Hack All The Things: 20 Devices in 45 Minutes

[@JamiePineappleWyatt]

Half you guys never get the reactions you're expecting, don't forget your audience is full of people just like you, these exploits are amazingly simple and you guys are awesome, keep laughing and keeping up the great work!

[@hacker.williams]

instagram.com/hackerpatrick60 the app instaripper"can find longin Password in faw min only. You may find it on Instagram

[@overjoyed4505]

@@hacker.williams few*

[@Nunya58294]

​@@overjoyed4505 moron

[@Nunya58294]

​@@overjoyed4505idiot

[@aunderiskerensky2304]

the more technologically advanced our security becomes the more absolutely a hacker can control every aspect of the environment around that system with virtually the smallest access flaw.

[@MrSpiderman1321]

he even hacked at his haircut

[@rikbakker5845]

MrSpiderman1321 hahahaha

[@MagikGimp]

+MrSpiderman1321 An actual bowl-cut. I never thought I'd ever see one in the wild.

[@paulbracken9280]

ddddvnncmmm?mf cc c c c.cmrmnfmfkfnrnmrmrfmfmrmmmrnrmrmkrkrr7

[@samdrone4125]

in the wild!

[@damejelyas]

Swaraj Panchal use correct english next time

[@speedplays6710]

sweet i can ddos my toaster cuz of this vid!

[@ycoihmn6388]

lmao ^^

[@danielharrhy9894]

Imagine hacking your ex's toaster and burning all her toast #itsthelittlethingsinlife

[@speedplays6710]

daniel harrhy lol

[@jjjhfam]

You could've DDoS'd your toaster anyway...just might not have done much

[@danielharrhy9894]

Let's overload her kettle so it won't work

[@mainHERO88]

That hans guy did a great job at explaining stuff! I've never dug into those types of boards and what not but he was good at explaining them into simple concepts I thought. Good work dude!

[@TheCynicalDude_]

If you have physical access to a device, there is no reason you shouldn't be able to root it.

[@TheCynicalDude_]

***** Whoa, buddy. Easy.

[@TheCynicalDude_]

***** Almost gave me a heart attack.

[@JasonScottHamilton]

Absolutely not true. There are plenty of devices that these guys can't crack. If the security and encryption is done properly, there's no way you're getting in. They've found certain devices that can be cracked through vulnerabilities and most of them are old, which I would argue means the manufacturers have hardened their systems against these attack vectors.

[@TheCynicalDude_]

+Jason Hamilton If a device *can* be cracked... and you have physical access, it is possible to root it/crack it, whatever.

[@ximecreature]

yeah of course, that's why they could give away UART keys for free. The fellony by hacking someone else's device by this method is actually theft; but their penetration allowed them to notice extremely bad security issues (the POST php thing is a beginner's mistake, hardcoded password is way out of the common programming practice, and so on...) that could potentially allow someone to introduce a device from outside. Hacking its own device may lead to loosing garantee, so you're still a villain bad hacker by doing so, even if it's basically and legally like dismounting your pen to know how it works then notice you can make a blowpipe with it. Still fun.

[@k_e_n_n_y_mccormick]

24:54 the geekiness

[@AlexanderHL1919]

He sounded drunk, plastered out of his mind. Made it a lot more entertaining.

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@johnmorganbryan]

Hmmm... time to create a light bulb bot net to DDOS stuff.

[@batuhangenc2021]

+instantaphex In couple of years "Everything is a computer if you think about it" would be acceptable. I wonder if jaden smith said this.

[@ffejpsycho]

+Swaraj Panchal First, the doctors will be required to allow you out of the facility to receive the money grams I will be sending. I wish you good luck.

[@SomeGuyFromCrowd]

It happened. God help us all.

[@BrysenJacobsen]

@@SomeGuyFromCrowd ayyyyyyyy look at us now, this thread aged well

[@bloguetronica]

Nice presentation! Learned a few tricks by watching this. This is useful in a security and hack prevention perspective.

