YT YouTube2Text

YouTube2Text → Transcripts → 🚨 ENGENHARIA REVERSA COM IA | QUANTO TEMPO ATÉ HACKEAREM SEU BANCO?

🚨 ENGENHARIA REVERSA COM IA | QUANTO TEMPO ATÉ HACKEAREM SEU BANCO? — Transcript

by mano deyvin · 2,649 words · 390 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00But first, let me ask you something: do
0:02you know what your bank app, a card
0:04reader, and a hard wallet—the one you
0:06bought to keep your cryptos safe—all
0:09have in common? What does each one of
0:11them run? An embedded system that was
0:14written about 5, 10, 15, or 20 years
0:17ago. Back in a time when, if we were
0:20talking about reverse engineering, it
0:22would take days, weeks, months, or
0:23years. And the cost to find a
0:27vulnerability, my friend, was so high
0:29that nobody really bothered to try and
0:31fix what was going on, man. But in
0:33October 2026, all that changed, my
0:37player. There's a guy on YouTube called
0:39Low Level. The guy is basically an
0:41expert in reverse engineering. This guy
0:43went there and did an "Illuminati"
0:44experiment, man, that was quite
0:46interesting. He took a Dell monitor, he
0:48threw the monitor's firmware into the
0:50AI. In 15 minutes, it managed to
0:52extract the encryption key, decrypted
0:54the binary, verified the MD5, and
0:56proved that it, my friend, that it was
0:58correct. Man, do you have any idea that
1:01it did that in 15 minutes? Dude, 15
1:03minutes? No, not 15, actually, it was
1:0516 minutes. And he even admitted in a
1:07video there that he rounded it off, my
1:08friend, it was 16 minutes, man. Think
1:11with me: something that took, I don't
1:13know, a week for you to break, to
1:14reverse engineer, man, that thing, damn
1:16, in 16 minutes, man. Now think with me
1:19, if the AI can do that with Dell
1:21monitor software, how long do you think
1:23it would take to do the same thing?
1:27Maybe with that old internet banking
1:29from that bank, that chip in those card
1:31readers, or, I don't know, a hard
1:33wallet, because if we stop to think,
1:35everything made here in Brazil, my
1:37friend, wasn't built to withstand an AI
1:39that scans firmware; in 15, 16 minutes
1:41it can solve it. They didn't think
1:44about that back in the day, man. And
1:46that's going to be our topic for today.
1:47So subscribe to the channel, leave a
1:48like, and turn on notifications so you
1:50don't miss any videos. Help this
1:52channel reach 400,000 subscribers,
1:54please, because this is the biggest
1:56tech pub around. There's no mentorship
1:58or course selling here. Now grab your
2:02coffee because I'm going to explain to
2:04you, man, why I thought what this guy
2:05did was a complete absurdity, which
2:07people even sent me a ton during the
2:08live stream. I said, "Man, what a
2:09boring topic." But, man, hold on, hold
2:11on, because today we're going to talk
2:12about it, man. If you have a Dell
2:13monitor, for example, Dell goes and
2:15publishes an EXE firmware update, and
2:17inside that EXE, it usually has the
2:19real firmware, already decrypted. And
2:21nobody, man, who publishes this stuff,
2:23they don't want anyone messing with it,
2:24because, damn, it's in an EXE, it's
2:26locked. The normal reverse engineering
2:27process, man, was basically the
2:29following. You'd take that EXE and
2:31extract it with that binwalk tool. In
2:33the normal reverse engineering process,
2:35man, how did that work? Basically, you
2:38could take that EXE and perform an
2:40extraction on it using binwalk. Then
2:42what would happen? You'd find the DLL
2:45for that thing and you'd open it with
2:47Ghidra, which is a framework from the
2:48NSA, man. Then you'd, man, you'd go
2:52there, find, for example, the
2:53encryption function, try to understand
2:55the algorithm, guess more or less where
2:57the key is, then, man, you'd test,
2:59you'd fail, test again until that thing
3:00worked, man. And usually the people who
3:04work with this, guys, they take, I
3:05don't know, an average of one to two
3:07days, sometimes even a few weeks, man,
3:08or months or years, it really depends
3:10on the challenge, man. The low-level
3:12guy says that for him it would take
3:14more or less a week to be able to get
3:16this done, man, because it varies a lot
3:18from professional to professional. The
3:20more experienced guys, man, are quick
3:21on their feet. And what did the AI do
3:23in this case, big guy? In 15 minutes,
3:25it went there, basically it extracted
3:27the container from inside the firmware,
3:28it opened Ghidra and it didn't open it
3:30the usual way, it opened it how? Via
3:32MCP, man. It identified the function
3:34that created it, big guy. Man, this was
3:36wonderful. It identified the function
3:38that created the blob of the the the
3:40key itself, you know? It identified the
3:42decrypt function inside that thing. And
3:44the craziest part, man, it wrote a
3:46Python script to be able to decrypt
3:48that stuff, man. Man, he ran the script
3:51and it simply, what? It worked, man.
