Security Blog
Internet Of Things
The Pen Test Partners Security Blog brings you the latest news and trends in penetration testing and the internet security industry.
More about our security blog »
For the best user experience please upgrade your browser
Advice for manufacturers on the coming PSTI regulation
23 Feb 2024
Ski & bike helmets protect your head, not location or voice
07 Feb 2024
IoT Secure Development Guide
10 Oct 2023
Effecting positive change in the Internet of Things
21 Oct 2022
We need to talk about sex toys and cyber security
23 May 2022
What does the Product Security and Telecommunications Infrastructure bill mean for me?
25 Nov 2021
Hijacking smart luggage
11 Nov 2021
When the IoT vendor goes bust
28 Sep 2021
Why the Raspberry Pi isn’t suitable for IoT
01 Sep 2021
Is IoT ever really yours?
08 Mar 2021
Smart male chastity lock cock-up
06 Oct 2020
360lock Smart Lock Review
11 Sep 2020
Threat modelling and IoT hubs
17 Jul 2020
Hacking smart devices to convince dementia sufferers to overdose
09 Jul 2020
Pwning smart garage door openers
07 Jul 2020
Identity in IoT
01 Jul 2020
What an IoT assurance scheme could look like
30 Jun 2020
Unclamping the Barnacle
04 Jun 2020
You can’t build a great IoT system without a strong foundation
17 Apr 2020
Embedded devices. Typical security issues
26 Jan 2020
Kids Tracker Watches: CloudPets, exploiting athletes and hijacking reality TV
17 Dec 2019
Xmas Light Security Improves… a bit
10 Dec 2019
Pwning a Smart Car Charger, Building a Botnet
06 Nov 2019
Objections to IoT regulation. A rational reply
24 Oct 2019
Drilling open a smart door lock in 4 seconds
23 Sep 2019
IoT security. A retrospective
17 Sep 2019
A Secure “Smart” Kettle?
30 Aug 2019
ZTE MF910 – An end of life router, running lots of vivacious hidden code
10 Aug 2019
Group sex app leaks locations, pics and personal details. Identifies users in White House and Supreme Court
08 Aug 2019
DCMS Practical Guidelines. Actionable information
02 Aug 2019
Vehicle Telematics Security; getting it right
26 Jul 2019
Fails and Fixes with IoT
19 Jul 2019
Burning down the house with IoT
12 Jul 2019
Tic Toc Pwned
15 Apr 2019
Connected camera cock up
20 Mar 2019
Hacking ski helmet audio
04 Mar 2019
Different ‘smart’ lock, similar security issues
18 Feb 2019
Super-systemic IoT flaws
05 Feb 2019
GPS watch issues… AGAIN
29 Jan 2019
IoT: OFF by default
11 Jan 2019
Hacking the Echo echo echo
02 Jan 2019
Hackers in Hot Water. Pwning smart hot tubs, yes really
22 Dec 2018
Tracking and snooping on a million kids
15 Nov 2018
Flogging a dead smart horse
09 Nov 2018
Ghost hardware. Device No.3, the Ghost Rover
31 Oct 2018
Hacking ghost hunters
30 Oct 2018
‘Secure by Design’ & SB-327. Standards for a secure IoT?
09 Oct 2018
Smart male chastity lock cock-up – plot thickening
09 Oct 2018
Which? Magazine recommends vulnerable smart home camera
08 Oct 2018
Speaking at TEDx
28 Sep 2018
Hacking an assault tank… A Nerf one
13 Sep 2018
Smart Locks: Dumb Security
31 Aug 2018
Smart Lock Security: Interview with hardware.io
30 Aug 2018
PTP, IoT & the Norwegian Government
15 Aug 2018
Security Alarm Round-up
30 Jul 2018
FLIR FX / Lorex video stream hijack: Disclosure train wreck
26 Jul 2018
Hacking Swann & FLIR/Lorex home security camera video
26 Jul 2018
EU Cybersecurity Act IoT FAIL
19 Jul 2018
Breaking up is hard to do… with IoT
06 Jul 2018
Totally Pwning the Tapplock (the API way)
15 Jun 2018
Totally Pwning the Tapplock Smart Lock
13 Jun 2018
Z-Shave. Exploiting Z-Wave downgrade attacks
23 May 2018
Hijacking Philips Hue
16 May 2018
‘Hacking’ the Nespresso Prodigio and Jura E8 coffee machines
17 Apr 2018
PTP and Microsoft to brief EU Parliament
19 Mar 2018
WHY is consumer IoT insecure?
