like, this is what they did to fix it.

And it's just this, in this day and age, it's so frustrating how we still have this potential risk of getting sued and this lack of communication between vendors. A lot more vendors are doing it well compared to the loft and back in the day.

But it still, it really surprised me that there was not more of open communication there.

Sometimes it's also cultural and location and geographical. Sometimes they have different perspectives on different things.

Yeah, I absolutely agree that sometimes organizations do want to learn from the different perspectives.

And why not? I mean, if you're designing a secure product and somebody finds a problem, like, why not learn from that?

You know, the fact that we found it as two hackers hacking on stuff, you know, this is the same story all the time. Like, obviously somebody else is exploiting that. We are not the smartest people in the room. And we are not the only people finding these problems.

Absolutely.

We're just trying to make the world a better place. And you can't just put your head in the sand and imagine these things don't exist. It doesn't work.

No one's looking and no one's discovering.

Absolutely. Yeah.

So what things are you getting up to today? What's new? What's. What's the latest news you've got?

Yeah, so I've actually, I've been home for the first time in a couple years. I've been home for more than like three weeks, which is really, really nice.

I travel probably 10 or 12 times a year for maybe a week or more at a time. So it is very like. I don't know if the term road warrior is used anymore.

But it is definitely like I feel like I'm on to and I feel like I'm a one man band, which I love, I absolutely love it. But I've also discovered that I love having more than three weeks so I can really get deep into projects.

What I'm working on, surprisingly, or maybe not surprisingly, is when I did the first wallet hacking video with the Trezor 1 that uses an STM32 F205 microcontroller General purpose microcontroller. I did the, this fault injection attack to bypass security to get the funds out for this guy.

But I was never really comfortable with the approach and I felt in the back of my head I felt like there was a better way to do it.

And that sort of just stuck with me and that kind of hacker mindset, like that adversarial thing of like, I can do this better, I know I can do it better.

So over the past couple years I've been focused on trying to refine that original attack but make it work across more devices, learn different types of fault injection techniques, build up different platforms and different hardware. And I've been working with a colleague of mine in Belgium on like late night discord chats about it and really collaborating.

That's been so, so exciting and to see this incremental progress as we go.

And it's very much like a scientific approach to hacking because you're running all these tests, you're making changes, you're looking at results, you're doing all these things and it's been a long time coming and we're almost ready to release a whole bunch of information that again is not necessarily groundbreaking. It served a purpose for us to learn new techniques and use those techniques in my case to help people with cryptocurrency recovery.

In his case he was doing some PhD work and some other projects, but these chips are used in billions of devices all over the place.

But really it's this, I feel like it will be a cool culmination, kind of like the robophone work of showing like, here's what existed, here's what we learned, here's what we made, you know, here's what we iterated on and maybe improved. Here are the problems we ran into. Most importantly, here are the problems we ran into.

Here's what we tried, here's what didn't work, here's how we overcame these things. So really kind of COVID that process. I'm just so excited about it, I don't know where it's going to come out. And how it's going to come out.

We might make a video about it.

But it really, like, has been such a cool learning experience that I can't even wrap my head around how much I've learned over these past couple years.

So how do you learn? What is your method?

Yeah, always by doing. I spend a lot of time thinking and writing out my lists of like, let's try this, let's try this. But it doesn't really click until I do it.

So like when my colleague does some tests and give me, gives me some results, I'm like, okay, now I want to replicate that so I learn the right way and make sure that of course that my results are the same as his, but also to learn from it. So it's all about doing, which means I make a lot of mistakes and.

I'm not afraid which mistakes are good because it means mistakes are part of the learning process.

They are. And it, and it's something I think a lot of people are embarrassed to talk about. And I actually gave a talk at.

It was Hack in the Box in Thailand, Thailand over here, about failure.

And it was just some examples of failing because I think especially with the Internet and when you go to a conference or you see papers published, that's the end result of what could be a huge amount of work. And it's, it's, it's very easy to get imposter syndrome when you look at stuff like that. And it's like, how did they do that?

Are they not making the same mistakes I am? So I think it's important to talk about that.

I think that's one of the crucial things. I've spoken to quite a few people who do the capture the flag and streaming and showing the walkthroughs and they show the perfect walkthrough.

And just like, yeah, when I did it, my hid my head on the table about a hundred times, right.

And it's funny because now, like we have an attack that works, but that's only because of our dozens of failures along the way.

And those failures, by the way, just because something didn't work for our attack and our approach and our chip doesn't mean it's not going to work anywhere else. So somebody could take our failures and actually turn those into positive successes on some other project with a different chip.

And that's what is so cool about it.

That's one of the important things is about, you know, going through this process of documentation, documenting everything that you do.

And I think that's one of the things that sometimes that people don't realize the amount of work that goes into just documenting not just the success, but everything that you did. All the steps.

When Bruno and I were doing the software reverse engineering of Roboform, like I would have a screen capture running. So if I ended up finding something or doing something and I needed to go back and be like, what did I do to cause that outcome?

I could actually just drag back and see what I did. Yeah, the documentation is hugely important, which I love doing. From the engineering mindset of having everything documented properly.

We have our Discord chat is a three year laboratory notebook basically. So when we start like writing up this, this research to give a talk or whatever it is, we have everything kind of documented by time.

But it's so important.