[@lesleyeneasato6341]

Keeping tab on your SPOUSE isn't something i would request you dive into, nevertheless, if you still need to clear any cloud of doubt about what secretly goes on in your relationship, then engage HACKERS SUMMIT the platform i'd mention for all hacking purposes. They paid attention to details and delivered expertly when i hired . Contact via HACKERSSUMMIT .COM

[@bloguetronica]

@@lesleyeneasato6341 This is out of context. I don't even have a spouse.

[@sossupummi]

@@bloguetronica this video comment section is filled with bots, their sole object is to spread fear, doubt, paranoia and separation

[@bloguetronica]

@@sossupummi They are not being effective in the least. LOL

[@spydergs07]

The guy at 25:00, he seems to be addicted to Rockstar's... But don't tell him, he might hack my CFL light bulbs and catch them on fire.

[@curtallen7755]

000000000++

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@Buggerme75]

what scope is he talking about? couldn't hear the name correctly, to see the wave form

[@YumekuiNeru]

aha why was this deleted from the DEFCONConference youtube playlist "spam, scams, and commercially deceptive content" ? did one of the vendors get upset and report the video because their device was insecure?

[@thelurkingpanda3605]

motorola probably

[@egecoskunol3890]

Nah its because it says shit in the subtitle and that means less money for the publsiher of this video

[@623-x7b]

When they load their programs on the devices do they mostly use assemble to create the binaries or can they use C compilers to target most micro-controller's instruction sets?

[@Eatmykebab]

Usually you use something like ARM or MIPS Instruction set to attack it, they are simulators for that.

[@jaydenphillips-bradshaw2084]

lol every time this guy says root he laughs haha 26:06

[@jaydenphillips-bradshaw2084]

+CheekyRektan r u saying i have autisum or he has autisum?

[@NonsensGaming]

he has lol

[@readneuromancerbywilliamgi6761]

+Jayden phillips-bradshaw you too though

[@jaydenphillips-bradshaw2084]

k emps no fucks given

[@ranikheir5272]

Behind each snicker is a "MWAHAHAHAA" inside

[@hrnekbezucha]

It ends at 40:00. Leave it when it's still good.

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@mitchelbryce]

Why you keep posting the same link in every comment

[@blitzsh0cker652]

By downloading the link to the upload, you can hack time.Its true, I saw hackerman post a tutorial on it when he sent a kung fu cop back in time to fight Kung Fuhrer. Luckily Triceri-cops (his partner who is also a dinosaurs), viking babes with guns, a T-Rex, and Thor all came to too defeat the Nazis.

[@jpmendoza1982]

Blitz Sh0cker Too to*

[@MajkaSrajka]

Blitz Sh0cker TOO MUCH TIME HACKING!

[@boxbox6290]

Guys go into your mom or dad or your pc or laptop computer press and click on *system32* click delete it will get you into evreyones accounts ie facebook twitter watsapp instagram and you can see if boyfriend girlfriend cheating also it deletes all parental passwords and you can watch FREE PORN all you do is go into my computer and delete system32 job done ps my father is a cnut but god this live porn in my nieghbours live webcam in her bedroom boooom thnks dad

[@crazyvet112]

+Box Box . I did this and my computer crashed. how do I fix it so I can see everyone's FB?

[@mohammedel-masry8376]

+crazyvet112 He lied, you're screwed bro.

[@hoanganh3388]

You guys are extremely awesome :3

[@rossuser]

Do you have any comments on building security into the future of APIs?

[@ChaplainDaveSparks]

Might I suggest "hacking all the things" BEFORE "drinking all the booze"?

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@TheDavidlloydjones]

"Without further ado" occurs at 4:25.

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@vortex4355]

20 decives in 45 minutes? That seems beyond human speed. That would probably work if they hacked a public wifi.

[@monkeySkeptic]

I watch this and double down on my conviction never to install any "internet of things" appliances in my house.

[@garrettk7166]

YUP! IoT has no place in my home. Screw that.

[@svrestless3425]

indeed. to hell with smart devices

[@suvetar]

I'm fascinated but have to ask, apart from "Just because I can", why would you want to Root your Printer? Thanks for the great presentation!