3:53But then it didn't just work, it did
3:56something that, man, it was just
3:59mind-blowing, man. After decrypting
4:02this thing, it basically verified it,
4:05grabbed the MD5 stored at the offset,
4:07the 0x1CD of the binary, cleared the
4:10field, computed its own MD5, and
4:12compared the two, man. Dude, the crazy
4:15thing is that it matched, it actually
4:17worked, man. After that, it went and
4:20performed an entropy analysis, hell,
4:22understood the byte patterns, the reset
4:24vector, checking if it was in the right
4:26place, if the code was consistent with
4:28the Dell monitor chip he was using,
4:30even an MStar 8051 microcontroller. Man
4:34, everything was lining up, dude.
4:36Everything matching, everything, damn,
4:37working perfectly. And if we stop to
4:40think about it, man, it did the work
4:42and proved to the guy it was right, in
4:4316 minutes, just like he said in the
4:45video. Then, buddy, you might think: "
4:49Well, fine, the AI helped a hacker hack
4:51a monitor, that's what happened, all
4:53good, time to leave the video." Nothing
4:56new. That's where you're wrong, my
4:58cloud code pro player. Forget the
5:00monitor, man. Forget this monitor talk.
5:02Let's bring this to a real-world
5:04example, for our daily lives. What's
5:06happening is that this reverse
5:07engineering thing has become accessible
5:09, it's become easy, man. Over on X, I
5:11started seeing Yuri Dev himself. He
5:13managed to reverse engineer his air
5:15conditioner, made this thing where he
5:17could control his AC directly from his
5:19computer, man, directly from his Mac.
5:21Put a little bar there and everything,
5:23man, it looked beautiful. I'm seeing
5:24several projects today on X popping up
5:26because of this reverse engineering
5:28thing that guys are doing on everything
5:30, man. But there's another side to it,
5:32because what people used to need was
5:34maybe a top-tier expert, a guy with, I
5:35don't know, 5 years of experience in
5:37Ghidra, in Assembly, whatever, someone
5:39who really knew their stuff about
5:40cryptography. Now, buddy, hell, anyone
5:43can do this stuff, man. And they do it,
5:45hell, with prompts, with libs, it's
5:46already got a bunch of stuff, a bunch
5:47of projects, a GitHub already showing
5:49this off, man. And do you know what
5:51that means in practice, my player? The
5:53guy from the low-level channel actually
5:56ends his video saying exactly that, man
5:58, that it's going to generate way more
6:00bugs, because anyone can do reverse
6:02engineering now, and by doing that,
6:03they can find a bug, find a little
6:05vulnerability that, man, people didn't
6:07count on being this accessible, you
6:09know? Because before, buddy, to find a
6:11bug in firmware, man, it was impossible
6:13, nobody explored it, very few people
6:14were interested in that, man. I mean,
6:17you needed tons of time, for example,
6:18you needed a group with knowledge,
6:20really sharp people, but now it's cheap
6:22, man. It’s accessible, damn it. 15
6:23minutes, 16 minutes, the guy can
6:25explore the thing, man. And for us, the
6:29old-school programmers who are now
6:30current vibe coders, you, me, any dev,
6:33man, especially my friends who are now
6:35firmware programmers, these guys are
6:37going to feel it firsthand, because the
6:39software we publish, the firmware we,
6:41for example, end up embedding in
6:43something, man. The API we manage to
6:46expose, all of that now gets scanned by
6:48artificial intelligence. And what’s
6:51most bizarre is that, man, we know the