Like that is really part of the process that helps helps you as the hacker learn, but also helps other people learn and be able to replicate your work and take that and build on it.

Absolutely. And what resource for anyone in the audience who's looking to get into this, where would you point them to?

What would be taking your course would definitely one opportunity.

Yeah. Right. So a lot of people, so right. My courses, you know, they cost money. They're at a conference, conferences charge for those.

All of the resources that I use in my training classes are already available on my website in different presentations that I've given over time. The course just kind of makes those into a more defined structure.

But on my website, probably the easiest thing is if you go to joegrand.com that will currently go to a Linktree page.

It will eventually just go to kind of a launching point for my various projects and stuff that will lead you to Grand Idea Studio, which is my engineering company. That's where all of my security work. That's where all of my work is. Most projects I've done are open source. All my security stuff is out there.

So kind of looking through the hardware hacking stuff that's out there. I do have a Discord server also which is fairly low volume. There's a lot of cryptocurrency like scammers and annoying people on there.

But once in a while we have good technical conversations and there's a frequently asked questions list in there about how to get involved in hardware hacking. I'm sure there's a lot of places that I'm not involved with on Discord and other, other forums and stuff for hacking.

But I always tell people like, just find something you're interested in. Like in your case it was, you know, Proxmark So rfid, whatever you're into. Flipper Zero.

Like, maybe you just want to, like, screw with Tesla, you know, charging ports, and that's a drug to, like, doing something else. Find something you're interested in and, you know, maybe go to a thrift store and buy some electronics and tear it apart.

But there are definitely a lot of resources now and a lot of tools available now, and it can be overwhelming. So, you know, Discord, my Discord server, there's. There's other people there other than me that will also answer questions and stuff.

Fasting. Absolutely. And don't, you know, I've burnt my fingertips quite often. Yeah.

I don't even have anymore. I can't feel my fingers when I get burned. It's like, oh, that just happens.

And I always keep a torch nearby. Yeah, I think I've been in the dark quite a few times. Joe, it's been really awesome having you on.

It's been a pleasure, you know, talking with you and learning and listening to your journey.

And you're definitely, I think, for everyone out there, you probably got so many people into hardware hacking to really kind of, you know, make the world a safer place, including myself. You know, I've watched a lot of your. Your, you know, sessions and talks, and I've learned so much from you, and I'm sure the audience will also.

So really, if people do want to contact you, what's the best way, you know, if they have questions, is it going to the website, to your Discord? What's. What's the best way to.

I mean, yes, I would say Discord is probably the best way. If you email me, I'll probably not respond. Respond to it. I get so many emails that. That it's been.

I used to try to respond to everything, and then when, when. When the videos went viral, when it started reaching this outside audience, it became really hard and overwhelming.

So a lot of times I just shut everything off and just. And hack on things. So Discord, at least is a good, asynchronous kind of communication. And then other people can jump in and ask questions, too.

But, yeah, again, I appreciate the opportunity. It's always fun to share this stuff and especially with people, you know, of my generation, who sort of. You grew up in a very similar way.

I will mention, too.

So, yeah, again, the best way, like jogrand.com what we didn't mention is by the time this podcast comes out, there will be a movie released on February 28th, and this should be coming out afterwards called Cold Wallet. And it's a cryptocurrency like heist thriller movie.

So like an independent film that got picked up and, and I think it will be in actual movie theaters and streaming. I don't know for sure because they haven't told us. But I actually have a part in that movie as a character that is.

It's a character pretending to be me basically. So you'll have to see it. But be on the lookout.

Joe grand, the hacker engineer and actor.

And actor, yeah. But you know, basically it's like it was very fun. Definitely watch it. You're not, you're not going to learn anything new.

But it's, it's a, it's an exciting kind of thing and, and to be in a, to be at a movie is just another one of these examples of like, I have no idea what, what's going to happen. I just like doing what I do and kind of following my, my passion. As cheesy as that sounds like you can do it right? You can, you can do what you love.

Especially in the security space. There's no shortage of, of paths to go. That movie for sure was, was a night.

It was a different introduction into a different world and fun to, to put that little hacker bit into it.

Absolutely. I think over the years, I think even for me that's what got me really into changing from gaming into hacking was, you know, the back of War Games.

War Games was, you know, sneakers, so hackers, even hackers. So I think that was, you know, doing what I was doing was, was the entertaining side of things.

But those, you know, really were the things that just swayed me back in again. Into the hacking side.

Yeah.

And definitely change.

You can make real change in, in positive and in, in potentially negative ways.

Also, which everything has a double edge.

Exactly.

So we'll definitely make sure for the audience, we're going to make sure. I'll put all of those into the show notes including the link for the movie as well. Yes. So that will be.

It's on my list of movies now to watch in the coming.

Okay.

I'm assuming it's still in there.

If it was in there, then it definitely should be. So, so awesome having you on. Looking forward to catching up in the near future.

So for the audience, always looking to bring you really thought leaders educational, you know, information to, to keep you interested and keep you passionate about making the world a safer place.

And if hardware hacking is kind of your path, then hopefully this episode is going to really kind of re energize yourself into, you know, taking the next steps and journey. Tune in every two weeks for the podcast. Look forward to talking with you, seeing you in the future, and stay safe and take care. Many thanks.

Cool. See ya.