Joe Grand: The Hardware Hack That Can Never Be Patched

Joe: How's it going, Joe? It's Joe Grand (Kingpin): I'm Joe: great to have you on the podcast. I don't know if you noticed, but I think I was probably reaching out to you through different mediums for the past year. And I finally found your website. I don't know why I didn't think of it before. I finally found your website, submitted the contact, me or whatever Joe Grand (Kingpin): Yeah. Joe: it was. And I'm telling you right now, if that didn't work, I was going to hit up Paul Asadorian from... Joe Grand (Kingpin): Right, write me a letter or something. Joe: Yeah, I was like, Hey, can you like, this guy or like, send him a pigeon carrier, you know, like Joe Grand (Kingpin): Well, thanks for having me. mean, it's it's funny. It's funny that you say that because email, I guess maybe it shows my age, but like email is still the best way to get in touch with me because like social media, I don't go to very often. I get so many messages and so many potential like scams and spams and the sex bots and even just people who need help with different things. And it's super overwhelming. And anytime I'm on social media, it's like, OK, well, I'm not focusing on like a thing. Email is something I check every day, so I'm glad that you finally got to the email and that we hooked up, because this is awesome and thanks for having Joe: Yeah, no, I don't know why I didn't think of it earlier, you know, but it, you know, it's hit or miss, right? Like if I reach out to people on X, it's like 50 % if they're going to ping me back or whatever, you know, and that's always like, that's like the easiest, you know, low hanging fruit too, in terms of like trying to get ahold of someone new is like, well, I don't necessarily know your email, right? So like, Joe Grand (Kingpin): Yeah, yeah. And I used to feel bad, like, I mean, I would get like personally insulted if I send an email to somebody and I don't hear back. I'm like, why are they ghosting me? But then after now being in a position of like, sometimes I can't, I just don't have the time to answer email. And it takes me three months to answer it. It's like, right now I get it. So I won't take it personally. And hopefully nobody else does either. But like some emails, I just can't answer anymore. Because there's just, you know, I would just be customer service for random things and a lot of times my answer is like go to my discord or check out these resources because you know it's sort of a lot of times standard questions of like how do I get into hardware hacking how do I do this how do I do that so sort of guiding people in the right way but I feel bad that I can't respond to everybody but at the same time it's like yeah I want to have I want to have time to be able to hack and Joe: Yeah. Joe Grand (Kingpin): and sometimes I get to my email and I'm like you know it's like I know I have to do it but it's It's hard. mean, it's like being an adult is hard. Joe: Yeah, no, I really relate to what you said with getting the email and whatnot. Because I mean, I feel terrible. If you look at my inbox of people that are trying to get a hold of me to come on the show, it's Joe Grand (Kingpin): yeah. Joe: a couple pages on Joe Grand (Kingpin): Yeah, Joe: Gmail. Joe Grand (Kingpin): yeah, the triage like triage the stuff and then and deal with it. Joe: It's hard because like I can't I can't have everyone on right like it would take up 100 % of my time and Joe Grand (Kingpin): Yeah. Joe: if I have you on in February right your episode may not go live until May right like right now you know right then Joe Grand (Kingpin): Right, and that is David. Yeah. Joe: it becomes dated and it's not fresh or anything so like I mean I've really had to like pare down the recordings that I have like even right now you know like I have five ready to go and it's like but like I don't know I don't know I'm figuring out figuring it out as I go. Joe Grand (Kingpin): Yeah. Joe: I started this whole thing really because I was getting reached out to all the time on LinkedIn and Twitter at the time and whatnot, saying like, how do I get into cybersecurity? How do I do this? What search should I get? That sort of thing. And I remember when I was trying to get into cybersecurity, took me two and a half years to get my first security dedicated role. And that was like the most frustrating thing because I'd be constantly told you're doing the right things. You're you're you know, you're learning the right stuff, but we're not going to hire you, right? Because you don't have experience on Splunk. Joe Grand (Kingpin): Right. We need experience. Yeah. It's like, how do you get experience if you can't get experience? Joe: Right. I'm sitting here like, okay, how do I get experience with Splunk? I work for a small IT place. Like our product is open source. know, like Joe Grand (Kingpin): Yeah. Yeah. Joe: how do I get this experience? Right. And so like, it took me two and a half years and it, out of that frustration, I kind of created this platform of like having people on to kind of tell their story. Because I remember when I was going through it. All I wanted to hear was someone else, you know, that went through it, that was successful and I didn't find any of it. Yeah. Joe Grand (Kingpin): Yeah, and someone else's experiences. And you know, it's interesting that you say that, what I found through a project I'm working on now, which we'll talk about later, everybody has a story. Even if they're just getting into the field, you know, how they found it is a story. And like somebody who's been around for a long time has stories. And I think that's a super interesting sort of human side of there's, yeah, everybody has something to contribute. and in your podcast, it's like, what if you, could have like mini episodes of like five minute lightning, you know, storytelling or something, because so many people of all these people that reach out to you, probably all of them would have something interesting to say from a different perspective, even if it's just like I spent two years trying to get a security job. And then I realized that I could, you know, publish all my stuff on GitHub and then people see that I'm doing things and then get hired. So yeah, I don't know, but it's so interesting. Like people and the hacker. the cyber security community and yet, you know, they're kind of different but there's this Venn diagram of overlap. Yeah, super interesting. Joe: Yeah. Yeah. It's, it's definitely fascinating. Well, you know, Joe, we kind of like just dove into the conversation, but, you know, why don't we start with you? You kind of giving me your background, you know, how did you get into, you know, this space? Like what intrigued you all those years ago to say, I want to go down this route, right? Like what does that path Joe Grand (Kingpin): Yeah. Joe: look like? Joe Grand (Kingpin): So I guess the short ish version is I got my first computer was an Atari 400 in 1982. So I was seven years old. I had an older brother that was into computers. So he sort of taught me how to copy the games and play the games. He introduced me to bulletin board systems where that I could communicate to other people and really just started trading games with people. And as I kind of got older, into my teenage years, was like discovering, not just trading games with people, but trading passwords and sort of this underground, this hacker underground at the time, which was very small and very localized, but you could connect to different people through through bullet board systems, know, early forums through through a modem. And for me, it was just this natural connection. Like I know a lot more about myself now than I did when I was seven. But having that computer was sort of this gateway. I just connected to it. Like it was just a natural interaction. We're like dealing with people, not a natural interaction. Like playing sports, not a thing. Using the computer was a thing. And at the same time, I was also into electronics. So there's a lot of like hobbyist electronics magazines. There was a local electronic store that I could ride my bike to. that was about half an hour bike ride away. So it was like this adventure to go buy electronic components that I could then build with. And it wasn't radio shack. It was like a better electronic store. And, so I'd build electronic things out of magazines and then start screwing around with those. So really early on being a hacker, wasn't something that was a career. It was just something that, that you were doing because you liked computers and you liked technology and kind of screwing around. And I was sort of. As in my teenage years, I say I was like a technological juvenile delinquent. Like by the time I was a teenager, I was kind of causing trouble out in the real world also. But the computer for me, it was just a fun way to kind of screw around with people, screw around with