Zac Davis chats with best friend and hardware hacking guru, Matthew Freilich this week on War Stories.
Episode Summary
In Episode 4 of War Stories, host Zac Davis talks with hardware hacker Matthew Freilich about roughly 15 years in cybersecurity, the tool he relies on when he is staring at an unknown circuit board, and what happened when a bank asked his team to break into an ATM.
Like many testers, Matthew started out running vulnerability scans before moving into network and web application penetration testing. He then shifted into hardware security, including medical device testing and ATM security work. His favorite tool is the logic analyzer, which lets a tester connect to pins on a board or chip and see what data is moving across connections like UART, even when nobody has explained how the device works.
His war story starts with a request to break into a live ATM and see if anyone noticed, which raised real safety questions about armed guards and police response. On the machine they tested, the cabinet lock on an older ATM was raked open in a few seconds with a standard tension wrench. Then the team plugged into the headphone jack built for visually impaired customers, which triggered Windows accessibility features like Sticky Keys and let them break out of the ATM's kiosk mode.
In This Episode
- Matthew Freilich's path from vulnerability scanning to hardware security testing
- Testing medical devices and ATMs
- Using a logic analyzer to read UART and serial data on unknown circuit boards
- Picking an ATM cabinet lock in seconds
- Breaking out of kiosk mode through the accessibility headphone jack and Sticky Keys
Is Your Hardware As Locked Down As You Think?
ATMs, kiosks, and connected devices often depend on physical and software controls that have never been tested together. SEVN-X runs penetration tests and physical security assessments for banks, credit unions, and other organizations that rely on them. Talk with our team about scoping a test for your organization.