[@gasparchilingarov4018]

Make it accept any cartridge you put in, for example

[@desertstonestudio3315]

Well, what if you rooted your printer then donate it to your or another place of business or to a friend. One way to get access to another network. Don't do that.

[@jonasghafur4940]

Well lots of printers, including Epson branded ones, have non replaceable consumables like small sponges that cover the printheads in parking position that they just assume are broken after a set number of print cycles making your printer ready for the landfill. Criminals.

[@danielmora7530]

Not my field, but I am really interested in the hacking of all aspects of devices and the intelligence of these smart Individuals.

[@KandyKoRner]

I see many people commenting on haircuts, is that because you can't find anything of substance in their words? So you turn to what you can see, that sounds intelligent and hilarious. Such a cool thing, to make fun of really intelligent people that you can't keep up with.

[@boika1905]

finally, a comment.

[@Earnest1G]

you gotta admit it's a pretty shit haircut though

[@Sevival]

KandyKoRner what if i told you you can be smart AND have a sense of style, instead of looking like a total fool? Look at elon musk for exampke

[@27shogun58]

I spy a fucking dweeb

[@Mike_Greene]

KandyKoRner So you asked a question and made an sumption without an answer then went on to make fun of this strawman ....? i dont get it . . .

[@UltraStuff]

YAYYY NOW I CAN HACK MY DISHWASHER

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@TheKetsa]

Hacked his haircut himslef ?

[@commonlibrary2]

TheKetsa xd

[@sadcatman1057]

TheKetsa he made it more functional

[@TheMcSebi]

I don't really get what's the point of hacking these hardware systems... What useful stuff can you do with it afterwards? If you build such a system, why would you even try to protect it from being "hacked"? Isn't the shell interface exactly what the 4 UART pins are for? How is this still hacking?

[@TheRandseed]

Imagine this kind of backdoor on medical equipment. (They're there. Worse, a lot are network exploitable.) Or maybe you really hate your friend so you go over to his house with a prepared script, plug in a UART, and have it randomly display goatse and tubgirl. Or worse, if that's possible. "Hey, mom, the refrigerator started playing a porno. She looks like you!"

[@leonalexander26]

What terminal Programm are they using?

[@NeXuSInfoS3c]

one of the best talks ever

[@mariarahelvarnhagen2729]

When You Don't Know Who Somebody Is And You Are Interviewed, Trained, And Paid To Keep It That Way

[@mariarahelvarnhagen2729]

Last Punjab

[@MrC0MPUT3R]

That guy's voice cracks are so unintentionally hilarious.

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@duncankat237]

Need help with samsung nexus older phone .lost password can I get into phone without data loss . Please help

[@arivfx]

Dude saurik??? That's crazy

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@LouieMcConnell26]

How do I find the TX, RX, and ground locations? I have a multimeter, but i don't know what do look for.

[@sundhaug92]

+Louie McConnell They're usually 2, 3 or 4 pins in a row or square. 2 pins will be TX/RX, 3 pin will also have GND and 4 pin will also have Vcc+. Using the pins of a known chip on the board and the multimeter in diode-mode to identify the Vcc and ground, that should give you to options for what the RX and TX is.

[@anon5119]

"Great, now it's a rap concert"

[@Scorch428]

embarassing

[@KnightMirkoYo]

Rap was actually pretty dope. Didn't expect that

[@karupeju]

But can they completely crack Denuvo?

[@destrierofdark_]

that's been done

[@mauer594]

Can someone tell me why the Vizio Costar LT would use Fat32?

[@Jagnathbaba]

isn't UBOOT used during production or development?

[@destrierofdark_]

...No? Do you even know what it is? Do you know what a bootloader is? Googling would have answered these questions.

[@bparker06]

@@destrierofdark_ u-boot is definitely used in production

[@seglogames1743]

But can that print run minesweeper???

[@Jrez]

I don[t really get the point of 100% of this. Why would I want root and the ability to run any code i want on my chromecast? What real benefit does that give me?