companies and get free phone calls and do all these things. But it wasn't a career. It was never a thought. My thought from very early, probably around 10 years old, was I'm going to be an engineer. I'm gonna design products, I love electronics, I'm gonna do this as a career. And I remember in fifth grade, there was a Halloween party, and everyone's dressed up in different costumes, and I'm there wearing kind of a navy blue sweatsuit, pants and shirt, carrying around a floppy disk, a five and a quarter inch floppy disk. And people are like, what are you? I'm like, I'm a hacker. And it was just like a fun thing because it was so different. But engineering was like, I was gonna go down the engineering path. I was gonna be an engineer. Hacking was just a way for me to sort of, I guess, express myself. And ultimately having knowledge and power that normal people didn't have. Joe: Yeah. It's really fascinating because you know, that skill set is such a, it's such a unique skill set of being able to, you know, hack, hack your way into different things. I wouldn't call myself a hacker by any means. Right. I mean, I haven't done the offensive security stuff yet. if I can ever finish up this, this dissertation, I'm going to start going down that path in terms of. you know, asserts and whatnot, because like, that's how I just learned best. Honestly. I kind of just like need that structure, I guess. but. Joe Grand (Kingpin): Well, it's like somebody go into a personal trainer, right? It's like the information's out there, but if you can go to somebody that's helping you, kind of guiding you through it, then you can get the knowledge the way that works best for you. Joe: Yeah. And I feel like you're, you're able to develop, at least for myself, you're able to develop that, that framework for your mind to say, okay, I have built in of reinforces framework. This is how I should be thinking about these problems and proceed from there. And then you're able to do a whole lot more. Like that's what I'm actually looking for. Joe Grand (Kingpin): Yeah, yeah. Joe: and yeah, it's, it's just fascinating because like you said, not everyone can do it. it. It kind of gives you an edge, you know, in a lot of situations where it's like, I locked myself out of my garage. Right. Like, all right. Well, I got to flip or zero. I'm just going to unlock it real quick. Joe Grand (Kingpin): Yeah, yeah. mean, I think part of it's a mindset thing for sure. Like I'll get emails and people will say, how do I become a hacker? And it's like, well, if you have to ask that question, you're probably not going to ever have that mindset. Like, yes, you can figure out how to use the tools and run the tools and do things, but I think the mindset is something that you can't teach. It's just there. And to me, it's this inherent, to explain it. It's just like this mischievous thing. Like I still feel like a teenager where I'm questioning everything. And I'm like, you know, when I'm hacking on a on a device, it's kind of like me against this thing that I want to break because they don't want me to break it. Right. It's almost as anti-authoritarian Joe: Yeah. Joe Grand (Kingpin): thing, but not in a political way, just in like me against the device. Like it's hard for me to explain. And that's why I I teach a lot of I teach a lot of classes about hardware hacking and It's like when I teach them, it's less about like how to use the tools, which they, you people do have to learn how to use the tool, but it really is that mindset of like, okay, now I have these skills of using these tools. How do I actually apply them in a way of, being a hacker? and like what you said too, reminded me, I started training, in Brazilian jujitsu and some other martial arts earlier in the year, at the beginning of the year. And. It's that same sort of thing of like you're learning all these skills and you're being dropped into this fire of like, what the hell is going on? You're learning all these things, but as you progress, you start understanding your toolkit builds, right? You start understanding the defenses, you start understanding the offenses and little by little you're learning and that's, and you don't necessarily realize it at the time. And all of a sudden you're like, my God, I put these two things together and now I can, you know, choke this guy out or whatever. And it's the same thing with hacking or really with anything is like you're learning as much as you possibly can. And a lot of times you're exploring different avenues that may not make sense, but then you get to the point of like, I'm going to combine these things and all of a sudden it works. So I think it's a lot of, you know, a lot of repetition, a lot of experimentation and not being able to not being afraid to fail, is huge. like, yeah, taking the jujitsu has really just reinforced my mindset of like being a hacker. you're not always going to be the best all the time. You know, and like, I think a lot of times when people post stuff online and you like everybody has imposter syndrome, I would say in this industry, at least if you don't, something's wrong because every time I see somebody post something, it's like, my God, that's amazing. Why am I not doing that? And it really is something where a lot of times, you know, everything we see online makes it look so easy, but it's not like it's a lot of work and you have to really love it. and you love those failures and you say, how can I, how can I fix that problem? What was happening here? And then you, then you fix it. You succeed. It's like, yes, I love it. And then, you know, you go back into it. So it definitely is like, it's hard and you know, it's hard, but it's, if you like it you have the mindset for it, like I couldn't imagine doing anything else. And the fact that this has turned into a career that I can like support my family to me is mind boggling. Like I cannot Joe: Yeah. Joe Grand (Kingpin): believe that, that I'm a hacker at, as a professional. Like, Joe: Yeah. Joe Grand (Kingpin): who knew? Joe: That's a weird thing to think about. It's like a mental shift. Because I feel like you're taught your whole life, like, okay, get a nine to five, support the family. But once you start doing things on your own, it's like, wait, this is all on me. If this thing fails, my kids don't eat. They're not Joe Grand (Kingpin): Yeah, that's right. Joe: going to school that they want to go to or whatever. Joe Grand (Kingpin): That's right. Joe: The stakes are instantly real. Joe Grand (Kingpin): Yeah, yeah, it's Joe: It's a weird pressure. Joe Grand (Kingpin): it is and it's super satisfying, but it's also really scary. And now so I've been independent now for 23 years. So before I had kids, I sort of took this path of like leaving at stake, which was one of the first computer security consulting firms that came out of the loft, which was the hackerspace that I was involved in. But I was young enough and had no responsibilities of like, I'm to go off on my own. I'm going to do some engineering consulting work because I was actually a professional design engineer for a couple of years until we started at stake until we became professional hackers. And I was like, I'm going to do engineering consulting work. I'll give some talks. I'll do whatever. And didn't need a lot of money to survive. You know, was like, let's make sure we can pay rent, eat food and support my habit of this stuff. So it was very minimal. And it just took a long time to turn that into something that that at least I could survive on it. And the industry was growing at the same time. now there's a lot of, there's huge cybersecurity budgets, not every company, every, most companies are aware of the need for security, the need for continuing education for their employees. So there is this huge industry now built around the stuff that essentially we were doing as kids. And now we can help educate other people about you know, cybersecurity and hacking and all of these things. So it's sort of just been nice that the industry has grown also. So there is a budget that supports essentially, you know, what we love to do. But it's, yeah, it's just, think, being very, very lucky and fortunate that this is, this is the place to be right now. Like I always worry about, I'm kind of on the older end of things now. Like some people are like, you don't look that old, but like, I am old enough that I get worried that somebody's gonna say, well, we don't need Joe anymore. We're gonna hire somebody younger who doesn't have gray hair and whatever. And it's like, because when I was younger, like you see somebody old, you're like, cobalt. Joe: Yeah. Yeah. Yeah. Joe Grand (Kingpin): They don't know what they're dealing with with modern stuff. so sort of this ageism or aging out, like that's my fear. On the other hand, The beauty, especially with what I do with hardware hacking is there are new techniques that come out, but the structure of hardware