07 Mar 2018
Security by Design. UK Gov’s first stab at IoT consumer protection isn’t good enough
07 Mar 2018
Hijacking & rick rolling a smart guitar amp
26 Feb 2018
Reverse Engineering BLE from Android apps with Frida
23 Feb 2018
IoT vulns are unexploitable by the masses. Wrong
21 Feb 2018
Xiong Mai DVR Revisited
19 Feb 2018
Hacking / ruining the Samsung Smart Fridge
14 Feb 2018
A smart sex toy that pings your employer?
12 Feb 2018
Want entropy? Don’t use a floating ADC input
06 Feb 2018
Runtastic deserves more ‘heat’ than Strava!
02 Feb 2018
NoT: Taking the ‘internet’ out of IoT
25 Jan 2018
The most common IoT device security failings of 2017
02 Jan 2018
Hacking a talking toy parrot
01 Dec 2017
This week’s IoT security news
27 Nov 2017
Destroy kids GPS watches says German Federal Network Agency
17 Nov 2017
IoT vendors. Avoid recalls, choose a secure chip
17 Nov 2017
The art of finding JTAG on PCBs
04 Oct 2017
Screwdriving. Locating and exploiting smart adult toys
29 Sep 2017
Dumping CC2540 Firmware. An IoT how-to
18 Sep 2017
Tearing down the Star Wars Battle Drone toy from Propel
01 Sep 2017
IoT: Convenience vs. Privacy. Where do you draw the line?
24 Aug 2017
Brick or Bot? Solving OTA update issues
16 Aug 2017
Analysis: Draft US Senate IoT security bill
10 Aug 2017
“Alexa, use IoT to kill the power grid”
07 Aug 2017
Which IoT product should I buy?
01 Aug 2017
Adult IoT toys. Privacy invasion or worse?
24 Jul 2017
IoT security testing methodologies
20 Jul 2017
Could ‘Right to Repair’ heighten the risk for IoT and smart devices?
12 Jul 2017
UnBrickerBot? XiongMai fix Mirai DVR security issues… and fail
03 Jul 2017
What did Mirai Miss? Making a better, bigger botnet
06 Jun 2017
Hacking wireless house alarms
05 Jun 2017
IN THE NEWS: BBC Click. The IoT at Dover Castle
24 May 2017
Keep your IoT schematics private
19 Apr 2017
IoT Aga. Cast iron Security Flaw
12 Apr 2017
Vulnerable Wi-Fi dildo camera endoscope. Yes really
03 Apr 2017
Nifty XSS in Annke SP1 HD wireless camera
23 Mar 2017
Jurassic Poke: Hacking a Dino toy
16 Mar 2017
Weeping Angel / Fake OFF for Android TV
08 Mar 2017
Weeping Angel. Old News?
08 Mar 2017
No Genesis Toys, My Friend Cayla can be hacked even if you do follow the instructions!
06 Mar 2017
CloudPets data breach
28 Feb 2017
MyFriendCayla banned. Are all listening Bluetooth devices set for the bin?
21 Feb 2017
Our Friend Cayla: No Longer Welcome in Germany!
17 Feb 2017
Screw Cayla: Use Chromecast for rogue Amazon Echo voice control!
14 Feb 2017
Secure all the things with other things via the Blockchain!
10 Feb 2017
End of the line, Internet of Things
02 Feb 2017
How to avoid blowing your privacy online
25 Jan 2017
Leaked DVR creds added to the IoT Fail list
11 Jan 2017
Who wants a hairbrush that’s connected to the internet?
06 Jan 2017
Edimax Wi-Fi Extender can disclose your WPA key
06 Jan 2017
Christmas lights. Festive security issues?
05 Jan 2017
Just in time for Christmas- the Cayla reminder
16 Dec 2016
TalkTalk router hack. Consumers, what should you do?
