@nmatt0

Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria

 /dev/ttyUSB0
brownfinesecurity.com
Joined July 2016
  • Tweets2.6K
  • Following1.1K
  • Followers11.8K
381Media
My research got featured on @WIRED today 😀
WIRED
@WIRED7 Jan 2025
Misconfigured license plate recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes them by. wired.trib.al/0GrhVYG

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Misconfigured license-plate-recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes by them.

wired.com
10
14
1
227
36,084
You guys think the Social Security Admin knows about integer overflows?
Aaron Frank
@arfrank7h
You can actually just do this; ssa.gov/number-card/requesti…

Requesting a new number

When and how to request a new Social Security number.

ssa.gov
6
496
Matt Brown retweeted
Ben Sadeghipour
@NahamSec9h
In case you missed it, we are hosting #NahamCon2026 in person in Oakland with multiple live hacking targets, 15+ amazing speakers, and of course our flagship CTF! Would love to see some familiar faces, especially if you live in the Bay Area!
4
4
49
3,654
Sen. Bernie Sanders
@SenSanders11h
This is insane. We cannot allow AI agents to go into your bank account and act independently without your authorization. But that is what’s happening right now. Left unchecked, AI could endanger the entire global financial system — including your bank account. Pause AI NOW!
1
15
525
I'm noticing decode tok/s maxxing is less important for hacking tasks. This is from a gray box hacking session consisting of: - static binary RE - root shell on device for dynamic work - active network service testing Notice that decode tok/s is not the bottleneck... It's tool calling. Agent thinks about a problem, makes a tool call, then thinks about the result. rinse and repeat. I think this is really good news for pentesters wanting a good local LLM setup. I've been getting solid real world results from my 2x sparks running GLM 5.3 Flash. (btw this session found a crit in an IoT device)
11
41
1,796
More VRAM == better local AI? Not always. We talked about hardware trade-offs in episode 197! youtu.be/gKvIjE8LRVg

800 Bugs w/ DeepSeek + Local Model Hacks (Ep.197)

Episode 197: In this episode of Critical Thinking - Bug Bounty Podc...

youtube.com
1
1
24
3,495
We are going to clean room rebuild everything. Chinese wallmaxxing ftw
kache
@yacineMTBOct 22
Things will continue to get worse until you finally realize that it is time to stop using dependencies
1
6
761
Matt Brown retweeted
Iceman
@herrmann100122h
github.com/mitmproxy/mitmpro… That went fast.

Add `--emudhra` option (#8500) · mitmproxy/mitmproxy@1692344

github.com
5
40
8
412
32,264
I need this to keep the youths off my lawn.
Min Choi
@minchoiOct 21
China's Unitree just dropped H2-X Kung Fu Legend Guardian. Dents car doors. 4 meter drops. Spinning kicks + flips. Even lifts front of a car. We are cooked 💀
3
3
32
3,172
Firmware scanning tool Mithril can now detect eMudhra style EC key flaws as well as many other weak key issues with the --keys flag! github.com/nmatt0/mithril/pu… Remember to unpack with Moria and analyze with Mithril ⛏️💎

feat(keys): detect near-zero EC private scalars (eMudhra P-384 compromise) by nmatt0 · Pull Request...

What The --keys pass could not see a whole class of broken key: EC keys whose private scalar is tiny enough to recover by brute force. PublicKey discarded the EC point during parsing, and every wea...

github.com
3
3
1
77
1,917
Matt Brown retweeted
Ben Sadeghipour
@NahamSecOct 21
Thrilled to welcome @OpenAI as another target for Prompt2Pwn, our live hacking event at #NahamCon2026! 🎯 Only a few in-person tickets remain. Apply for a free tickets 👉🏼 nahamcon.com
4
4
52
5,848
Ppl in this thread are like "but that's illegal". Like, yeah we know.
Marc Köhlbrugge
@marckohlbruggeOct 21
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
3
2
41
2,693
chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.
23
43
4
521
12,254
Benchmarking this now. Open weights are pacing the frontier.
Mia
@MiaAI_labOct 20
DeepSeek V4.1 Flash 1017 on 2x DGX Sparks Frontier at home. No limits. 100% Private. github.com/MiaAI-Lab/DeepSee…

GitHub - MiaAI-Lab/DeepSeek-v4.1-Flash-1017-2x-DGX-Sparks: DeepSeek-V4.1-Flash-1017 EXL3 on 2x DGX...

DeepSeek-V4.1-Flash-1017 EXL3 on 2x DGX Sparks with TensorFold - MiaAI-Lab/DeepSeek-v4.1-Flash-1017-2x-DGX-Sparks

github.com
4
2
44
3,803
I've found vulns exploitable over WiFi that were identifiable by SSID prefix... One @wiglenet search is all you would need to geolocate a pwnable device.
i²cjak
@i2cjakOct 19
less freaky and longer range: every WiFi SSID (well BSSID) is sniffed by smartphones and geotagged. Someone can look up your home network SSID and, if it is unique, exactly locate you. Or find a handful of places you might be. Your SSID is literally your address, treat it as such
1
5
61
2,837
Matt Brown retweeted
Will
@realwillreilOct 17
Just another day in the factory
14
4
1
368
5,583
Matt Brown retweeted
Hash
@BitBangingBytesOct 17
The $999 SEM is coming along
1
5
47
1,798
I can't wait to be 100% local.
Matt Johansen
@mattjayOct 17
🚨 Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke.
7
2
1
65
4,823
I swear some of you people would have gone to the Chicago World's Fair and been like "AcKtuAlly tHat DoeSn'T sCaLe feAsiBly"!
Sam
@SamCKxOct 16
I hate to be the one to burst the Tesla bubble today, but the spectacular “flight” we witnessed at the Roadster reveal needs a little context. The car is carrying around 250kg of compressed air, plus the weight of the tanks, valves and thrusters needed to contain and release it. Based on the published figures, that gives it roughly 1.5–2 seconds of maximum thrust before the system needs to be refilled. In short, it's a gimmick.
6
1
41
1,828
Matt Brown retweeted
Quentin Kaiser@qkaiserOct 16
All the details including the slides are now available at quentinkaiser.be/security/20…

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of...

quentinkaiser.be
3
31
101
6,159
Matt Brown retweeted
Quentin Kaiser@qkaiserOct 16
My presentation at Hexacon is done ! Time for public disclosure. Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
6
57
3
269
16,074
Load more