hacking, and I would say the structure of any hacking, that base process, that base knowledge is always gonna be there. even, I'm still keeping up with newer attacks and everything, but it moves slower, I think, than maybe the software world or the network world or something. But yeah, that's my fear. That's my fear of like, you know, Joe's been around for so long, but he's kind of like this old gray beard, whatever. And, you know, that's, guess on one hand, that's okay because like we do need new blood coming in and new perspectives, but at the same time, it's like, well, shit, what am I going to do if people stop hiring me? Joe: Right. Well, I think it's also. You know, I feel like personally, I feel like that would be the case, you know, for a lot of people in many different situations. But if you're going to be successful in security, you have to keep on learning. You have to keep evolving and discovering Joe Grand (Kingpin): percent. Joe: new things and learning just overall. And earlier on in my career, I was working for a fairly like well-known investment firm, not a hedge fund, they were wealth management. Joe Grand (Kingpin): Okay. Joe: It was a wealth management fund and there was one person that was there for like, you know, 20 years. All he did was sock work and he only did like a certain like subsect of tickets only worked on a, very few, you know, tools that we had. No one else even touched it or cared about it. And like I, I told him like, Hey, you should probably like, you know, learn other stuff. Like, what happens if we just get rid of this tool or we don't work with that anymore? Or, you Joe Grand (Kingpin): Yeah. Joe: know, we solve this problem that, you know, it can be solved with a script, right? Like, what happens if that happens? You know, he's like, Joe Grand (Kingpin): Yeah, or AI. Yeah. Joe: that'll never happen. You know, it's a good company. I'll be here. And as soon as COVID happened, he was the first one to get laid off. It's like. Joe Grand (Kingpin): Yeah, well, that's interesting. So two things there. One is, when I was growing up and entering the engineering industry, you could get a job at a company and you would be at that company for your entire career. 20 years, 30 years, like that was just, you get a good solid job in there, you're good to go. And now I feel like staying at a company for two or three years is amazing. I don't think that stability of job security is there anymore. And the problem is if you're then in a job or a career for too long and then you get dropped, now you're older and you've been kind of pigeonholed in this one task. And then how do you sort of proceed to the next thing that happened to a friend of mine that's not in the hacker field at all, the technology field, but a different industry. His whole department got cut and suddenly, and then he, you know, have to scramble to find something that he can fit into and I think that's, of course, that's a risk and some people like having that stability while it exists. But as sort of a kind of distrusting person anyway, I think it suited me really well to go independent and take the risk of, you know, having to hustle to figure out how I'm going to make money, but at the same time, know that it's all on me and that I'm not relying on somebody else to maintain my position in a company. So it's a different level of uncertainty. At the same time, like you said about learning, yeah, 100%. You have to keep learning and have to keep exploring and experimenting and failing. I did a lot of that through some of the cryptocurrency wallet recovery stuff that I had been doing because there were so many interesting projects of different types. It's like, I need to learn about this. I need to learn about this. So it had this motivation of learning. But at the same time, I have stuff that I'm working on. for no reason other than it super interests me. I can learn something from it and then I can turn that into a talk and I can share my experiences with it and put that out there and continue to sort of put my work into the world that other people can learn from and then do something with. But yeah, you have to love it and you have to keep paying attention to what's going on out there and kind of screwing around. But also I think the failures is a huge thing. I mentioned before of like being okay with failing is part of the process. like, sometimes it bruises your ego, right? It's like, no, that didn't work. Or I totally fucked this thing up. That's what happens. And like, you know, there's probably a million different quotes about, you know, failure is this, you know, whatever gets you to succeed or whatever it is. Like you learn so much by those failures. And I've actually given talks specifically about failures. So people say, okay, I guess it is okay to fail, you know? And it's like, that's how you learn. And that's how you come up with with interesting things. Even if you're just replicating somebody else's work, you know, something might be online and and you're you're cloning their repo and you're trying to compile something and it doesn't work. It's like, all right, now you have to figure out why it doesn't work. all yeah, all of that's important. And I think that really happens if you're passionate about what you do and if you like if you like what you do and you're interested in the in the things you're playing around with. is important. But if you're sitting back just collecting a check nine to five, you may not be exploring those things. So if you let go at some point, you're kind of screwed. Joe: Yeah. Yeah. It's, you know, it's great that we like talk about failing, right? And I remember earlier on in my career, like one of the first jobs out of college, I, I was essentially like a Linux admin, but I focused on like our, military and, federal agency clients. And so, you know, they had a requirement of deploying SC Linux onto like everything that it could be deployed on. was deployed on and I don't, you know, I don't know if SC Linux was like new at the time. to be honest with you, it probably wasn't, but there was literally no documentation on it. And of course, you know, our devs put together a SC Linux module and they're like, Hey, if you're in this environment, you gotta deploy it. And then you start everything else. I deploy it. And of course, like no one on my dev team tested it. You know, they never tested it to see if it like. Actually deployed or if the application actually worked after deploying it, you know And sure enough. I mean I'm on site at a customer you know in in in their data center, which I probably shouldn't have even have been in and This thing fails the entire app crashes. I can't bring it back up I'm learning SC Linux like on the fly, you know, Joe Grand (Kingpin): terrifying. Joe: I go back to my hotel room I'm like looking up everything I can on SC Linux, you know And I remember like flying back because I was basically defeated. had to revert to a backup. Joe Grand (Kingpin): Wow. Joe: And I said, okay, give me two weeks. I'll fly back out. We'll do it. And I just remember those two weeks. I I failed thousands of times and people would probably say like, that's an exaggeration. It's like, no, you can ask my coworkers. I'm actually still friends with a couple of them. And like they describe it as You know, they would hear me, they would hear me like cursing under my breath at this command line. And then all of a sudden they would just hear my mouse hit the side of my cube and I would just get up and walk away because like I'm, building this thing out that the devs, you know, told me that they did. Like Joe Grand (Kingpin): Yeah, yeah. Joe: I'm learning it on the fly, but if you fast forward six, seven months. You know, when one of one of our other customers, it wasn't one of my customers, it was another, you know, coworkers customer had SC Linux deployed in their environment. My coworker could not figure out what to do, how to get it to work or anything like that. I here's the 10 commands. Like this is all that you need. Right. And he's like, I don't know how you figure that out. I was like, yeah, I figured it out when I was throwing that mouse up against the wall because I could not figure this stuff out. Joe Grand (Kingpin): And wanting to rage quit. Joe: yeah, I wanted to just like walk out and be like, I'm done. You know, I'm done here. I'm not doing this. Joe Grand (Kingpin): What's that saying? It's like, you know, fame come overnight, overnight success takes 10 years or, something like that of like, there's all Joe: Yeah. Yeah. Joe Grand (Kingpin): of this legwork of learning and trying and like, you don't magically become an expert in anything. And if anybody ever says they they did, or if they if they think they're an expert, and you know, they're probably not if they haven't haven't failed and gone through sort of that pain of whatever it is and the embarrassment of something happening. Yeah, I