Security Blog
The Pen Test Partners Security Blog brings you the latest news and trends in penetration testing and the internet security industry.
More about our security blog »
For the best user experience please upgrade your browser
How we helped expose a £12 million rental scam
19 Nov 2024
Did security gaps at Antwerp port enable drug smuggling operations?
12 Nov 2024
BEC-ware the Phish (part 2): Respond and Remediate Incidents in M365
08 Nov 2024
You lost your iPhone, but it’s locked. That’s fine, right?
06 Nov 2024
Maritime lawyers assemble!
05 Nov 2024
What goes into testing a ship?
05 Nov 2024
Mounting memory with MemProcFS for advanced memory forensics
31 Oct 2024
Testing the security of CCTV systems
30 Oct 2024
Using Volatility for advanced memory forensics
24 Oct 2024
BEC-ware the phish (part 1). Investigating incidents in M365
15 Oct 2024
Imposter syndrome in cyber security
10 Oct 2024
How to handle vulnerability reports in aviation
09 Oct 2024
Airbus Navblue Flysmart LPC-NG issues
01 Oct 2024
How can you protect your data, privacy, and finances if your phone gets lost or stolen?
30 Sep 2024
Direct Memory Access (DMA) attacks. Risks, techniques, and mitigations in hardware hacking
26 Sep 2024
Proroute H685 4G router vulnerabilities
19 Sep 2024
Cyber threats to shipping explained
18 Sep 2024
Living off the land, GPO style
12 Sep 2024
Smart home security advice. Ring, SimpliSafe, Swann, and Yale
10 Sep 2024
Advanced forensic techniques for recovering hidden data in wearable devices
04 Sep 2024
How to enhance the security of your social media accounts
30 Aug 2024
How to root an Android device for analysis and vulnerability assessment
23 Aug 2024
Insights and highlights from DEF CON 32
16 Aug 2024
Living off the land with Bluetooth PAN
12 Aug 2024
Key safe security, or the lack of it
07 Aug 2024
Fuzzy matching with Ghidra BSim, a guide
05 Aug 2024
Bootloaders explained
01 Aug 2024
Leave the World Behind, or don’t
24 Jul 2024
Pen testing cruise ships
08 Jul 2024
RCE vulnerability in OpenSSH – RegreSSHion (CVE-2024-6387)
02 Jul 2024
Glastonbury ticket hijack vulnerability fixed
28 Jun 2024
Dodgy disks. My 32TB SSD Adventure
21 Jun 2024
HUMINT in a cyber world
20 Jun 2024
UK PSTI? You’ll need a Vulnerability Disclosure Program!
24 May 2024
Impacts on ICS from the updated Cyber Assessment Framework (CAF)
17 May 2024
Pipedream ICS malware toolkit is a nightmare
09 May 2024
Vulnerabilities that (mostly) aren’t: LUCKY13
03 May 2024
Bypassing MFA on Microsoft Azure Entra ID
01 May 2024
Can ships be hacked?
12 Apr 2024
Navigating the perilous waters of conference invitations
14 Mar 2024
The big play of autonomous vehicles
12 Mar 2024
Living off the land with native SSH and split tunnelling
06 Mar 2024
Advice for manufacturers on the coming PSTI regulation
23 Feb 2024
No fix KrbRelay VMware style
21 Feb 2024
Cyber security for Credit Unions 101
20 Feb 2024
QR Phishing. Fact or Fiction?
15 Feb 2024
Android Content Providers 101
13 Feb 2024
Ski & bike helmets protect your head, not location or voice
07 Feb 2024
Hacking Electronic Flight Bags. Airbus NAVBLUE Flysmart+ Manager
01 Feb 2024
OSINT in 60 seconds. Mind reading on TV
30 Jan 2024
10 years on from the Target breach. Has building cyber security improved?
24 Jan 2024
Cockpit door lock auto-unlock is no surprise
10 Jan 2024
Listening in at Latimer House. RF emissions and more
09 Jan 2024
RAID Technology and the importance of disk encryption in data security
04 Jan 2024
Mobile malware analysis for the BBC
02 Jan 2024
Helping a banking fraud victim
02 Jan 2024
Helping a mobile malware fraud victim
02 Jan 2024
Socks! Our cyber prediction for 2024
22 Dec 2023
Intercepting MFA. Phishing and Adversary in The Middle attacks
12 Dec 2023
Navigate FDA 524b to get your medical cyber device to market
07 Dec 2023
OSINT. What can you find from a domain or company name
05 Dec 2023
OPSEC failures when threat hunting
30 Nov 2023
Are Vehicle to Grid spikes coming?
