Joe Grand: The Hardware Hack That Can Never Be Patched

Joe Grand, aka Kingpin, hardware hacker, L0pht alum, and the engineer behind the $2M Trezor wallet recovery, joins Joe South on Security Unfiltered.

They get into how a kid with an Atari 400 ended up in the hacker underground, why the hacker mindset can't be taught, and what 23 years as an independent hacker really looks like. Joe Grand walks through learning fault injection to free a locked wallet, how he and his colleague found an attack on STM32 chips that happens before the boot ROM even runs, why a vendor that won't respin silicon leaves chips vulnerable forever, and why "they need physical access" is not a security strategy (see: the San Francisco parking meter he bought on eBay). Plus failure, burnout, full disclosure, and his new travel show exploring hacker culture around the world.

Chapters
00:00 Finally reaching Joe Grand (email still wins)
03:29 Why Security Unfiltered exists
05:36 Atari 400 to the hacker underground
10:00 The hacker mindset you can't teach
13:16 Going independent for 23 years
16:30 Keep learning or get cut
21:04 Failing thousands of times with SELinux
24:16 Hacks under pressure: cameras, customers, $66M
27:55 How the $2M Trezor wallet hack started
30:46 Learning fault injection
34:37 Boot ROMs, Ghidra and silicon you can't patch
37:04 Full disclosure and fighting for the user
43:53 Chips that stay vulnerable forever
44:34 Physical access is not security: the parking meter hack
48:02 How an independent hardware hacker finds work
52:28 Saying yes, saying no, and publishing your work
56:22 Joe Grand's new hacker culture travel show
62:57 Where to find Joe Grand

Joe Grand on YouTube: https://www.youtube.com/@JoeGrand
Joe Grand: https://joegrand.com/
Grand Idea Studio: https://grandideastudio.com/

Subscribe: https://www.youtube.com/@securityunfilteredpodcast
Show site: https://www.securityunfiltered.com

Affiliates
➡️ OffGrid Faraday Bags: https://offgrid.co/?ref=gabzvajh
➡️ OffGrid Coupon Code: JOE

➡️ Unplugged Phone: https://unplugged.com/
Unplugged's UP Phone - The performance you expect, with the privacy you deserve. Meet the alternative. Use Code UNFILTERED at checkout

*See terms and conditions at affiliated webpages. Offers are subject to change. These are affiliated/paid promotions.

Tesla Referral Code: https://ts.la/joseph675128

Follow the Podcast on Social Media!

Instagram: https://www.instagram.com/secunfpodcast/
Twitter: https://twitter.com/SecUnfPodcast