[@ethanwatson5923]

It can give you the ability to run software, and/or add new firmware to give you the ability to have even more use with it.

[@jeremykurowski519]

Jrezky it gives you root access like on a android phone. Anything root on android you can do now. Gives you more flexability to do anything you want. I don't even know where to start except you should google just google it.

[@learnsoftwareengineering6975]

Jrezky It gives some the ability to make software that would otherwise be incapable of running due to limitations of the OS or UI. It gives you complete access to the devices direct underlying OS (typically, if not always, linux). In the case of an end user it would give you the ability to run software written under this guise. For most users, this is meaningless. For some the point is that they make a device using technology and then lock out that technology (ie: my cell phone supports ALL cell technologies, but they locked out the 4G LTE method, it's still there in teh hardware but hidden in the software, by rooting it and installing a patch I can now use 4G LTE). Essentially, gives you control over your device that you only had limited control before. It's not for everybody.

[@rhiltbrunn]

Jrezky By hacking the hardware first, you are able to figure out the system and then figure out better hacks from different avenues. The more these things are hacked, the more likely the will be better secured in the future. That's what you want, especially, when we start using IoT stuff in your home or office. Cheers!

[@johnfavalorojr.4169]

Jrezky It doesn't give you any benefits because you obviously can't write code, nor do you have the hacker mentality.

[@carltonmiller7889]

I am being and have beeeeeeeeeen hacked ever since? Even as I watch this video. I also know who the culprit is that is currently hacking me, on top that the place I live in is over and under and all around watching, and violating our "privacy" any suggestion?

[@estebanjacome6663]

I didn't understand shit but I loved the effort on the event and everything. You have a raper and everything. Keep doing what you love guys congrats

[@snekjuce]

somebody got raped?

[@mitchelbryce]

Whos the rapist?? We watching the same video lmaoo jk

[@Top5Crime]

What about the Xbox 360??

[@dixeflatline]

RSH are you kidding me? that thing has been running back ups and homebrew for the longest time.

[@MaximusMuleti]

Practically since day 1

[@emmettcoen]

Take a shot of tequila everytime he says "so" !

[@ezcondition]

43:30 @ 1.25

[@tmdrake]

Geeze i'm watching this...but learned all of this on my own...working in the radio industry...Made some friends/enemy in IWCE community. I think i been banging heads with the wrong group of people!

[@destrierofdark_]

Why don't you hit up some other hackers? Couldn't hurt to associate with people doing the same stuff as you, for the same purposes, reasons and ends.

[@fsxfanatics]

that was a good rap, but that rap was a little cringy

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@nthicidea5138]

Back in my (barely) hacking days, (like 6 months ago) I was fucking with my microwave, and I decided to connect a receiver to my microwave in such a way that I could turn in on by inputting a number into an application, (for the receiver I used), the numbers of course was the time to cook for, and the wattage to use since my microwave had a setting to change the wattage, it worked for like a couple months but I guess I fucked up a seal in the microwave somewhere and the Microwave rays totally blocked the receiver from receiving commands, it was pretty cool. Should've done the same sort of thing to my toaster, would've been cooler.

[@p0st1e64]

why were you cooking a seal in the first place,they're fatty, stink and taste like shit

[@Happyface615]

I not only watched this three years late but also half buzzed off some sweet nectar of mother natures greatest flower and some disorienting liquid made of 'hops'. I thoroughly enjoy watching this video thru its entirety AND only knew *1%* of what these 'nerds' were talking about. The *passion* is what carried me to the end.. Seeing how much enjoyment they gotta outta doing this shyt and having fun at the same time is something I can definitely vibe with. :thumbs_up:

[@Cristofopo]

shut up degenerate.

[@kingonmax]

Cool beans

[@ELTRENTOisbak]

"Drink all the booz, hack all the things" is my ring tone now. I cringe when it rings.

[@TimmacTR]

So....what can you do then? I mean, after you hacked these devices?

[@Bloodysugar]

Well it's obvious : a talk at Defcon.

[@destrierofdark_]

A plethora of fun stuff.

