This Week In Security: Critical DNS Keys Rotated, Hacking Freezers Isn’t Cool, OpenAI Spies On Itself, And Advanced Hardware Wallet Hacks

October 16, 2026 by Mike Kershaw 14 Comments

Critical Internet keys changed this week. Did you notice? The keys behind DNSSEC, the system for cryptographically validating DNS responses, rolled over on October 11 2026. This is the second time the DNSSEC keys have rotated since the system was implemented, and the first time in 2018 didn’t exactly go entirely smoothly.

DNS is what resolves a host name and turns it into an IP address. It underpins web browsing, email, and just about every other connection. It’s also a very early Internet protocol, written in both a simpler, less paranoid era, and an era where encryption was computationally expensive and legally problematic. DNS offers little protection against malicious actors spoofing responses, and the impacts range from phishing to redirecting email to just about any other manipulation of connections you can image.

DNSSEC addresses this by creating a chain of trust between DNS resolvers — the servers that forward the DNS query into the DNS infrastructure and return the results — and the global DNS servers. Part of this chain of trust is the root key that each resolver must have and trust, and this key is what changed this week. DNSSEC resolvers automatically watch for a new root of trust key, but the key must be signed by the previous root of trust, and is checked for at least 30 days before it is trusted. If someone were able to issue a bogus certificate, they would have to maintain control of the infrastructure for over a month before DNS resolvers would trust it.

The process of distributing the new key actually began more than a year ago, on January 11, 2025, to give DNSSEC resolvers time to get the new key. DNSSEC services should have had plenty of time to obtain and trust the new key, and unless DNS stopped working for you this week, they did their job.

The next major change for DNSSEC will require more profound changes to deploy a new signing algorithm that will be post-quantum secure.

Continue reading “This Week In Security: Critical DNS Keys Rotated, Hacking Freezers Isn’t Cool, OpenAI Spies On Itself, And Advanced Hardware Wallet Hacks” →

2022 Hackaday Supercon: Joe [Kingpin] Grand Keynote And Workshops Galore

October 25, 2022 by Elliot Williams 5 Comments

It’s our great pleasure to announce that Joe [Kingpin] Grand is going to be our keynote speaker at the 2022 Supercon!

If you don’t know Joe, he’s a hacker’s hacker. He’s behind the earliest DEFCON electronic badges, to which we can trace our modern #badgelife creative culture. He was at the l0pht when it became the most publicly visible hackerspace in the USA, at the dawn of what we now think of as cybersecurity. And moreover, he’s a tireless teacher of the art of hardware hacking.

Joe’s talk at DEFCON 22 about reverse engineering PCBs on a hacker budget is on our top-10 must watch playlist, and his JTAGulator debug-port enumeration device has been present at the start of countless hacking sessions. But again, it’s his enthusiasm for creating, his inspiring “what if I poke at this thing this way?” attitude, and overwhelming hacker spirit that make Joe a long-overdue speaker at Supercon! Continue reading “2022 Hackaday Supercon: Joe [Kingpin] Grand Keynote And Workshops Galore” →

Open Source Pizza Compass Will Show You The Way

April 28, 2021 by Tom Nardi 18 Comments

In Pirates of the Caribbean, Captain Jack Sparrow has an enchanted compass that points to what the holder wants most in life. The Pizza Compass created by [Joe Grand] is basically the same thing, except it’s powered by a Particle Boron instead of a voodoo spell. Though depending on who’s holding the thing, we imagine they’d even point in the same direction.

[Joe] was tasked by Wired to design and produce the Pizza Compass in three weeks, a process which was documented in the video below. Being the Badgelife luminary that he is, the final product looks far more attractive than it has any business being. In addition to the Particle Boron that slots in on the back of the handheld PCB, there’s a GlobalTop PA6H GPS module, a LSM303DLHC compass, and eight NeoPixels that correspond to the points on the silkscreen compass.

Using the device is simple, just press the button and then walk around trying to keep the top-most LED lit. Behind the scenes, the Boron is pulling down the coordinates of the closest pizza place as reported by Google’s API, and comparing that to the user’s current GPS location. In practice that means the Pizza Compass isn’t concerned with nuances like streets or buildings, so its up to the user to figure out how best to stay on the desired heading. So rather than just following some turn-by-turn directions, there’s some proper navigation involved if you want that fresh slice.

If you don’t like pizza, you could reprogram the compass to point to whatever quest-worthy resource you wish. As explained at the end of the video, [Joe] wanted this to be an open source project so it could easily be adapted for different tasks by the community. Though honestly, it’s pretty weird if you don’t like pizza.

We’ve actually covered a very similar device in the past that would point the user to the closest White Castle or Five Guys, but with all due respect to that project, the Pizza Compass is in another league. When you’ve got the talent and experience of [Joe Grand] on the team, even the most mundane of gadgets ends up looking like a piece of art.