27 Nov 2023
Cap Dev. Better red teaming with continuous Capability Development
23 Nov 2023
FujiFilm printer credentials encryption issue fixed
31 Oct 2023
FDA medical IoT cyber device compliance. FD&C 524b
31 Oct 2023
Using Velociraptor for large-scale endpoint visibility and rapid threat hunting
12 Oct 2023
IoT Secure Development Guide
10 Oct 2023
The reality of Apple watch pen testing
09 Oct 2023
Call centres. Outbound call verification
03 Oct 2023
Fastboot Fuzzing
29 Sep 2023
Which security framework? All of them, in the SCF
27 Sep 2023
3yrs of CAA ASSURE assessments. What we’ve learned
20 Sep 2023
PCI v4 is coming. Are you ready?
14 Sep 2023
Information disclosure through insecure design
07 Sep 2023
A broken marriage. Abusing mixed vendor Kerberos stacks
25 Aug 2023
The most hated man on the internet. Lessons to learn
22 Aug 2023
Scorpion CBS show. Plane hack
14 Aug 2023
Die Hard 2. Or how not to hack airplanes
14 Aug 2023
Vulnerability disclosure in aviation
09 Aug 2023
PTP at DEF CON 31 2023
03 Aug 2023
n00b’s guide to DEF CON. Surviving the Matrix of the underground
03 Aug 2023
Have you been compromised?
02 Aug 2023
Exposed Gits: 10 Years on
19 Jul 2023
Black Basta ransomware
28 Jun 2023
WhosHere Plus. Trilateration vulnerability
12 Jun 2023
EFB vulnerability in Lufthansa’s Lido eRouteManual
24 May 2023
All your building are belong to us
19 May 2023
It’s always DNS, here’s why…
16 May 2023
Netflix MH370: The plane that wasn’t hacked
12 May 2023
Bullied by Bugcrowd over Kape CyberGhost disclosure
05 May 2023
London Councils & pirate books. Google dorking for subdomain takeovers
11 Apr 2023
Carbon reduction at PTP
17 Mar 2023
Monetising hacking by shorting commodity shipments
08 Mar 2023
Finding forensics breadcrumbs in Android image storage
20 Feb 2023
Causing incidents with in-flight entertainment systems
07 Feb 2023
OSINT your OT suppliers
24 Jan 2023
UK gov website being used to redirect to porn sites
09 Jan 2023
RCE on Steam through the Cultist Simulator game
02 Jan 2023
What’s My Name Again? Reolink camera command injection
13 Dec 2022
Consumer advice for buying smart IoT devices this Christmas
02 Dec 2022
Hive Ransomware is on the rise. How should you deal with it?
18 Nov 2022
IACS UR E26 and E27 guidance
14 Nov 2022
Effecting positive change in the Internet of Things
21 Oct 2022
Social Engineering dos and don’ts
20 Oct 2022
Moto E20 Readback Vulnerability
19 Oct 2022
MS Enterprise app management service RCE. CVE-2022-35841
13 Oct 2022
Living off the Cloud. Cloudy with a Chance of Exfiltration
11 Oct 2022
Airbus AoA – Angle of Attack sensor issue
03 Oct 2022
Attacking Encrypted HTTP Communications
28 Sep 2022
You can’t stop me. MS Teams session hijacking and bypass
22 Sep 2022
DEF CON 30. Hacking EFBs. Engine Performance
08 Sep 2022
When disclosure goes wrong. People
02 Sep 2022
Living off the land, AD CS style
26 Aug 2022
Bluetooth + Electrical switchgear
25 Aug 2022
Database Integrity Vulnerabilities in Boeing’s Onboard Performance Tool
13 Aug 2022
Maritime regulation. All Hands-on Deck!
