Joe Grand: The Hardware Hack That Can Never Be Patched
From Security Unfiltered · 01:04:17
Show by Joe South
Joe Grand, aka Kingpin, hardware hacker, L0pht alum, and the engineer behind the $2M Trezor wallet recovery, joins Joe South on Security Unfiltered.They get into how a kid with an Atari 400 ended up in the hacker underground, why the hacker mindset can't be taught, and what 23 years as an independent hacker really looks like. Joe Grand walks through learning fault injection to free a locked wallet, how he and his colleague found an attack on STM32 chips that happens before the boot ROM even runs, why a vendor that won't respin silicon leaves chips vulnerable forever, and why "they need physical access" is not a security strategy (see: the San Francisco parking meter he bought on eBay). Plus failure, burnout, full disclosure, and his new travel show exploring hacker culture around the world.Chapters00:00 Finally reaching Joe Grand (email still wins)03:29 Why Security Unfiltered exists05:36 Atari 400 to the hacker underground10:00 The hacker mindset you can't teach13:16 Going independent for 23 years16:30 Keep learning or get cut21:04 Failing thousands of times with SELinux24:16 Hacks under pressure: cameras, customers, $66M27:55 How the $2M Trezor wallet hack started30:46 Learning fault injection34:37 Boot ROMs, Ghidra and silicon you can't patch37:04 Full disclosure and fighting for the user43:53 Chips that stay vulnerable forever44:34 Physical access is not security: the parking meter hack48:02 How an independent hardware hacker finds work52:28 Saying yes, saying no, and publishing your work56:22 Joe Grand's new hacker culture travel show62:57 Where to find Joe GrandJoe Grand on YouTube: https://www.youtube.com/@JoeGrandJoe Grand: https://joegrand.com/Grand Idea Studio: https://grandideastudio.com/Subscribe: https://www.youtube.com/@securityunfilteredpodcastShow site: https://www.securityunfiltered.comAffiliates➡️ OffGrid Faraday Bags: https://offgrid.co/?ref=gabzvajh➡️ OffGrid Coupon Code: JOE➡️ Unplugged Phone: https://unplugged.com/Unplugged's UP Phone - The performance you expect, with the privacy you deserve. Meet the alternative. Use Code UNFILTERED at checkout*See terms and conditions at affiliated webpages. Offers are subject to change. These are affiliated/paid promotions.Tesla Referral Code: https://ts.la/joseph675128Follow the Podcast on Social Media!Instagram: https://www.instagram.com/secunfpodcast/Twitter: https://twitter.com/SecUnfPodcast
More episodes of Security Unfiltered
More episodes
- AI Agent Guardrails: OpenAI Sandbox Escape | Bill Gurling, Rubrik
- Prioritization Is Dead: Every CVE Has an Exploit Now | Shimon Tolts
- Open Models Will Do Anything: AI Is Speeding Up Attacks | Rob Chapman, ArmorCode
- AI Agents Are Deleting Production. Cloud Security Has to Catch Up | Matt Lea
- Securing AI at Scale: Why Your Logs Can't Read Agent Intent | Ashish Rajan
- Your AI Agents Will Try Every Permission You Gave Them | Nadav Cornberg Eve
- Why Antivirus Fails at File Scanning | OPSWAT CEO Benny Czarny on CDR
- 100,000 OAuth Grants Later, Security Teams Still Can’t See the Risk
- Breaking the Sky: How Vulnerable Are Our Satellites?
- The Future of AI: Security, Ethics, and Human Augmentation
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.