Continue reading “Open Source Pizza Compass Will Show You The Way” →

DEF CON 27: The Badge Talk; Or That One Time Joe Grand Sourced 30,000 Gemstones

August 9, 2019 by Mike Szczys 12 Comments

Yesterday we published a first look at the hardware found on the DEF CON 27 badge. Sporting a magnetically coupled wireless communications scheme rather than an RF-based one, and an interesting way to attach the lanyard both caught my attention right away. But the gemstone faceplate and LED diffuser has its own incredible backstory you don’t want to miss.

This morning Joe Grand — badge maker for this year and many of the glory years of hardware badges up through DC18 — took the stage to share his story of conceptualizing, prototyping, and shepherding the manufacturing process for 28,500 badges. Imagine the pressure of delivering a delightful concept, on-time, and on budget… well, almost on budget. During the talk he spilled the beans on the quartz crystal hanging off the front side of every PCB.

Continue reading “DEF CON 27: The Badge Talk; Or That One Time Joe Grand Sourced 30,000 Gemstones” →

First Look At DEF CON 27 Official Badge; Kingpin Is Back!

August 8, 2019 by Mike Szczys 15 Comments

The first big surprise Vegas had in store for everyone is that the DEF CON badge is an electronic badge this year. It’s traditionally been the DC practice to alternate years between electronic and non-electronic badges. Last year we had a fantastic electronic badge designed by the ToyMakers, so I had expected something more passive like the vinyl LP badge from a few years ago. What a pleasant surprise to learn otherwise!

Second up on the surprise list is the badge maker himself. The design is a throwback to days of yore as Joe Grand steps up to the plate once again. Veterans know him as Kingpin, and his badge-making legacy runs deep. Let’s jump in and take a look.

Continue reading “First Look At DEF CON 27 Official Badge; Kingpin Is Back!” →

Joe Grand Is Hiding Data In Plain Sight: LEDs That Look Solid But Send A Message

June 10, 2018 by Mike Szczys 19 Comments

Thursday night was a real treat. I got to see both Joe Grand and Kitty Yeung at the HDDG meetup, each speaking about their recent work.

Joe walked us through the OpticSpy, his newest hardware product that had its genesis in some of the earliest days of data leakage. Remember those lights on old modems that would blink when data is being transmitted or received? The easiest way to design this circuit is to tie the status LEDs directly to the RX and TX lines of a serial port, but it turns out that’s broadcasting your data out to anyone with a camera. You can’t see the light blinking so fast with your eyes of course, but with the right gear you most certainly could read out the ones and zeros. Joe built an homage to that time using a BPW21R photodiode.

Transmitting data over light is something that television manufacturers have been doing for decades, too. How do they work in a room full of light sources? They filter for the carrier signal (usually 38 kHz). But what if you’re interested in finding an arbitrary signal? Joe’s bag of tricks does it without the carrier and across a large spectrum. It feels a bit like magic, but even if you know how it works, his explanation of the hardware is worth a watch!

Continue reading “Joe Grand Is Hiding Data In Plain Sight: LEDs That Look Solid But Send A Message” →

[Joe Grand’s] Toothbrush Plays Music That Doesn’t Suck

March 27, 2017 by Mike Szczys 40 Comments

It’s not too exciting that [Joe Grand] has a toothbrush that plays music inside your head. That’s actually a trick that the manufacturer pulled off. It’s that [Joe] gave his toothbrush an SD card slot for music that doesn’t suck.

The ~~victim~~ donor hardware for this project is a toothbrush meant for kids called Tooth Tunes. They’ve been around for years, but unless you’re a kid (or a parent of one) you’ve never heard of them. That’s because they generally play the saccharine sounds of Hannah Montana and the Jonas Brothers which make adults choose cavities over dental health. However, we’re inclined to brush the enamel right off of our teeth if we can listen to The Amp Hour, Embedded FM, or the Spark Gap while doing so. Yes, we’re advocating for a bone-conducting, podcasting toothbrush.

[Joe’s] hack starts by cracking open the neck of the brush to cut the wires going to a transducer behind the brushes (his first attempt is ugly but the final process is clean and minimal). This allows him to pull out the guts from the sealed battery compartment in the handle. In true [Grand] fashion he rolled a replacement PCB that fits in the original footprint, adding an SD card and replacing the original microcontroller with an ATtiny85. He goes the extra mile of making this hack a polished work by also designing in an On/Off controller (MAX16054) which delivers the tiny standby current needed to prevent the batteries from going flat in the medicine cabinet.

Check out his video showcasing the hack below. You don’t get an audio demo because you have to press the thing against the bones in your skull to hear it. The OEM meant for this to press against your teeth, but now we want to play with them for our own hacks. Baseball cap headphones via bone conduction? Maybe.

Update: [Joe] wrote in to tell us he published a demonstration of the audio. It uses a metal box as a sounding chamber in place of the bones in our head.

Continue reading “[Joe Grand’s] Toothbrush Plays Music That Doesn’t Suck” →