mean, it's brutal. Like it definitely brutal, especially when you're dealing in a live environment or with the customer. I actually just gave a talk at where was I? I was at besides Brisbane in Australia last week and gave a talk called hacks under pressure of sort of thinking back to situations where I had to hack things live with cameras watching customers watching and how much that changed the approach and really how it changed my love of hacking. Because when you're doing it and everybody's watching and expecting you to succeed is a much different thing than when you're doing it for fun or you're doing it in an environment where you can fail and learn from that and write a document about it, give a talk, whatever, of just this high stress of doing it live. And it reminded me of like, yeah, there's a lot of times where If you're working on a, you know, some live installation or whatever, like, we've seen systems go down all the time of people pushing updates and not testing them or whatever. And like, it's a, it's super terrifying and like kind of a fragile infrastructure, just in general, right? takes like just somebody making a mistake to kind of make everything tumble down. Joe: Right. That's probably like the most stressful, like high stress hack that you could do. Right? People are watching you live, cameras are on you, watching you hack this thing. Joe Grand (Kingpin): Horrible. Horrible. Not recommended. So I kind of equated. Joe: It sounds like a government facility, you know, like it sounds like a government facility where they're like watching you like that. Joe Grand (Kingpin): Yeah. Well, it's, it's funny. Like I, I'm not a doctor, but I could only imagine being a surgeon is kind of like that, you know, like you're doing brain surgery or heart surgery, any type of surgery. have all these people watching your assistance, whatever, and you're expected to succeed in whatever surgery you're doing. and a friend of mine actually is a surgeon and, he basically is like, I just disassociate, you know, the task with the, with the, with the patient. So they're really like, if they're doing surgery on on an eyeball, it's not, you know, Johnny from, you know, my my gym or whatever, like, it's an eyeball, and you do what you do on the eyeball. So that was actually really helpful for me, because when I started doing a lot of wallet recovery, and really, there was a couple projects where there was supposedly high values of money, and I grudgingly let people come to my office here, which is a garage. outside of my house, but it's on my property. And then we filmed it, of course, to make videos. And I tried to do that same thing of like, this is not a device with potentially $66 million. It's a chip that I've hacked 50 other times. Let's just go through that technical process and do what I know I can do, not thinking about the person, not thinking about the cameras, not thinking about the value. though it is easier said than done, know, and everybody's watching you and the lights are on and it's hot and you're hoping it works like whole other level of pressure that I probably am not going to choose to do again. know, like giving, giving Joe: Yeah. Joe Grand (Kingpin): live demos at a conference is fun because you have the demo gods and is it going to work? And everybody's sort of rooting for you success or failure, but when you're dealing with somebody's device, if you wipe it or corrupted or break it or whatever, I couldn't imagine like it would be it would be horrible. So luckily that didn't happen. Knock on wood. But yeah, huge amount of stress to the point of like, I don't really enjoy that. You know, I would rather hack on stuff on my own time and really get into it. Not not do this sort of live dog and pony show, if you will. But yeah, definitely like it's it's a whole other level when you add live live to it. Joe: Yeah. Because I, you know, at least I know of one situation, right? Because I watch her YouTube videos. But how did you, how did you actually like get into hacking the crypto wallets? Right. Because I feel like, I don't know, in my opinion, you always kind of heard about like one or two off of these like crypto wallets, you know, being hackable. And you essentially just always just heard Go to ledger. Ledger's uncrackable. Joe Grand (Kingpin): Yeah. Joe: No one hacks it. So, okay. I have a little bit of crypto, nothing that's life-changing. If it goes up to a million dollars, cool. You know, I put in like a hundred bucks or whatever, right? Joe Grand (Kingpin): Yeah. Yeah. Joe: Like I don't care. And so I just throw it all on the ledger. And then, you know, your videos came out, I think specifically on like the Trezor wallets. Joe Grand (Kingpin): Yeah, yeah. Joe: I don't know if I've seen you hack any ledger wallets. But like, how do you make that, that pivot? Because from a, from a hacker mindset, someone says, this is unhackable that immediately. mean, personally, it makes me want to try and hack it. Right. Like, and I'm not a hacker. So Joe Grand (Kingpin): But yeah, yeah. Joe: I would assume immediately from your perspective, you're like, all right, well, we'll see, you know, Joe Grand (Kingpin): Yeah, I mean, that's a lot of a lot of like all the products I've broken over my entire life. Almost all of them started with somebody, you know, being like, this can't be hacked, or we have good security or whatever. It's like, okay, let's prove that. In the case of the wallet hacking stuff, like, so I don't own any cryptocurrency, and I wasn't into cryptocurrency before, and I'm not into it now. It just was an interesting technical challenge. And it really started in the first wallet hacking video, we we filmed the whole thing. Cause my wife, you know, as I started hacking, she's like, we should be filming this to, know, you should film this to show people that you're still a hacker. Cause a lot of my stuff at that time, I'd been filming just, know, with my phone, engineering tools, whatever that I was working on. And basically a guy had emailed me and said, I'm locked out of my treasure one hardware wallet. I have $2 million on there. Can you help me? And I was like, that, you know, I get a lot of emails. Like we talked about before the show, like just a lot of email and I can't necessarily always answer all of them. But this one was well written, of piqued some interest of like, ooh, this might be fun. I had already known there were some published vulnerabilities about the STM32F2 and the Tresor Model 1. So the F2 is the microcontroller inside of the Tresor. It's a general purpose microcontroller. And some friends of mine had given some talks at Black Hat and other places about like, yes, you could defeat security in certain ways for certain versions of Trezor to get the recovery seeds back out. And this guy who had emailed me had that same version. So I was like, I could just replicate my friend's work. How hard could it be? Right? And it's Joe: You Joe Grand (Kingpin): always like, when you think something is simple, it ends up turning into a project. And... And this was something really, this was the motivation for me to learn a technique called fault injection, which at the time I'd known about it. and it was basically it's an advanced kind of hardware hacking technique, that you're basically trying to intentionally cause some sort of failure in the device at a certain point in time, either through voltage, changing your voltage levels really fast or through electromagnetic fault injection or with the laser, all these different ways, to, have something fail in a way that's beneficial to you. And in this case, my friends had done the work to show you could do voltage fault injection at a certain point in time to defeat security, which would then let you get access to the recovery seat. So I had never worked with fault injection. So it was like this perfect motivation of like, can learn a new technique and then I could possibly like free this guy's money. That turned into a three month effort and we filmed the live hack. Like the guy flew to my house here and And this was like a technical guy. was an engineer and had started a bunch of companies. it just seemed, that was, it was super stressful, but like I was okay with it because it was new and unique and like, this is going to be fun. I didn't know at the time how lucky I got with the success of that attack. And I just kept thinking as, as we were waiting for the device to successfully fault, we're sitting there, you know, like this. Eating pizza. I'm trying to meditate. I'm like super stressed out because what I didn't know is that there was still a high chance of of erasing his device or there was a high chance of succeeding with the fault to defeat security, but not getting access to the data that was there. So it ended up working out, which was great. But at the same time, it was almost, it opened up this Pandora's box of like, okay, if this guy needs