Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria
/dev/ttyUSB0
Joined July 2016
- Tweets2.6K
- Following1.1K
- Followers11.8K
- Likes4.7K
Pinned Tweet
My research got featured on @WIRED today 😀
Misconfigured license plate recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes them by. wired.trib.al/0GrhVYG
Matt Brown retweeted
While this whole Purge, or Great Fire, is starting to roll over us we need to consider another quite disturbing thought.
We're all talking about software, but if you've been watching the AI maker space for the last several months it's become clear that hardware is absolutely on the board now as well. You can kind of point an AI at a piece of hardware and it just Neo's that shit.
So this isn't just an applications, services, APIs, libraries situation. It's also about to be a hardware, sensors, devices, Internet of Things situation as well.
And of course they're all interlinked: the software, firmware, and the hardware.
You guys think the Social Security Admin knows about integer overflows?
You can actually just do this; ssa.gov/number-card/requesti…
Matt Brown retweeted
In case you missed it, we are hosting #NahamCon2026 in person in Oakland with multiple live hacking targets, 15+ amazing speakers, and of course our flagship CTF! Would love to see some familiar faces, especially if you live in the Bay Area!
This is insane. We cannot allow AI agents to go into your bank account and act independently without your authorization. But that is what’s happening right now.
Left unchecked, AI could endanger the entire global financial system — including your bank account.
Pause AI NOW!
Readers added context they thought people might want to know
Per Axios, detected AI agents access bank accounts with the customer’s permission. This violates most banks’ terms requiring human logins, which is why banks call it “unauthorized.”
Source: Axios (Oct. 22, 2026) — axios.com/2026/10/22/ai-…
I'm noticing decode tok/s maxxing is less important for hacking tasks.
This is from a gray box hacking session consisting of:
- static binary RE
- root shell on device for dynamic work
- active network service testing
Notice that decode tok/s is not the bottleneck...
It's tool calling. Agent thinks about a problem, makes a tool call, then thinks about the result. rinse and repeat.
I think this is really good news for pentesters wanting a good local LLM setup. I've been getting solid real world results from my 2x sparks running GLM 5.3 Flash.
(btw this session found a crit in an IoT device)
Matt Brown retweeted
More VRAM == better local AI? Not always.
We talked about hardware trade-offs in episode 197!
youtu.be/gKvIjE8LRVg
Matt Brown retweeted
github.com/mitmproxy/mitmpro…
That went fast.
Firmware scanning tool Mithril can now detect eMudhra style EC key flaws as well as many other weak key issues with the --keys flag!
github.com/nmatt0/mithril/pu…
Remember to unpack with Moria and analyze with Mithril ⛏️💎
Matt Brown retweeted
Thrilled to welcome @OpenAI as another target for Prompt2Pwn, our live hacking event at #NahamCon2026! 🎯
Only a few in-person tickets remain. Apply for a free tickets 👉🏼 nahamcon.com
Matt Brown retweeted
chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.
Benchmarking this now.
Open weights are pacing the frontier.
DeepSeek V4.1 Flash 1017 on 2x DGX Sparks
Frontier at home. No limits. 100% Private.
github.com/MiaAI-Lab/DeepSee…
I've found vulns exploitable over WiFi that were identifiable by SSID prefix...
One @wiglenet search is all you would need to geolocate a pwnable device.