05 Aug 2022
Efficient Infrastructure Testing
01 Aug 2022
Attacking EFB updates
27 Jul 2022
EFB ePIL. Pinching passenger PII from pilots
15 Jul 2022
Stop using phishing as a measure of your cyber awareness culture
12 Jul 2022
EFB Tampering. Holdover Time
06 Jul 2022
Cloud OSINT. Finding Interesting Resources
04 Jul 2022
CMC Electronics EFB breakout vulnerability
28 Jun 2022
Follina 0day exploit. Malicious code execution in Office docs
01 Jun 2022
Azure Cloud Takeover
31 May 2022
747 Hackathon
25 May 2022
Password policy guidance
23 May 2022
We need to talk about sex toys and cyber security
23 May 2022
Galleon NTS-6002-GPS Command Injection vulnerability (CVE-2022-27224)
20 May 2022
Got the security controls wrong in OT and maritime? Watch as engineers work around them
16 May 2022
Constrained environment breakout. .NET Assembly exfiltration via Internet Options
09 May 2022
Reporting of cyber incidents becomes law in the USA
13 Apr 2022
The reality of OT segregation
31 Mar 2022
To Pay or Not to Pay? That is the Ransomware question
21 Mar 2022
Red Team lab automation
03 Mar 2022
OAuth consent phishing, in the wild
21 Feb 2022
OpSec. Hunting wireless access points
16 Feb 2022
Vulnerabilities that aren’t. Unquoted Spaces
14 Feb 2022
DPD package sniffing
07 Feb 2022
Vulnerabilities that aren’t. ETag headers
04 Feb 2022
Who has access to your leased Tesla?
01 Feb 2022
Vulnerabilities that aren’t. Cross Site Tracing / XST
25 Jan 2022
Domestic CCTV and audio recording
17 Jan 2022
Audio bugging with the Fisher Price Chatter Bluetooth Telephone
22 Dec 2021
Gumtree – leaking your data and not really listening
15 Dec 2021
A masterclass in responding to vulnerability disclosure: The Buddi app and tracker
29 Nov 2021
What does the Product Security and Telecommunications Infrastructure bill mean for me?
25 Nov 2021
SkyFail. 6 million routers left exposed
19 Nov 2021
Hijacking smart luggage
11 Nov 2021
Pun-free Cylance vulnerability, fixed
10 Nov 2021
Time based username enumeration
09 Nov 2021
Limiting your exposure to location data resellers
08 Nov 2021
DCOM abuse and lateral movement with Cobalt Strike
03 Nov 2021
Germ-term, but all year. How criminals are hacking schools
13 Oct 2021
Free BrewDog beer with a side order of shareholder PII?
08 Oct 2021
How to build a password cracking rig during a worldwide chip shortage
05 Oct 2021
When the IoT vendor goes bust
28 Sep 2021
Securing mobile devices. A timely reminder
28 Sep 2021
Commercial Air Transport EFB Regulation
23 Sep 2021
EFB Tampering. Approach and Landing Performance Part 2
14 Sep 2021
EFB Tampering. Approach and Landing Performance Part 1
14 Sep 2021
EFB Tampering. The Human Factor
10 Sep 2021
ASSURE Case Study: Two
03 Sep 2021
ASSURE Case Study: One
03 Sep 2021
From open Guest Wi-Fi to pwning a lift
03 Sep 2021
OpSec. Expanding your search: Hunting domains
02 Sep 2021
Why the Raspberry Pi isn’t suitable for IoT
01 Sep 2021
Admin password re-use. Don’t do it
26 Aug 2021
How to install Frida into an Android application
20 Aug 2021
Breaking the NFC chips in tens of millions of smart phones, and a few PoS systems
18 Aug 2021
The value of regulator-driven red teaming: CBEST
12 Aug 2021
Breaking the Android Bootloader on the Qualcomm Snapdragon 660
09 Aug 2021
OpSec Leaky Images
04 Aug 2021
Smart car chargers. Plug-n-play for hackers?
30 Jul 2021
Are you sharing your address on social media?
30 Jul 2021
The Cloud in the clouds
14 Jul 2021
Top 10 Cloud security tips
08 Jul 2021
SNMP – Simply Not My Problem. Or is it?
02 Jul 2021
Ransomware. In the air?
02 Jul 2021
Google for OpSec data discovery
29 Jun 2021
Red Teaming. Practice what you preach
24 Jun 2021
Tracking Amazon delivery staff
15 Jun 2021
Why hackers don’t fly coach
11 Jun 2021
Deploying EFBs securely
04 Jun 2021
Do you know your OpSec?
28 May 2021
Smart lighting security
21 May 2021
Getting a persistent shell on a 747 IFE
21 May 2021
EFB Tampering 3. Take-off pt1
17 May 2021
EFB Tampering 3. Take-off pt2
17 May 2021
Echelon PII Leak and Disclosure Fail
14 May 2021
EFB Safety Advice for Pilots
07 May 2021
Tour de Peloton: Exposed user data
05 May 2021
2021. The age of the super vulnerability?
26 Apr 2021
We’re Hiring!