6:53number of people who are exploring the
6:55web applications we have, the ones we
6:57create, man, it's absurd. Now, damn,
6:58people are going to be exploring the
7:00hell out of firmware, man. And the same
7:02low-level guy, who is a hacker and all,
7:04he's on the side of the attackers, he
7:06said a phrase that was quite
7:07interesting, quote. The ability to
7:09dismantle poorly designed things and
7:11find flaws is now what? It's a
7:13commodity. It’s literally something
7:15anyone can do, man. You don't even need
7:16to have the free time. You leave that
7:18agent running there, and that thing
7:19will find some crap and just throw it
7:20out like this. Take it, there’s your
7:22crap, man. Anyone can do that. This put
7:25a bug in my ear, man, I was like: "Man,
7:27look at the point we might reach,
7:29because over in the United States, a
7:31guy went there, gave an example of a
7:32Dell monitor, for instance." We are
7:35seeing people, man, taking over the
7:37firmware of air conditioners and such,
7:38and controlling them. But here in
7:41Brazil, man, we have much worse
7:42problems, and, damn, if you use an AI
7:44like this, something focused on reverse
7:46engineering, man, it could destroy
7:48everything in 15 minutes. There’s a
7:51lot of absurd stuff that, man, is
7:52basically served on a silver platter
7:54for you to do. Let’s bring up a
7:55practical example. Think about banks
7:57now. Think about the banks. Today we
7:59know that banks have apps and such,
8:01it’s okay, it’s working. But we
8:03know that many banks, especially when
8:05we talk about corporate accounts, they
8:07still run some, man, incredibly legacy
8:09stuff. Like that old Java applet, that
8:12thing just running there. Man, there
8:14were even recent cases of one that only
8:15opened in Internet Explorer, dude.
8:16I’ve had reports of that, man. So
8:18think with me, man, it’s still there.
8:21There are many banks today that run, I
8:22don't know, a Java servlet on an old
8:24Tomcat server, with that .war file that
8:26, I don't know, nobody has touched in
8:2810 years because they’re thinking, "
8:30man, it's working, I'm not touching
8:32that, dude." And if we stop to think,
8:35the people who built that, man, they
8:36might not even be alive, there
8:38shouldn't be any documentation, there
8:39shouldn't be anything. Because you ask
8:41yourself, man, if a bank hasn't updated
8:43or modernized that system to this day,
8:44man, why didn't they? Because if you
8:46touch that crap, the whole thing stops,
8:47man. But now there’s simply an AI
8:49that can, for example, open this binary
8:51and find weak points. And this is a
8:53major risk, in my view. I might be
8:55talking total nonsense. So, if you work
8:56at a bank, man, and you see the, man,
8:58the risk this could pose, damn, comment
8:59down below. Because now, for example,
9:01if you're on the other side, if you,
9:04man, use one of these legacy bank
9:05systems to pay bills, make transfers,
9:08all that banking stuff, man, you now
9:10have to start worrying about: "man, did
9:12these guys audit this?" Is this really
9:14secure? Could someone come along and
9:16pull off some Illuminati scheme to
9:17cause a disaster? No, man, I don't know
9:19, man. I think it's just one more
9:20problem for us to think about, man. And
9:21there’s another side to it, too.
9:22Think about credit card machines. That
9:24one, man, you swipe on those CELO ones
9:27from Rede, Getnet, PagBank. Every one
9:29of those little machines has firmware.
9:31You know there’s firmware in there.