help, maybe other people need help. And that had turned into basically five years of doing wallet recovery for different people, different types of projects. And I really just equate it to like, I'm a hacker. this is an interesting technical challenge. I get to use my skills in a way that helped people. And it was really satisfying and interesting. And like we recovered a decent amount of money for people. but the stress of it definitely not worth it. And it took me a while to realize that of like, you know, There's definitely a trade off of like, have to watch your mental health at the same time as doing the work. And there has to be a balance. And I was full on one side, not paying attention to my mental health. And, you know, burnout is real in this industry and depression is real in this industry and like all these things. but yeah, I mean, it was a great way to get involved and learn, learn new techniques. And I just recently gave a talk at recon with my colleague, Leonard, who we'd been working on basically refining the technique that I used in that first video. for the past couple of years. And now we have a technique both for the Tresor Model 1, I should say the STM32F2 series of microcontroller, which is in the Tresor Model 1, the STM32F4 microcontroller, which is in the Tresor Model T. Any device we can defeat the security, get access to the flash memory, regardless of the product. Doesn't matter if it's a Tresor, doesn't matter if it's a Keepkey, doesn't matter if it's a hardware wallet or a toaster. or in an automobile or a drone or whatever. Same technique because it affects the boot ROM in the silicon itself. So the code that's running in the silicon, even the hardware that's running before the code runs. So we gave a talk at Recon about that a couple of weeks ago and the videos should be out soon and we're still cleaning up all of our code and stuff to release and different hardware we made. But it was super satisfying to go from sort of this one-off project to five years of like full on you know, stressful kind of work doing wallet recovery to then having this nice bounded, you know, framework of like, here's how you can do this attack. Here's how you could use this framework to set it up with a different chip, different device, whatever it is, and push that out to the world where for me, it's like this nice, you know, nice complete, complete arc of a project. Joe: That's fascinating. Okay, so... You know, when you're talking about code that that that is that low level like on the silicon itself, is that like a different language? Are you learning the new like framework of how it operates? Because I've never heard anyone talk about that before. And I would assume like the only people that know anything about it is probably the people that are actually designing it. And that's just like that just like blows my mind right there. Right. So like, what was that like? Joe Grand (Kingpin): Yeah, I I didn't even realize that chips will execute their own code before jumping to user code because the chips, when they power up, they still have to configure themselves. So there's going to be some hardware level stuff that happens. And then there'll be some boot ROM code that executes and then there'll be the user code, at least with modern chips. I'm not sure about early, early chips. So yeah, there's going to be code inside these devices and it's assembly language. It's not lower than that. guess technically there's going to be microcode and things like you see vulnerabilities in CPUs and stuff. But in the case of the STM32s, they're ARM core. And the chips actually, sometimes the boot ROM is locked. So you can't just get it from the device. You have to decap the chip, get access to the silicon, turn the ROM back into code. There's actually a tool, Travis Goodspeed has been working on one that was I don't know if it was based on or inspired by something that major malfunction had made. And I think the tool is called. I the original tool was called ROM par in this one. can't remember what it's called, but Travis Goodspeed on his GitHub. It's lets you convert sort of boot ROM mask back into code, taking ones and zeros, turning that back into like pretty wild. But other times, like with these chips, I keep looking over here because I have my little hardware hacking platform. the microcontrollers that are inside of of the, the STM32 probably maybe all of the series, but at least the F2 and the F4, you can connect with a debugger to a blank chip that doesn't have security enabled and just read that section of the memory space and you get the boot ROM. So now you can throw the boot ROM into Ghidra. You can analyze it, you do whatever you want. And then the beauty of that is if you find a vulnerability in a chip that has mask ROM like that, that can't be changed. you find a vulnerability there and they're not going to be able to patch it until they re spin the silicon, which really doesn't happen unless there's a huge amount of pressure on the vent. It's freezing. Joe: That's the cool thing. That's I mean like I could go like a million different ways with it, right? But like that, Joe Grand (Kingpin): yeah. Joe: you know, that's the cool thing about security is The the security industry is like so open about you know flaws and vulnerabilities even like high-impact You know items. I can't remember what I was even reading The other day but someone put it on X where it was like a hyper V escape or You know, like a management plane, you know, in AWS essentially escape and they found a way around it. I guess they gave this company, I don't think it was AWS. So please do not sue me AWS. Um, it was some other, you know, management layer company and I guess they disclosed it to them, you know, gave them 120 days to patch it. didn't do anything with it. And so the guy's like, all right, well, I'm just going to release it to everyone. Right? mean, like I'm going to punish you by Joe Grand (Kingpin): Yeah, yeah. Joe: just not acting right. Because like he did all the work. They didn't even pay him for the bug bounty or anything Joe Grand (Kingpin): Right. Joe: like that. You know, and like I love that about the community because it's like, hey, this impacts a whole lot of people, whether you want to admit it or not. You have to do something about this. Like whether I Joe Grand (Kingpin): Yeah, yeah. Joe: get paid or not at this point is irrelevant. We're going to make the world know. Joe Grand (Kingpin): Well, that was always, I mean, it's funny because like back so back when I was in the loft. So in the early 90s are, you know, one of the first, possibly the first, you US hacker space. Our whole thing was like, we are going to find vulnerabilities and we're going to we're going to fight for the user, you know, like Tron or whatever, like we're going to fight for the user. We are going to tell the vendor, tell Microsoft, hey, we found this vulnerability. And the typical response at the time was either being ignored or they would say, that, you know, interesting, but nobody's ever going to do that in the real world. So then we'd write some exploit code, you know, some proof of concept code and say, here's how somebody could do it. And then they go, OK, I guess it is a little more real. And sometimes they would patch it. Sometimes they wouldn't. And then we would say the same thing of like, hey, we're going to we're going to release this in 30 days, 90 days, whatever, because the users need to know that there's a vulnerability and they can figure out a way to protect themselves if you're not going to help. so we were sort of pushing this full disclosure kind of thing with software. You know, I guess it depends on the, on the, the response time of the vendor, but I think it was 30 to 90 days was sort of this common thing. You can push software updates. fine. hardware is a little bit different and over time, it sort of became this ethical dilemma of like with hardware, if we release everything, the vendor. may not ever fix the device because it's too costly to do so. You can't just push a software update. You have to re-spin the silicon. So it's super fascinating. And I remember having this conversation with my wife. Again, she's not technical, but she's always behind the scenes for everything I've done. I'm like, you should do this TV show. You should film this video. You should do this. And I remember having this conversation about this work and actually even other work, the Roboform. software that I had hacked in a different video, basically finding a vulnerability in the way that they're seeding their random number generator to generate passwords. And with this hardware work that Leonard and I gave a talk about that we contacted STMicroelectronics in advance and said, we found this basically it's combining some other techniques along with our own special sauce to make this work. We got no response. And I remember talking to my wife of like, you