Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria
/dev/ttyUSB0
Joined July 2016
- Tweets2.6K
- Following1.1K
- Followers11.8K
- Likes4.7K
Pinned Tweet
My research got featured on @WIRED today 😀
Misconfigured license plate recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes them by. wired.trib.al/0GrhVYG
I'm noticing decode tok/s maxxing is less important for hacking tasks.
This is from a gray box hacking session consisting of:
- static binary RE
- root shell on device for dynamic work
- active network service testing
Notice that decode tok/s is not the bottleneck...
It's tool calling. Agent thinks about a problem, makes a tool call, then thinks about the result. rinse and repeat.
I think this is really good news for pentesters wanting a good local LLM setup. I've been getting solid real world results from my 2x sparks running GLM 5.3 Flash.
(btw this session found a crit in an IoT device)
Matt Brown retweeted
More VRAM == better local AI? Not always.
We talked about hardware trade-offs in episode 197!
youtu.be/gKvIjE8LRVg
Matt Brown retweeted
github.com/mitmproxy/mitmpro…
That went fast.
Firmware scanning tool Mithril can now detect eMudhra style EC key flaws as well as many other weak key issues with the --keys flag!
github.com/nmatt0/mithril/pu…
Remember to unpack with Moria and analyze with Mithril ⛏️💎
Matt Brown retweeted
Thrilled to welcome @OpenAI as another target for Prompt2Pwn, our live hacking event at #NahamCon2026! 🎯
Only a few in-person tickets remain. Apply for a free tickets 👉🏼 nahamcon.com
Matt Brown retweeted
chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.
Benchmarking this now.
Open weights are pacing the frontier.
DeepSeek V4.1 Flash 1017 on 2x DGX Sparks
Frontier at home. No limits. 100% Private.
github.com/MiaAI-Lab/DeepSee…
I've found vulns exploitable over WiFi that were identifiable by SSID prefix...
One @wiglenet search is all you would need to geolocate a pwnable device.
I swear some of you people would have gone to the Chicago World's Fair and been like "AcKtuAlly tHat DoeSn'T sCaLe feAsiBly"!
I hate to be the one to burst the Tesla bubble today, but the spectacular “flight” we witnessed at the Roadster reveal needs a little context. The car is carrying around 250kg of compressed air, plus the weight of the tanks, valves and thrusters needed to contain and release it.
Based on the published figures, that gives it roughly 1.5–2 seconds of maximum thrust before the system needs to be refilled.
In short, it's a gimmick.
Matt Brown retweeted
All the details including the slides are now available at quentinkaiser.be/security/20…
Matt Brown retweeted
My presentation at Hexacon is done ! Time for public disclosure.
Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
The real alpha in hacking devices like this is obtaining a physical device (ideally multiple) to discover and test exploits against in a controlled lab environment.
BUT that makes firmware access trivial to TAs because the first thing they will do is dump firmware from flash. No need for public downloads.
As others have noted, not allowing public downloads does inhibit security researchers that don't have physical device...