07 Dec 2016
IoT Encryption: The challenge of missing entropy
07 Dec 2016
My Friend Cayla wakes up and smells the lawsuits
06 Dec 2016
TalkTalk and other ISPs need to replace customer routers urgently
03 Dec 2016
TR-064 worm. It’s not Mirai and the outages are interesting
02 Dec 2016
Can Linux really be owned by holding the Enter key?
16 Nov 2016
Filling in gaps in Mirai. It’s about DVRs, not cameras
11 Nov 2016
The Wi-Fi enabled LG air conditioner
08 Nov 2016
What is Mirai? The malware explained
03 Nov 2016
Too little, too late. IoT vendors wake up and smell the coffee. …and the lawsuits
27 Oct 2016
Smart Fridge. Dumb idea?
21 Oct 2016
Optimising Mirai: A better IoT DDoS botnet?
06 Oct 2016
Yet another vulnerability in the Smarter Wi-Fi Kettle
06 Oct 2016
IoT DDoS – we haven’t seen the half of it yet. Nor have utilities…
27 Sep 2016
All your video are belong to us part 3. The D-Link 932L webcam
05 Sep 2016
Stupidly insecure electronic / RFID door lock
19 Aug 2016
Samsung’s smart camera. A tale of IoT & network security
11 Aug 2016
Thermostat Ransomware: a lesson in IoT security
08 Aug 2016
Smarter Coffee machines still being found unconfigured
19 Jul 2016
Home security camera isn’t secure. SpotCam in the spotlight
07 Jul 2016
Alarm systems alarmingly insecure. Oh the irony
29 Jun 2016
All your video are belong to us part 2. The TP Link TL-SC3230’s CSRF
27 Jun 2016
All your video are belong to us. The Foscam webcam
21 Jun 2016
Advice for IoT device manufacturers
22 Apr 2016
Snooping where the sun doesn’t shine
22 Apr 2016
Apps and Après. Skiing and privacy
15 Mar 2016
BLN’s IoT Forum. What went down
10 Mar 2016
Pwning CCTV cameras: Update
23 Feb 2016
Steal your Wi-Fi key from your doorbell? IoT WTF! UPDATE
12 Jan 2016
Steal your Wi-Fi key from your doorbell? IoT WTF!
08 Jan 2016
Star Wars BB-8 IoT toy: awesome fun, but can it be turned to the Dark Side with this vulnerability?
06 Jan 2016
Wi-Fi HaLow 802.11ah for IoT. 802.11uh-oh?
05 Jan 2016
OWASP Birmingham IoT Hackathon
17 Dec 2015
VTech Innotab Max: it’s getting even worse! Apps run in debug mode
03 Dec 2015
New, easier ways to make My Friend Cayla swear
20 Nov 2015
The IoT: Innovation or Exploitation?
18 Nov 2015
Hacking a Wi-Fi Coffee Machine – Part 1
16 Nov 2015
What if your fridge said “no”? What if indeed?
11 Nov 2015
New Wi-Fi kettle, same old security issues? Meh.
15 Oct 2015
Tonight’s CSI Cyber: implausible Marla talking doll hack. Fiction stranger than truth for once
06 Oct 2015
Hacking the Aldi IP CCTV Camera (part 2)
02 Oct 2015
44CON London: Our IoT Security Workshop
11 Sep 2015
Pen Test Partners IoT workshop at 44CON London
07 Sep 2015
Hacking DefCon 23’s IoT Village Samsung fridge
18 Aug 2015
Inside the spy tank; a hardware review.
11 Aug 2015
How to hack an app enabled device to make it truly internet enabled
17 Jul 2015
Finding wireless kettles with social networks
01 Jul 2015
My Friend Cayla. Updated app; Updated security fails. How to make her swear (again!)
22 Jun 2015
Encrypting the database has done virtually nothing to secure the doll and app.
Why you’re better off buying expensive smart scales
15 Jun 2015
Extracting your WPA PSK from bathroom scales
08 Jun 2015
The Coming Revolution: Hardware attacks and the internet of things
26 Nov 2013
Suffered a Security breach?
Mobile Security
Social Engineering
Web application testing
Security Consuting
