Travis Goodspeed

Background

Travis Goodspeed is an American reverse engineer and hardware security researcher based in East Tennessee, in the Southern Appalachian region of the United States. He is known within the embedded-security and hardware-hacking community for combining formal vulnerability research with a hands-on, low-cost, do-it-yourself approach to reverse engineering consumer and industrial electronics. He has described his own approach to picking research targets as "junk hacking" — reverse engineering inexpensive, easily obtainable devices as a way to develop and demonstrate techniques without the legal or political complications that come with attacking expensive commercial or governmental systems.

GoodFET and early hardware-hacking work

Goodspeed is best known as the creator of GoodFET, an open-source USB JTAG adapter first released in the late 2000s. Loosely based on Texas Instruments' MSP430 FET debugging hardware, GoodFET was designed to be cheap to build and easy to reprogram, and it became a widely used tool for debugging, dumping firmware from, and reverse engineering microcontrollers across many different chip families. In 2009 he presented research on mask-ROM bootloaders at the USENIX Workshop on Offensive Technologies (WOOT), published as "Half-Blind Attacks: Mask ROM Bootloaders are Dangerous," which described techniques for exploiting the read-only bootloader code baked into microcontroller silicon during manufacturing.

Facedancer, wireless research, and further tools

Building on his hardware-hacking work, Goodspeed created Facedancer, a framework and family of USB boards for emulating and fuzzing USB devices, which has since been used and extended by other researchers for USB protocol security testing. In 2011, while affiliated with the University of Pennsylvania, he co-authored and presented "Packets in Packets: Orson Welles' In-Band Signaling Attacks for Modern Radios" at USENIX WOOT, demonstrating a packet-in-packet technique for injecting raw frames into wireless networks by embedding a complete physical-layer packet inside the payload of another, uncontrolled packet. He has also published research on extracting firmware from historically significant hardware through direct ROM photography, including a firmware and ROM dump of the MYK-82 chip used in the Fortezza cryptographic card, a successor to the U.S. government's Clipper Chip.

Reverse engineering the Tytera MD-380

One of Goodspeed's most publicly visible projects has been the reverse engineering of the Tytera (TYT) MD-380, a low-cost digital mobile radio (DMR) handheld popular with amateur radio operators. Presenting at ShmooCon in 2016, he detailed how he analyzed the radio's USB Device Firmware Update (DFU) protocol, discovered undocumented vendor-specific commands, and found a null-pointer vulnerability that allowed reading of protected bootloader memory on the radio's STM32 microcontroller. This research, later published in detail in the PoC||GTFO journal, underpinned the community-maintained md380tools project, which patches the radio's firmware to add features such as displaying callsigns during transmission, effectively turning an inexpensive commercial radio into a customizable amateur-radio and DMR-scanning platform.

PoC||GTFO and publishing

Goodspeed is a co-editor of PoC||GTFO ("Proof of Concept or Get The F*** Out"), a reverse-engineering journal distributed as a hacker zine that mixes deeply technical essays on topics such as file-format polyglots, chip decapsulation, and firmware exploitation with unconventional formatting and humor. Issues of PoC||GTFO have been collected and republished in print by No Starch Press. Goodspeed has contributed numerous technical articles to the journal, including pieces on chip decapsulation and photography, and has used it as a primary outlet for publishing his own research rather than relying solely on traditional academic venues.

Later work and recognition

Goodspeed has continued to speak at hacker and security conferences including DEF CON, ShmooCon, Black Hat Arsenal, HITB, 44CON, and hardwear.io, and has taught training courses on microcontroller and embedded-system exploitation. In 2024, No Starch Press published his book Microcontroller Exploits, which documents a series of real hardware hacks and firmware vulnerabilities against embedded devices. His body of work is frequently cited as foundational reading for practitioners entering embedded and hardware security, and tools he created or inspired, such as GoodFET and Facedancer, remain in active use in the reverse-engineering community.

Timeline

• 2009Releases the GoodFET open-source JTAG/hardware-hacking adapter and presents "Half-Blind Attacks: Mask ROM Bootloaders are Dangerous" at USENIX WOOT.
• 2011Presents "Packets in Packets" in-band signaling/packet-injection research for wireless radios at USENIX WOOT while affiliated with the University of Pennsylvania.
• 2013Co-founds/edits the PoC||GTFO reverse-engineering journal with collaborators, publishing technical hacking research in zine form.
• 2016-01Presents reverse-engineering research on the Tytera MD-380 DMR radio firmware at ShmooCon, leading to the community md380tools project.
• 2024No Starch Press publishes his book Microcontroller Exploits.