In this interview, recorded at CCCamp19, Alvaro chats with Johnny Xmas (@J0hnnyXm4s, github) about reverse engineering TSA keys/locks, web APIs, and more!

• Malört
• Jenny List
• Target Breach
• Photo from our recording location
• ICS
• Stuxnet
• MS08-067
• Deviant Ollam
• Deviant Ollam's "I'll Let Myself In" Talk
• IronGeek TSA Keys Video
• TSA Key 3D Models on Github
• DarkSim905, J0hnny XMas, & Nite 0wl - The TSA Keys Leak [HOPE XI]
• "The laws of mathematics are very commendable"
• Cool Tools Podcast
• Basin Wrench
• Postman
• Burpsuite
• StackOverflow April Fools Joke 2011
• https://www.kasada.io
• Zach Whittaker
• Luminati IP Proxy (TrendMicro Paper on HolaVPN and Luminati)
• MonkeySocks Proxy
• Web Application Firewall
• CCCamp19 photo from above
• Various more CCCamp19 Photos

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

In this two-part episode, Alvaro talks to three contestants of "The Box" contest at DEFCON 27 as well as Datagram, the creator of the contest.

Alex, Gina, and Phil joined for the first part of the show and Datagram/DG for the second.

DC27 Bomb Defusal Contest Rules

Videos from the contest in 2014:

• https://www.youtube.com/watch?v=jEabTPOXh04
• https://www.youtube.com/watch?v=sEcVAcTfuVI

"The Box" is part of the Tamper Evident Village. Check it out next time you're at DEFCON!

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

Jeri Ellsworth (@jeriellsworth) joins Jen and Alvaro to talk about her background, past projects, reverse engineering, and her company Tilt Five.

• Jeri was recently at Gen Con.
• Dirt Track Racing
• FPGAs
• Lattice Semiconductor
• CPLDs
• VHDL
• Verilog
• Betamax
• VHS
• Analog Delay Line
• Videocipher II
• C64 DTV
• C64 SID Chip
• [New Listener provided] C64 Leak Blog from 2004
• Siliconpr0n
• Demoscene
• QVC
• Slashdot
• C64 Bull Riding
• Amiga
• Altera
• Binvis.io
• Lua
• @esden's FPGA Workshop
• Xilinx Zynq
• Jeri's YouTube
• Jeri's Etch-a-sketch
• Jeri's C64 Guitar
• Jeri's "TSA" Scanner
• Jeri's latest Amp Hour episode about CastAR
• HBO's Silicon Valley
• Startups Anonymous
• Valve Software
• HTC Vive
• CastAR
• Gloom Haven
• TiltFive (@tiltfive)
• @wendys
• Penny Arcade
• Cool Tools Podcast with Jeri
• Tooth Brush for cleaning Flux
• Fiberglass brush
• @_mg_'s Reflow Video

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

Alvaro chats with Kate Temkin and Mikaela Szekely from GreatScottGadgets about USB Reverse engineering.

Here are some of the things mentioned:

• HackRF
• Ubertooth
• Frequency Hopping Spread-Spectrum
• GreatFET
• Michael Ossmann
• Dominic Spill
• USB 2.0 Specification
• Beagle 480
• libUSB
• pyUSB
• https://usbc.tf
• https://mini.usbc.tf
• usb-tools on Github
• USBProxy
• usbmon
• Sigrok
• Glasgow
• OpenVizsla
• Saleae
• Piotr Esden-Tempski
• 1BitSquared
• ViewSB
• Wireshark
• GreatFET Rhododendron
• USB Monitoring with Wireshark on MacOS
• PhyWhisperer USB
• Facewhisperer
• Glitchkit
• Nu-map
• usb-tools Discord Chat
• Ghidra
• IDA
• Pulseview
• hacking-usb on Github
• tg165-tools on Github

Rick Altherr joined Jen and Alvaro to talk about reverse engineering cars, server BMC's, FPGA's, and more!

