# 053 - It's Hammer Time!

- Show: [Unnamed Reverse Engineering Podcast](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast)
- Published: 2021-12-16
- Length: 1h 40m
- Page: https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time
- Listen: https://unnamedre.com/episode/53

## Summary

Hash, a reverse engineer known for smart meter hacking, discusses his journey from self-taught electronics hobbyist to analyzing critical infrastructure. He details his reverse engineering of the Neato XV-11 robot vacuum's LIDAR to win a bounty, and his current work using Software Defined Radios (SDRs) like the HackRF and Yardstick One to analyze Landis+Gyr smart meters. Hash explains how he bypassed frequency hopping by transmitting on all channels simultaneously and highlights the security risks of these devices, including data leakage from decommissioned hardware found on eBay.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=0) Introduction: Hash's background and self-taught origins
- [8:39](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=519) Career path: Dropping out of college for hands-on engineering
- [17:23](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=1043) Neato XV-11 LIDAR reverse engineering and bounty win
- [35:32](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=2132) Smart meter research: Geographical routing and Texas blackouts
- [47:20](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=2840) Acquiring meters from eBay and building a test network
- [1:05:49](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=3949) Tools of the trade: SDRs, HackRF, and protocol analysis
- [1:19:17](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=4757) RECESSIM community and open-source hardware resources
- [1:24:18](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time#t=5058) Data leakage from decommissioned e-waste and disposal failures

## Topics

- [Wireless & RF](https://hardwarepodcasts.com/topic/wireless-and-rf)
- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Careers & education](https://hardwarepodcasts.com/topic/engineering-careers-and-education)
- [Sourcing & supply chain](https://hardwarepodcasts.com/topic/sourcing-and-supply-chain)

## Most relevant to

early-stage companies

## Mentioned

- Landis+Gyr (company)
- Neato (company)
- HackRF One (tool)
- Yardstick One (tool)
- USRP B200 (tool)
- Saleae Logic Analyzers (tool)
- Beagle I2C/SPI Protocol Analyzer (tool)
- RECESSIM (other)
- Sense (company)
- Precursor (product)

## Related episodes from other shows

- [Ep 223: Smoking Smart Meter, 489 Megapixels, and Unshredding Documents](https://hardwarepodcasts.com/podcast/hackaday-podcast/2023-06-16-ep-223-smoking-smart-meter-489-megapixels-and-unshredding-documents) (Hackaday Podcast)
- [An Interview with Samy Kamkar](https://hardwarepodcasts.com/podcast/the-amp-hour/2016-07-22-an-interview-with-samy-kamkar) (The Amp Hour)
- [Hardware Security with Matt Brown](https://hardwarepodcasts.com/podcast/the-amp-hour/2025-07-17-hardware-security-with-matt-brown) (The Amp Hour)
- [An Interview with Dmitry Nedospasov](https://hardwarepodcasts.com/podcast/the-amp-hour/2016-06-17-an-interview-with-dmitry-nedospasov) (The Amp Hour)
- [#397.6 - An Interview with Matt Knight](https://hardwarepodcasts.com/podcast/the-amp-hour/2018-06-24-397-6-an-interview-with-matt-knight) (The Amp Hour)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-12-16-053-its-hammer-time. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Unnamed Reverse Engineering Podcast.