Larry Pesce

Finite State
Product Security Research and Analysis Director

Larry’s core specialties include hardware and wireless hacking, architectural review, and traditional pentesting. He also regularly gives talks at DEF CON, ShmooCon, DerbyCon, and various BSides. Larry holds the GAWN, GCISP, GCIH, GCFA, and ITIL certifications, and has been a certified instructor with SANS for 5 years, where he trains the industry in advanced wireless and Industrial Control Systems (ICS) hacking. Larry’s independent research for the show has led to interviews with the New York Times with MythBusters’ Adam Savage, hacking internet-connected marital aids on stage at DEFCON, and having his RFID implant cloned on stage at Shmoocon. Larry is also a Principal Instructor and Course Author for the SANS Institute for SEC617: Wireless Penetration Testing and Ethical Hacking and SEC556: IoT Penetration Testing. When not hard at work, Larry enjoys long walks on the beach weighed down by his ham radio, (DE KB1TNF), and thinking of ways to survive the impending zombie apocalypse.

DEFCON Contest

While we aren’t having a party this year, we are running a mini contest and offering up some tokens of appreciation for those who complete it. A badge of honor if you will… https://www.badguywalmart.com Let’s be clear. The end objective of this game is to speak a phrase to Darren or Larry so that it […]

Building the CCDC Badge System

Two weeks ago, some of the Security Weekly crew spent a couple of days down in Maryland hanging out with all of the great CCDC crew. While Paul and Darren played Red Team for the Mid-Atlantic Collegiate Cyber Defense Challenge, I got to play “the badge man”. It was my job to design and implement […]

Information gathering with GPG/PGP keytrusts

Some times you just need to know more about a person… Often times during some of the initial phases of a pen test, I find myself needing some avenues for delivering client side attacks – with permission and within scope of course! Now, finding appropriate attacks can be a challenge, but to me a larger […]

What’s in Larry’s RFID hacking box?

We’ve been asked a number of times for advice on RFID equipment that can be used to start experimenting with RFID technologies. We’ve heard your request loud and clear; I’m going to give you a rundown of what is in my current kit. Start at the Beginning The first reader that I picked up was […]

Recovering Firefox Passwords for World Domination

To quote Carlos “dark0perator” Perez, “shell is just the beginning”. Now that we have access to a machine, we can gather all sorts of goodies, we just need to know where to look. Some of my favorite local system information gathering techniques include grabbing Firefox stored passwords. Prior to version 3.5, (for version 3) the […]

Security Weekly Defcon Party Challenge The Solution

Now that DEFCON 17 is over, we promised the solution to our party pass challenge. I knwoo that many have been waiting patiently, here it is: Remember the original post? Here is the challenge in case you forgot. As stated in the original post, everything that you needed to complete the challenge was in the […]

Security Weekly/i-Hacked Defcon Party Update

The invite only DEFCON Party will be held at: Saturday, August 1st The Riviera Skybox 207/208 22:00 to 03:00 This will be immediately following the Podcaster’s Meetup, where tons of prizes are being given away, so you may want to come early. NOTE: Due to Hotel and State regulations, because alcohol is being served at […]

The Security Weekly/i-Hacked DEFCON Party

The planning for the party is shaping up, but in traditional Security Weekly fashion, a lot of the details are coming in at the last minute. We’ll have some totally rockin’ DJs from DJ Great Scott’s crew (when when have confirmation, we’ll let you know exactly who). We’ll have adult beverages – we’re looking at […]

How To: Sniffing DECT Wireless Devices

I’m always on the lookout for new ways to do recon during an assessment, or be aware how folks could be performing recon against an organization. Being aware of recon methods helps make recommendations to remediate potential exposure. One of the things that can be highly successful for recon on a target is wireless. I’m […]