You can find Rick on Mastodon @kc8apf and on his website: http://www.kc8apf.net

Rick will be giving trainings at RingZer0: https://www.ringzer0.training/system-firmware-attack-defense.html

Here are some links about the topics we covered:

• https://eclypsium.com
• https://ai.google/research/pubs/pub46352
• DE-9/DB-9
• Intel HEX Format
• S-Box
• EFI
• BIOS
• Real Mode
• PXE ROM
• BMC
• Dell's iDRAC
• HP's iLO
• IPMI
• U-Boot
• EFI - TianoCore
• Intel SVT DVI cable - For debugging intel systems.
• OpenBMC
• Yocto Linux
• FPGA
• Lattice iCE40
• ASIC
• TCL
• Chisel is a new high level language for FPGAs.
• VHDL
• Verilog
• FPGA LUT
• Lattice ECP5
• Yosys for FPGA tools open source synthesis.
• Next PNR - for ic40 and pcnb5/lattice
• Clifford Wolf's Interview on The Amp Hour
• Tomu
• Fomu
• Xxd - hex dump tool on command line
• Ghidra

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

In this episode, Alvaro talks to Major Malfunction at the Hardwear.io conference.

Alvaro first saw his Magstripe Madness talk at Defcon 14 (slides).

Magnasee

F2F Encoding

Magnetic Stripe Standards

Hardpwn contest

RFIDOt

Proxmark 3 developed by Iceman (patreon)

EMV

Adam's Github

Adam's Blog

RFIDler (Kickstarter)

HackRF

FUNCube

URH (Universal Radio Hacker)

Scapy

River Loop Sec's KillerBee

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

In another episode recorded at the Hardwear.io conference, Alvaro talked to Chris Gerlinksy(@akacastor) about ROM extraction and other IC reverse engineering tools/techniques.

Here are links to some of the things/topics mentioned:

Chris' Hardwear.io Talk

Chris' talk about cracking satellite and pay tv systems from 33C3

Micro-probing

Wet Etching

Chemical Mechanical Polishing (CMP)

John McMaster's SiliconPr0n.org

Implant ROM

Focused Ion Beam (FIB)

Reversing the Nintendo 64 CIC - REcon 2015

Chris' consulting site - http://pdrnorth.com

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

In this episode, Alvaro is joined by Jonathan Brossard to talk about the Witchcraft Compiler Collection during the Hardwear.io conference.

We talked about various tools/topics including:

• Moabi - firmware security automation tool
• Change.org
• Breaking Bitlocker - Defcon 16 Whitepaper
• Rakshasa Hardware/Firmware Backdoor
• Defcon talk and slides
• PE Binaries
• ELF Files
• QEMU
• strace
• Ltrace
• Address Space Layout Randomization
• Silent Disco
• Icecast
• IMSI Catcher
• SilentProtest.io
• SilentProtest Github
• RocketChat

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

In this episode, Alvaro interviews contestants and organizers of the Hardwear.io CTF challenge

First, we're joined by two members of the OpenToAll CTF team. Graziano and Antonius.

The second segment is with one of the creators of the CTF challenge, Philippe Teuwen(@doegox) from Quarkslab.

The third segment was with Team Pineapple.

Other topics mentioned/covered:

https://csaw.engineering.nyu.edu/ctf

https://nullcon.net

https://www.hitb.org

https://en.wikipedia.org/wiki/Tempest_(codename)

https://www.pjrc.com/teensy/

https://www.arduino.cc

https://www.nongnu.org/avrdude/

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)

This week, Holly Graceful (@HollyGraceful, gracefulsecurity.com) joined us to talk about her recent hardware reverse engineering blog series and her pen(etration) testing and security career in both public and private sectors. She tells us about how she entered the field via the military and some of those differences.

We discussed breaking down projects into smaller bites. We talk about why getting access to the JTAG (use it for...) port can be super easy in the consumer product and it may be more calculated than expected. The series ends with some key fob fun.

We do a minor round up of software defined radio and the USRP used with gnuradio. We catch up on what Alvaro is doing with his SDRs.

Holly is working on more posts so stay follow to be updated with the latest.

Links that came up:

• Pulse view logic analyzer
• Michael Ossmann (of Great Scott Gadgets) tutorials (one of many)
• Cheap: Jtag on arduino, Black Magic Probe, CortexProg
• Expensive: Jtagulator , Segger Jlink
• Radio posts/tutorial- by Oona Räisänen @Windyoona (Website)

Have comments or suggestions for us? Find us on twitter @unnamed_show, or email us at [email protected].

Music by TeknoAxe (http://www.youtube.com/user/teknoaxe)