know, should we give this talk? Should we be releasing all this information? And she's like, first of all, you are a hacker. Like your job is you're not at the whim of the corporation. Like you are at the whim of doing this work and discovering things. And if you feel like it's going to help the world, then you should be releasing it. I was like, what if I get sued? And she's like, that's, that's part of it. Like, this is the path you chose. And I thought that was really interesting because a lot of people I know are, first of all, are worried about getting sued if they release vulnerabilities because there is a real risk as a researcher to getting a company basically to try to stifle you by just suing you. So the fact that she was like, do it, you know, is super great at the risk of like, I do have corporate protection of my company, right? Like, it's not like they're going to go after personal assets necessarily, but still, like nobody wants to get sued. But the fact that she was like, you have to release it. But it does. It does throw this interesting layer of, you you release something that essentially can't be fixed. But then for me, it's like, well, you know, these devices that are used, they've been out for a really long time. They're in billions of devices. The vendor has, has explicitly said they will not fix the problem. So I think the information should be out there because somebody needs to compel them to, to, to be aware of like, okay, maybe we should be responsible for security. If we know there's a problem. Maybe we should be fixing that. What's super interesting is with the STM32F4 that we were looking at, we were experimenting with a couple different devices. even within that family of F4, there's the F405, the F4 or 417. I don't know. I can't remember. Different variations of it. The one used in the Trezor is different than just some other ones. So I grabbed a bunch of different F4s. I was reading the boot ROMs from them to compare like, were their differences because we were initially doing fault injection against the code in the boot ROM. And found one version of the chip that actually had some mitigations against fault injection. So the vendor had intentionally modified that boot ROM of that particular chip, but none of the others in the family. And we're like, well, that's interesting. Like, it must be a customer that has some huge power, probably a government, right? That's like, you need to fix this problem so there's mitigations. And I just thought that was interesting because they didn't do it across their entire platform. And when I was originally doing the work back at the beginning of this process, I reached out to STMicroelectronics and said, because my fault injection wasn't working, trying to replicate my friend's work. I was like, well, what's going on? So I emailed STMicroelectronics. like, you might be aware of this work that was published about hacking these chips. Have you fixed the problems? Because I thought maybe I had a newer version of the chip. And they write back and they're like, yeah, we're aware of the problems. No, we haven't fixed them. We recommend that you buy this newer, secure device, essentially more expensive, more features, blah, blah, trying to upsell me and move me away from a device that potentially would have suited my needs. So they admitted to not fixing it, basically trying to push engineers to other devices. But being an engineer, I know that engineers are going to choose the device either that has the minimum amount of things they need for the lowest cost, or they are told by management or whoever, you need to use this particular device for whatever reason. So engineers don't necessarily get to choose something that might have better security features. And even if it does, doesn't mean that it's more secure. It just means maybe somebody hasn't hacked on it yet. Joe: Right. Joe Grand (Kingpin): But they admitted to not fixing it. And then when we sent the vulnerability report over to them, we got no response. So there's this whole range, like hardware definitely is interesting. And I should mention that ultimately our attack that we're doing on these devices, it's not even in the boot rom. It's even earlier. It's when the chip is powering up and it's doing something in hardware, like it's reading some registers and pushing them into flash like with logic. That's where we're messing with it. So it's not that they could even patch the code. They would have to change the actual boot up process of the chip, which to me is even mind blowing of like, wow, they're not going to do that. Right. It's just chips will remain vulnerable forever, which I think is super, super interesting from a hacker perspective, but also like kind of scary depending on where these things are being used. Joe: Right. Well, what's the what's the actual, you know, attack surface of it? Right. Because and I ask because you know, at least from your videos, right? Like you're in your you're in your space. You have microscopes on it and everything. It's different from if someone walks by, let's just say a camera that has this chip in it and they're they're trying to like. connect to it wirelessly and manipulate it like that, right? It's different. like, I guess it would be a different risk profile based on the company and the use case, right? Joe Grand (Kingpin): Yeah, for sure. Yeah. mean, you you have network connected devices, so you have a different entry point, right? You can do network style attacks. Most of the work that I do is very board level, system level, physical access to the devices. There are some times you could do the attack in situ, meaning like maybe you have the product, you can just wire up some things to it, attach it to your attack platform and do something to it. but you would need to really study that product in advance to know the right way to do it. It's like building a mod chip, right? Like you could build a mod chip to do something in an existing system, but you have to do the research first really specifically for that device. But it is physical attacks. And a lot of the work I'm doing is in my lab and the safety of my lab. I can get the products in, open them up, do whatever I need to do. But I think at the same time, that that might give vendors this false sense of security of like, well, if we just physically protect the chip or we physically protect the product, that's gonna help, which it doesn't. So it depends on your threat, but most of the time, I guess I shouldn't say most of the time, but many times you can get physical access to something and do the attack. And maybe that attack is really just to like, say I'm hacking a device that is a network connected device or is. some military thing I'm not going to have access to physically, but I know what the chip is. So, or maybe somebody gives me one device to mess with first. Like I could get the firmware out of the device, know, hack it, get the firmware out, then reverse engineer the firmware. And then maybe from that find a vulnerability that doesn't require physical access and then do that on the real thing. This network connected. So there's, you know, it's not always like you're just hacking one device to defeat some security and win. It might be you're defeating security to get something that then is going to give you something else, credentials or whatever, to then attack the real system. So if vendors are just relying on physical security of things, that may not be good enough because somebody might be able to get another device to mess with. Like an example is the parking meter. So I'd hacked the smart parking meters in San Francisco back in 2009. I guess you could potentially go to a parking meter and start doing work on it in real time. which some of it I did, but I ended up finding a parking meter of that same vendor, similar product that was like decommissioned from a different city, bought that on eBay, got it to my house, analyzed it, tore it apart, analyzed it, did my preliminary work on it. And then I could go to the live parking meter and do the rest of my attack and then create a smart card emulator and do it against the real thing. So even something like that, or like some skater equipment or industrial equipment that Normally a hacker, you know, in theory wouldn't have access to, you can find something similar to do your work on. So the whole thing about, you need physical access first, like, is not a great level of security. Joe: Yeah, no, that's a really good point. You know. to kind of maybe like circle back just a little bit. So you're doing your own thing, you're independent. How do you find customers? Because I would assume how you find customers for hardware hacking is extremely different from how firms find customers for pen testing, right? What's your like key to the... Sorry for the coughing. Joe Grand (Kingpin): Yeah, yeah, I mean. Joe: I'm like getting over a cold or something, but