@nmatt0

Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria

 /dev/ttyUSB0
brownfinesecurity.com
Joined July 2016
  • Tweets2.6K
  • Following1.1K
  • Followers11.8K
378Media
My research got featured on @WIRED today 😀
WIRED
@WIRED7 Jan 2025
Misconfigured license plate recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes them by. wired.trib.al/0GrhVYG

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Misconfigured license-plate-recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes by them.

wired.com
10
14
1
227
36,059
I'm noticing decode tok/s maxxing is less important for hacking tasks. This is from a gray box hacking session consisting of: - static binary RE - root shell on device for dynamic work - active network service testing Notice that decode tok/s is not the bottleneck... It's tool calling. Agent thinks about a problem, makes a tool call, then thinks about the result. rinse and repeat. I think this is really good news for pentesters wanting a good local LLM setup. I've been getting solid real world results from my 2x sparks running GLM 5.3 Flash. (btw this session found a crit in an IoT device)
5
26
913
More VRAM == better local AI? Not always. We talked about hardware trade-offs in episode 197! youtu.be/gKvIjE8LRVg

800 Bugs w/ DeepSeek + Local Model Hacks (Ep.197)

Episode 197: In this episode of Critical Thinking - Bug Bounty Podc...

youtube.com
1
21
2,960
We are going to clean room rebuild everything. Chinese wallmaxxing ftw
kache
@yacineMTB18h
Things will continue to get worse until you finally realize that it is time to stop using dependencies
1
5
570
Matt Brown retweeted
Iceman
@herrmann100110h
github.com/mitmproxy/mitmpro… That went fast.

Add `--emudhra` option (#8500) · mitmproxy/mitmproxy@1692344

github.com
3
27
5
255
17,117
I need this to keep the youths off my lawn.
Min Choi
@minchoiOct 21
China's Unitree just dropped H2-X Kung Fu Legend Guardian. Dents car doors. 4 meter drops. Spinning kicks + flips. Even lifts front of a car. We are cooked 💀
3
3
31
2,896
Firmware scanning tool Mithril can now detect eMudhra style EC key flaws as well as many other weak key issues with the --keys flag! github.com/nmatt0/mithril/pu… Remember to unpack with Moria and analyze with Mithril ⛏️💎

feat(keys): detect near-zero EC private scalars (eMudhra P-384 compromise) by nmatt0 · Pull Request...

What The --keys pass could not see a whole class of broken key: EC keys whose private scalar is tiny enough to recover by brute force. PublicKey discarded the EC point during parsing, and every wea...

github.com
3
3
1
74
1,863
Matt Brown retweeted
Ben Sadeghipour
@NahamSecOct 21
Thrilled to welcome @OpenAI as another target for Prompt2Pwn, our live hacking event at #NahamCon2026! 🎯 Only a few in-person tickets remain. Apply for a free tickets 👉🏼 nahamcon.com
3
4
50
5,539
Ppl in this thread are like "but that's illegal". Like, yeah we know.
Marc Köhlbrugge
@marckohlbruggeOct 21
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
3
2
41
2,648
chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.
23
43
4
521
12,174
Benchmarking this now. Open weights are pacing the frontier.
Mia
@MiaAI_labOct 20
DeepSeek V4.1 Flash 1017 on 2x DGX Sparks Frontier at home. No limits. 100% Private. github.com/MiaAI-Lab/DeepSee…

GitHub - MiaAI-Lab/DeepSeek-v4.1-Flash-1017-2x-DGX-Sparks: DeepSeek-V4.1-Flash-1017 EXL3 on 2x DGX...

DeepSeek-V4.1-Flash-1017 EXL3 on 2x DGX Sparks with TensorFold - MiaAI-Lab/DeepSeek-v4.1-Flash-1017-2x-DGX-Sparks

github.com
4
2
44
3,786
I've found vulns exploitable over WiFi that were identifiable by SSID prefix... One @wiglenet search is all you would need to geolocate a pwnable device.
i²cjak
@i2cjakOct 19
less freaky and longer range: every WiFi SSID (well BSSID) is sniffed by smartphones and geotagged. Someone can look up your home network SSID and, if it is unique, exactly locate you. Or find a handful of places you might be. Your SSID is literally your address, treat it as such
1
5
61
2,824
Matt Brown retweeted
Will
@realwillreilOct 17
Just another day in the factory
14
4
1
368
5,578
Matt Brown retweeted
Hash
@BitBangingBytesOct 17
The $999 SEM is coming along
1
5
47
1,798
I can't wait to be 100% local.
Matt Johansen
@mattjayOct 17
🚨 Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke.
7
2
1
65
4,812
I swear some of you people would have gone to the Chicago World's Fair and been like "AcKtuAlly tHat DoeSn'T sCaLe feAsiBly"!
Sam
@SamCKxOct 16
I hate to be the one to burst the Tesla bubble today, but the spectacular “flight” we witnessed at the Roadster reveal needs a little context. The car is carrying around 250kg of compressed air, plus the weight of the tanks, valves and thrusters needed to contain and release it. Based on the published figures, that gives it roughly 1.5–2 seconds of maximum thrust before the system needs to be refilled. In short, it's a gimmick.
6
1
41
1,822
Matt Brown retweeted
Quentin Kaiser@qkaiserOct 16
All the details including the slides are now available at quentinkaiser.be/security/20…

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of...

quentinkaiser.be
3
31
101
6,149
Matt Brown retweeted
Quentin Kaiser@qkaiserOct 16
My presentation at Hexacon is done ! Time for public disclosure. Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
6
57
3
269
16,039
Meanwhile over on LinkedIn...
3
3
1
34
2,129
The real alpha in hacking devices like this is obtaining a physical device (ideally multiple) to discover and test exploits against in a controlled lab environment. BUT that makes firmware access trivial to TAs because the first thing they will do is dump firmware from flash. No need for public downloads. As others have noted, not allowing public downloads does inhibit security researchers that don't have physical device...
Matthew Green
@matthew_d_greenOct 15
I hate to say this because it goes against everything I believe in. But people are going to need to take down public firmware images for critical infrastructure, like yesterday.
6
4
79
4,640
No blackpilling allowed.
Tesla
@TeslaOct 16
Do a kickflip!
22
1,339
Load more