[@spkoftdvl]

@@Bloodysugar jajajajaja

[@SavenaWlakere-q7q]

My light in my bathroom flutter on and off constantly every where i go my radio systemsevery thing i dobt know how to stop it but would be hapoy to oay someone to stop it

[@stefthor7297]

c'mon no one took the time to ring out that p.a.? amongst all those techno wizards.. that's too bad

[@joniator14]

Where can i get this uart? :D

[@Shambler101]

Great. they show you how to get into the root but not what you can do, as in useful things to do with the devices etc. i am a noob when looking at this stuff so what exactly can you do with these devices once you hack in that are useful.

[@meunomejaestavaemuso]

Shambler101 Imagine you buy a car with a motor that can go over 200km/h, but in the factory they put a lock in the speed and allow it only to go to 100km/h. When you get access to root, you are essentially accessing the full potential of the car. It may not be much with a printer or a refrigerator, but with a smart TV or a cell phone, you have something that can do much more in terms of processing power and user interactivity. For instance by hacking a cellphone, you can change the OS to go to web if it doesn't, change the homescreen if it doesn't allow, use apps from other sources rather than just the app-store of the company.

[@Shambler101]

Fernando Santos i understand what you are saying.

[@igrewold]

So, where is Amir (in Arabic it means prince) from his name sounds like Arab or Pakistani?

[@null-sweat]

Damn, rap at end was 🔥

[@firejim8]

I would like to see p5110 with uboot can you?

[@leberkassemmel]

I did not know saurik was in there.

[@planktonfun1]

43:30 thank me later

[@jamesmain6702]

fuckin barrssss hahaha

[@philipphoehn3883]

Paulo Castro thanks

[@tricky2055]

I’m embarrassed for him.

[@i.p.knightly149]

I need a hack to unsee that.

[@Partyfreaker]

Well, a bit anticlimax.. sure, it's really genius finding out that root access is possible when opening the device and creating a physical connection. But what scenario would make that beneficial? Going undercover at a big company, finding a printer that has this known exploit in open sight, then tell you are the IT guy at the front desk, hoping they don't have a internal IT department and not contacting their main IT guy, and then opening the printer up, get your physical contact and run the exploit to create a backdoor so you can sniff the network for vulnerable devices? And even if that was the case, the IT department did a good job, and only allowed the printer to access the shared printer server and the rest of the connections are blocked in the firewall, so the printer can't sniff the entire network or access the internet.

[@playaspec]

"Who uses PowerPC these days?" A: *LOTS* of people, and in 2020. They're in countless SAS and FC HBA cards, laser printers, set top boxes, the list goes ON AND ON...

[@mibdev]

Next time hack your haircuts too!

[@adamgibson7181]

i watched all 48 mins and had no idea what i was watching. loved it though.

[@whoanowyo]

So, everything I saw here indicates you need physical access and a UART chip? If one had physical access to most devices, couldn't you do just about anything?

[@whoanowyo]

+whoanowyo I guess I'm just saying is there really ANY device that is "secure" from a standpoint of having unlimited physical access?

[@0xbenedikt]

A lot of these devices had web-exploitable bugs that led to root. You might want to consider rewatching the video ;-)

[@destrierofdark_]

You missed the beginning slide, I see. This is about your ownership of _your own_ devices, where some try to, to varying degrees of success, keep you out of modifying their software.

[@oinkfat]

How were you able to get binaries off the summer zoom wifi monitor? The uart appears to be spitting out useless words such as "sync no-ok" and doesn't appear to be interactive.

[@groovejet33]

can you give me some real world applications i can use these Uart hacks for? sorry but i am completely new to this but im really interested in it.

[@kava2340]

All of these devices have networking , and if they are connected their part of a network Add 1 to 1

[@stefvdwel]

Memes everywhere!

[@MyBigRed]

Lloyd really has come a long way since Dumb and Dumber, hasn't he?

[@biotoxinfoundation7433]

*DEFCON IS MY DREAM*

[@BitwiseMobile]

Overarching theme: Telnet has root access. Solution: Chroot or stick your SSH daemon in a jail. Disable root access on ssh and turn on passwordless logons (key based). Rookie stuff.