like. Joe Grand (Kingpin): I think it's, I mean, I think it's similar. Like my, I don't advertise. I think a lot of the, a lot of the, the projects I get are through word of mouth. and really almost everything I do now is training. so I'll go, you know, do a couple of public conferences where I'm doing my hardware hacking training classes. and generally what happens is somebody at one of those public conferences then goes back to their. company or their facility and says, hey, we should bring Joe in to do that on site. So it's a lot of word of mouth. I think that the videos going viral, that's super interesting. And it's fun that people get to see these videos. But that's a different audience. The YouTube audience is not the audience where I'm providing trainings to. But I think in whatever way the SEO stuff works is if somebody's searching hardware hacking, my name comes up, they find my website and say, We want to learn about this. We want to learn about hardware hacking. So it's just very organic of somebody reaching out. sometimes, usually what happens is the fall and the spring are really busy as far as I'm gone a lot, and I'm traveling, and I'm doing classes on site. But then the summer and the winter are really slow. Sometimes no work. It's July. I know that I don't have anything scheduled until September. So it takes a lot of planning and part of that was intentional so I can be at home and actually enjoy the summer for the first time in decades. But it's a little bit scary of like, holy crap, what am I gonna do? How am I gonna like, I need to teach for classes. Sometimes I'll reach out to customers and be like, hey, just so you know, I'm ready for 2027, let's get stuff on the calendar. And then what ends up happening is sometimes I overbook in the spring, in the fall, so that I'm gone even longer. but it is this roller coaster and it might be that the talks I give, just like a lot of times people will give a talk at Defcon or Black Hat basically as a way to market themselves. I don't use it in that way, but I'm sure there is an effect of that, of like, my name has just been out there for so long. People find it for hardware hacking, but I don't do penetration testing. I'll pass that off to friends of mine that actually do pen testing as consulting work. given my time at stake when we sold the loft and started a consulting company, like I realized I'm not a great consultant. And even when I was doing hardware design for people, it's a different relationship, right? This client customer relationship is different. And you have to be really good at managing those relationships. And especially as a technical person where non-technical people either don't understand your capabilities or they minimize them and don't realize they're as important as they are. as where with training, it's a very defined, here's what you're getting. This is my style. That's very public. You see Joe Grand in videos, you know how I'm gonna be teaching a class. You get what we've agreed on, project is over. And to me, that's very satisfying to be able to just check the box every week or every couple days of doing a class. So it just works, it works out. But there's times where... where my wife and other friends are like, know, imagine if you were doing something with these guys to build this company or whatever that that happened more in the past when I was younger. I was like, you could have been involved in this startup or this startup. And it's like, yeah, but you know, maybe I could have been a multimillionaire and retired, but what I have enjoyed the nine to five or the the all day sort of effort of building something. And I have done that before. And like I I didn't really enjoy it. So, you know, it's like, I'm definitely comfortable with the uncertainty and I'm comfortable with not overly advertising and just letting people find me as they need to. And that's good enough. You know, like I don't necessarily want to travel more and I don't want to travel less, but I like having this middle line of like traveling maybe, you know, once or twice a month or whatever it is. And that, you know, it's a good balance. Joe: Hmm. Yeah, it's fascinating, you know, for myself because I'm always kind of juggling several different things and it's always, that's always like a sticking point. Well, okay, I got this one. How do I get another? Right? Like, how do I start getting more of this? Right. And that might be like one of the biggest, you know, sticking point that a lot of people have is like, okay, well, I got the one. I kind of got lucky on that. Joe Grand (Kingpin): Yeah, yeah. How do I get more? And I Joe: How do I get more, you know? Joe Grand (Kingpin): mean, there's definitely two sides to that. Like one of them is if you say yes to everything, that's gonna you're gonna be really busy, which maybe is good. Like again, when I was younger and had no responsibilities, I was saying yes to everything and I was just working my ass off all the time. And maybe that helped sort of establish myself for later. But at the same time, like you have to be ready for that and being independent and being a consultant is definitely tricky. And sometimes saying no ends up being good. But there's something else with that. Yes, the other thing is like, just getting your name out there, I think it just goes back again to like doing stuff you love. And my kids are into this right now. One of them is like really into making music. One of them is into making kind of satire videos online. We're actually going to film a couple together as like a collab, which is going to be really ridiculous Joe: That's cool. Joe Grand (Kingpin): because he wants to like cross post on my YouTube channel and his and and it's all about just like doing stuff you love and creating things and putting things out there in the world. So there's this on it. There's sort of an un wouldn't say unintended, but it's your you're contributing without doing it as a paying job like you are making things, making tools. working on projects and pushing those out there. So you're kind of building your portfolio so you have experience. So then people might find you and say, I saw you worked on that project. Like, can you help us with this? Right? So in this downtime, if you're not working on something, just working on your own stuff and publishing that and giving a talk about it, like all of that stuff's important. Just so people see that you're working on things. But also like, I don't fully know because it's a much different world now than than when I got involved in it and much more competitive and many more people involved with things. And AI, of course, is going to get out the slop of stuff. And how do know if something is good versus something that's just crap AI that somebody put up some tool? But I do still think it's like whatever you like doing, do that and publish that work and get yourself out there. And I think people will see that passion. and that you love doing it. And then maybe you find a niche of like, this is what I really love. And it turns out this is what I'm good at. And for me, it was like, I think that I never expected to be a trainer, but I love being on stage. I love speaking and training was sort of this natural progression of that of sharing, sharing what I love and being able to take like these complicated concepts and then turning them into simpler things to understand, but also turning them into exercises where people learn. And it took me 30 years to realize that was my skill. So it's like, all right, let's do that, where I know that consulting is not my skill. And sometimes that's going to take a long time to figure that out. But once you find it, milk it as long as you love it. Joe: Yeah, yeah, no, that's a, that's a great point. You know, like it's a It's just it's just fascinating your journey, the hardware hacking like it's a I feel like it's a completely opposite world of even what I'm familiar with in security overall, you know, it's a. Joe Grand (Kingpin): Yeah, I mean, yes and no. Like, I think the mindset is the same. I always say like the mindset's the same, whether you're software, network, not even hacking, but you know, maybe doing development work or whatever. Like that mindset is there. It's just different tools, I think. Joe: Yeah. Yeah, no, that's a that's a fantastic point. Well, Joe, you know, I know we went over time. I really apologize for that. I try to stay stay on task. But Joe Grand (Kingpin): No, it's so... As you know, I could probably talk all day. So, yeah, thank you. Thank you again. I do want to mention though what I didn't say and I told you before, before we started recording is what I'm working on now. this... Yeah, Joe: yeah, let's do, let's dive into that. Sorry. Joe Grand (Kingpin): so this is not public and I haven't told anybody about it yet. But one of the things that I really love to do is travel and teach my classes. So I go to all of these