9:32And, bro, every firmware today can have
9:34vulnerabilities. And there’s, we can
9:36take, man, a lot of content from Penny
9:37Gu where he shows, man, so many
9:39vulnerabilities in that stuff. But that
9:40wasn't as explored, it was more of a
9:42hardware hacking crowd, you know? To be
9:44able to find keys and such. But, man,
9:46now pretty much anyone can find
9:48vulnerabilities inside these things,
9:49bro. And it gets worse, man. Think
9:51about the hardware wallet guys, man.
9:53That Ledger, that Trezor. And we had a
9:56recent problem in one of those where,
9:57damn, a huge vulnerability that ended
9:59up leaking people’s keys and such,
10:00and they made a killing off that thing.
10:03Trezor, just so you have an idea, man,
10:05they still publish their firmware to
10:06this day, and the firmware is open on
10:08GitHub, so anyone can access their
10:09repository today and manage to read
10:11that stuff. So its security sort of
10:13already starts from the principle that
10:15the code there is public. So if someone
10:17is clever enough to reverse engineer it
10:19, understand how it's generating that
10:20key, man, everything today is
10:21vulnerable, bro. It can go south, you
10:23know? And there's a lot of stuff, man.
10:25Damn, there are so many applications,
10:26so many things you run, for example, ah
10:28, I have a device here of mine, there
10:29are basic things like that, and you say
10:31: "Ah, man, I never updated this crap,
10:32I never updated the firmware of
10:33anything, man." It’s all there, man,
10:35full of vulnerabilities. If you have
10:36something really important, man, the
10:38chance of it going south is huge. Then
10:39you’ll say: "Ah, man, Devin, come on,
10:41that’s paranoia, dude." That's
10:42paranoia, damn it. Stop with that.
10:44Usually there’s a team focused on
10:46that. The systems are super secure and
10:48such. The guys are already looking at
10:49this, they’re already fixing it, man.
10:50Then, my friend, I throw this question
10:52back at you, man. Are are these guys
10:55really prepared for did they even see
10:57this coming, man? Because, for example,
10:59if something was created back in 2008
11:01and maybe it was built by an outsourced
11:03company or an outsourced dev who might
11:05have already left the company, man; or
11:07maybe, I don't know, it’s using a
11:09Servlet version that is, man, already
11:11super legacy, full of bugs, man. How
11:12much software do you think is on the
11:14market today with these characteristics
11:16, man? I don't know anything. I only
11:18know that looking from the dev side,
11:19looking inside our dev bubble, that man
11:21, I don't think we're very prepared for
11:23this, man. That is exactly what ends up
11:25worrying me. And in that low level
11:26video, which I'll even leave here in
11:28the description, it must be hitting
11:29almost 1 million views already, man. I
11:31think it’s a mandatory thing for you
11:32to watch. Watch this video, I’ll
11:34leave it in the description here for
11:35you to watch easily, because I think
11:36the part where he talks about the hack
11:37in this movie, man, well, that's the
11:38least of it. I think that's silly and
11:40all, everyone is already exploring this
11:42and that. But the thing that, man, that
11:45really makes you suspicious, is that he
11:46doesn't end, for example, with an
11:48answer to this problem, he ends with a
11:49question. I want to leave this question
11:52for you now who are watching this video
11:54, man. If the AI can currently reverse
11:57engineer proprietary software in about
11:5915 minutes, man, how long does it take
12:02to find a flaw, for example, in your
12:04bank's legacy internet banking, in the
12:06app you use to invest, in the card
12:08machine you swipe every day on the
12:10street, or in that Hardware Wallet you
12:12bought to store your crypto keys? I
12:15don't know the answer, I don't know
12:16anything. I'll leave it for you to
12:18answer here in the comments if it's my
12:19paranoia or not. Not subscribed to the
12:21channel? Subscribe to the channel,
12:22leave a like, turn on notifications so
12:23you don't miss any videos. Help me
12:24reach 400,000 subscribers. We're in
12:26this together. Big hug. See you in the
12:27next video.

About this transcript

This page contains the full transcript of 🚨 ENGENHARIA REVERSA COM IA | QUANTO TEMPO ATÉ HACKEAREM SEU BANCO? by mano deyvin, generated from the public captions YouTube serves with the video. The transcript has 2,649 words across 390 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.