[@p0st1e64]

aren't only the users in the jail, the jail can still be entered from outside?

[@destrierofdark_]

Jails are hard on a system where those do not exist.

[@ericabreeze539]

how is possible that someone hacked my mp3 player. I live in a apartment complex.

[@shavais33]

So once you have root, what can you do with it?

[@katesthgreat7552]

Shavais Zarathu endless possibilities

[@acet1n]

may if it has wlan start building a botnet if it doesnt build some malicous device that will infect anything it gets plugged to if it has Bluetooth you can build your own jammer it is endless

[@Cray2TheZ]

Imagine if they ACTUALLY HACKED A MACHINE LIVE instead of inflicting that HORRIBLE rap at the end !

[@wylieecoyote]

Hack? Yes, that also describes the rap singing at the end.

[@LG-Devil]

Yuck! That wink php script has no variable sanitizing. Who writes this shit? Wink looks really neat though. Great presentation learned a lot!

[@shotasdg3679]

I am here at 2020 to listen to the tap. If you so, here it is 43:27

[@hashkeeper]

anyone have a uart receiver suggestion?

[@alexitoyt1130]

me

[@larkalfen9510]

so after the competition the fbi were waiting behind the door

[@erictheboringone5292]

Pretty sure the fellow speaking at 4:00 let his mom cut his hair. Epic fucking bowl cut!!

[@pnkflyd66]

The awkwardness was rampant here.

[@boandlkramer8935]

Thats really interesting, but what use is this?

[@dummypg6129]

Developers will be able to modify or create programs on rooted devices.

[@brickwallerson7116]

drink all the booze

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@Obbliteration]

Thus is very cool but what would you even change in these devices?

[@destrierofdark_]

Bad UI comes to mind. Or perhaps, with a lightbulb, maybe a secret "party mode". More parts just for the hell of it.

[@Gunth0r]

Oprah rly looks like a vampire in that meme

[@EddieLeal]

Scary stuff folks.

[@theDgrader]

The Talking Over Music bit at the end was cringe worthy

[@RoySATX]

Whoa, what day is it?

[@lineageduper]

what you use to hack

[@enrique4012]

Step 1. Buy an UART You've succesfully became a hacker.

[@samineni100]

how do we get to know the baudrate?

[@egementutkunforreal]

Try each one

[@samineni100]

@@linuscattips6207 I guessed so.

[@hex1101]

Never been so bored watching a defcon talk...

[@vociferousrich3316]

Would learning Linux be the best place to start in order to learn to hack? What about windows machines?

[@privateagent]

@Winston Mcgee why?

[@Fopenplop]

Yeah go for it

[@privateagent]

@@Fopenplop indeed, Linux is the best OS to learn, not just hacking but everything computer related

[@xthukuh]

This is where I first heard "Hack all the things" fire sick and terminally ill rap

[@HackoGramming]

kzbin.info/www/bejne/n5bCmmiQf5V7mJo

[@gitapushyangel2092]

could we just laser etch an artificial diamond with gold and a magnet and coils to make a generator

[@imaginerus]

I don't really get it, first they complain about not having access to their own hardware, but then they laugh when a device is easily accessible...

[@bytefu]

They laugh at companies for their pathetic attempts to restrict access, just like they would laugh at a steel "NO TRESPASSING" sign next to a cardboard fence. Except companies try to restrict access to devices they don't own, of course.

[@imaginerus]

@@bytefu Of course they have to put the "no tampering" in the manual because of the warranty. You don't want a flood of bricked products because some script kiddies messed up. Other than that most products seem pretty inviting for people that know what they are doing.

[@lupinedreamexpress]

Green robots ooo. Know why they left Samsung alone? BOOM! hehehehehe

[@destrierofdark_]

Look at device 21.

[@michak8029]

I have 1 question: what would you like to run on mentioned devices?

[@destrierofdark_]

I mean, the uses I see for it would literally be a hive HPC farm.