different places. And I was talking to a friend of mine about it and I was sending him pictures of like, I'm over here, I'm over here. He's like, we should be filming this. So I'm working on a new video project that basically is sort of a travel show, exploring hacker culture around the world. And we will have a public teaser available soon and I will explain more later, but it is this very exciting thing for me where I'm out of the lab. I'm doing what I love to do. And then sort of being able to kind of be this catalyst to show off other people's stuff. You know, I'm talking about like everybody has a story. Now I can go and actually talk to my friends outside of a conference of like, what are you working on? What do you love? What brings you to this hacker world? You know, what's your mindset? It's almost like mini podcasts within this travel show. And I'm currently like, I've self-funded five episodes so far this year. We have one more that that's going to come later in the year. And then we have to figure out still how to release it. And I'm trying to figure out the best way that feels right as far as sponsorship of using other people's money to help pay for the videos instead of me. And this was another thing that my wife was like, you got to go do this. You love traveling, you love being on video. Do something fun instead of being stuck in your lab, being the monkey hacking over and over again. And so it's a super exciting project. More to come once we figure all of that stuff out. And yeah, but stay tuned for that and exclusive on security unfiltered podcasts. It will be on my YouTube. Joe: That's really fascinating. Joe Grand (Kingpin): Yeah, it will be on my YouTube. I'll tell everybody about it. And it's something that I'm really proud of. And there's so many ways to go. You know, the hacker world is nothing's black and white. There's all this gray, even with cybersecurity, the Venn diagram with hacking and you have, you know, black hats and white hats and gray, all these things to explore. And looking into it, not from like a journalist uncovering something, but like as a hacker nerd talking to other hacker nerds and other people and exploring a world where a lot of people don't necessarily understand it. And then doing the traveling and eating different food and trying things that I wouldn't normally do. Like, yeah, anyway, super exciting. So stay tuned for that. And and we will see what happens. Joe: No, that is, that's awesome. you know, that like reminds me of that one, I'm not gonna name them if I can remember, but it's some like YouTube show that, you know, I think some like well-known publication like put together and then they changed the name on the YouTube channel and it does something similar, but they always like make it sound just so, so much more dramatic than it actually is and. Joe Grand (Kingpin): Yeah. Yeah. Joe: You know, they have these shadowy figures on there that are like allegedly these, you know, WMDs of the hacker world. You know, like. Joe Grand (Kingpin): Right, It's a little overproduced and like, yeah, I mean, I kind of want to get back to my root. What's that? Yeah, yeah, that's right. Joe: Yes. It's hard for me to even watch, you know, it's hard for me to even watch because like I'm in the space. I know what they're talking about, but it's like, OK, you know, Joe Grand (Kingpin): A lot of us have pretty good bullshit detectors, you know, and like if something is over sensationalized or overproduced, it's not hitting the way that it should. And what's super fun is my director and cameraman, like he's been behind the scenes for almost everything I've done since COVID and he's not a hacker. He's not in this world. He comes from a filmmaking, like he loves filming. So having his perspective and my perspective. to explore these different things. Like, I don't know, it's just super fun and to have an excuse to hang out with my friends and like, and it's not going to be an overproduced thing. Like it is going to be as natural as, as I normally am. It's going to be as goofy as I normally am. And, hopefully people like it and hopefully it's something that, that I can get, you know, enough to self sustain it. So basically when I travel like to, be able to keep doing it, but yeah, I mean, there's, it's going to be, it's going to be fun to like, share that with the world and, and have something that feels more natural than like a super overproduced video. Joe: That's pretty awesome. I think that will actually like get a lot of people into the hacking space, you know, cause like you're. Joe Grand (Kingpin): Hopefully. And then, and then I'm hoping also of like, you should talk to this person when you're here, you should go to this space, you should explore this. Joe: Yo. Joe Grand (Kingpin): Because like, I don't really know much about any place that I go, I just might know a couple people there to talk to you. And that's the hope of like having the community or having viewers be like, dude, you totally missed this, you got to go here, you got to try this. And then you go back to those places and you just start, you end up with this big catalog of this whole world. And what I've already noticed is there's kind of these golden threads of of hacking throughout the world, but the motivations for it is different. Like the mindset's the same, motivation's different, whether you're in Eastern Europe versus Mexico versus Australia versus whatever. So it's super cool. like, I just want to get back to this point of like, you know, the hacker, I always talk about the hacker community, but now it's so much bigger than it was when we started. So is it really a community? I don't know. It's like sub. sub-communities. It's like villages at DEFCON, right? You have DEFCON is huge and you have these villages of people. I think that the hacker world, cybersecurity world is the same way of it's so big now. You have specialists, you have different things. You have people that are hacking like I did growing up, like mischievous, but also for learning. And then that turned into the loft where I'm doing it for education and kind of pushing boundaries. You have cyber crime groups, you have ransomware groups, you have all these things that... I didn't even talk about like people doing hardware implants inside of cryptocurrency wallets to steal funds. Like that stuff is so fascinating. So I don't know, like I get super excited about it because a lot of times we're only the only stuff that's that we see about hackers is this sensational thing put together by video production companies, news organizations, whatever. And then we have this great opportunity to like learn a lot about different people, learn a lot about different cultures. And yes, I'm super stoked on it and who knows what will happen with it. But yeah, I have all these ideas and then I hope other people will be able to also provide input of things. So yeah, very exciting. Joe: Yeah, that'll be awesome. Joe, you know, before I let you go, how about you tell my audience like where they could find you if they wanted to reach out your YouTube channel? I think it's just Joe Grand, but please correct me if I'm wrong. All the links will be in the description of this episode, of course. Joe Grand (Kingpin): Yep, yeah. So the easiest way is if you go to joegrand.com, J-O-E-G-R-A-N-D.com, I actually have a new website that I just need to finish cleaning up before I push it. Right now it just redirects to a Linktree page that has some links. You can also go directly to grandideastudio.com, which is like my engineering company that has all my projects on it. But yeah, those are those are the two and you can go everywhere from there. My YouTube is at joegrand.com. My social media, there's a bunch of different ones. If you just go to go to the go to joegrand.com, you'll see them all. I'm not that active on it. I'm trying to do better. I actually kind of need somebody to help me with that. But that's where I will announce, you know, if a talk comes out or if things happen, I'll put stuff there, but not not very often. I don't read comments because they stress me out. So if you want to contact me, go through my website, do the contact form like Joe did. And then you can get to me and I'll try to respond. But even if I don't, I appreciate you trying to find me anyway. Joe: Awesome. Well, thanks, Joe. I really appreciate you coming on. It was a fantastic conversation. mean, literally I could go for like another hour, but I'll definitely have to have Joe Grand (Kingpin): Yeah, yeah. Well, thank you. I appreciate it. Joe: you back on. Joe Grand (Kingpin): Yeah, thank you. Cool and happy happy Friday. I don't know when this will come out, but it's Friday now and that is a good thing. Joe: Yeah, absolutely. Well, thanks everyone. I hope you enjoyed this episode. Make sure you check out Joe at all the links in the description of this episode. Thanks guys. Joe Grand (Kingpin): Cool, see ya.