23 Apr 2021
Training apps. Have their privacy settings improved in 5 years?
21 Apr 2021
Homeworking vs Homeschooling. The cyber challenge
21 Apr 2021
EFB Tampering 2. Device Integrity
19 Apr 2021
Security vs User Journey
16 Apr 2021
Dumping LSASS in memory undetected using MirrorDump
26 Mar 2021
Multi-factor Authentication. Reset MFA you say?
22 Mar 2021
Out of cyber class. Maritime compliance.
15 Mar 2021
Is IoT ever really yours?
08 Mar 2021
EFB Tampering 1. Introduction and Class Differences
05 Mar 2021
Grid. Locked.
04 Mar 2021
Feature and Permission Policies. Security issues
23 Feb 2021
K&R insurance. Kidnap and Ransom(ware)
22 Feb 2021
Reverse Engineering Keys from Firmware. A how-to
08 Feb 2021
Email Relaying. A how-to and a reminder
05 Feb 2021
Cyber Essentials and the New Normal
26 Jan 2021
Three Word Passwords
19 Jan 2021
Cyber Security advice for Finance staff
15 Jan 2021
Azure AD. Attack of the Default Config
12 Jan 2021
Where maritime cyber checklists fail
11 Jan 2021
Schneider T200 RTU vulnerabilities
07 Jan 2021
How to make a software BTRFS RAID1 with LUKS2 FDE
22 Dec 2020
How to use Keepalived for high availability and load balancing
22 Dec 2020
A Logical Volume Manager / LVM primer for Linux
21 Dec 2020
Mimosa Cloud. Invite friends, not hackers
21 Dec 2020
Serious Vulnerabilities in Dualog Connection Suite
10 Dec 2020
Locking down your cyber life in lockdown
04 Dec 2020
What the cluck?! Cyber hygiene when eating out.
02 Dec 2020
Understanding Binary and Data Representation with CyberChef
24 Nov 2020
OBDeleven vulnerability
18 Nov 2020
Brute forcing device passwords
16 Nov 2020
Digital Forensics acquisition
14 Nov 2020
Snakes and Ladder Logic
10 Nov 2020
Password choice
06 Nov 2020
Abusing RDP’s Remote Credential Guard with Rubeus PTT
22 Oct 2020
Cyber Security Month. What can you do?
08 Oct 2020
Smart male chastity lock cock-up
06 Oct 2020
DLL Hijacking in NVIDIA SMI
01 Oct 2020
Cloud-y, with a chance of hacking all the wireless things
29 Sep 2020
CVE-2020-1472/Zerologon. As an IT manager should I worry?
23 Sep 2020
The Return of Raining SYSTEM Shells with Citrix Workspace app
21 Sep 2020
Speed 2 – The Poseidon Adventure – Part Two
17 Sep 2020
Consumer advice: Giggle vulnerability
14 Sep 2020
360lock Smart Lock Review
11 Sep 2020
Speed 2 – The Poseidon Adventure – Part One
08 Sep 2020
Cloud firewall management API SNAFU put 500k SonicWall customers at risk
02 Sep 2020
Fitbit forensics
29 Aug 2020
A Vulnerability Disclosure Program is not just a page on a web site
26 Aug 2020
Scanning for UK gov security.txt files
26 Aug 2020
Breaking Samsung firmware, or turning your S8/S9/S10 into a DIY “Proxmark”
18 Aug 2020
DEF CON 28: 747 Walkthrough from a Hacker’s Perspective
12 Aug 2020
DEF CON 28: ILS and TCAS Spoofing
11 Aug 2020
DEF CON 28: Introduction to ACARS
10 Aug 2020
Security Awareness is as valuable today as ever
07 Aug 2020
Building a lab with Server 2019 Server Core and PowerShell …then attacking it!
03 Aug 2020
Raining SYSTEM Shells with Citrix Workspace app
21 Jul 2020
Threat modelling and IoT hubs
17 Jul 2020
Bridging the gaps between Red and Blue teaming
13 Jul 2020
Hacking smart devices to convince dementia sufferers to overdose
09 Jul 2020
Patchless AMSI bypass using SharpBlock
07 Jul 2020
Pwning smart garage door openers
07 Jul 2020
Identity in IoT
01 Jul 2020
What an IoT assurance scheme could look like
30 Jun 2020
Scams and how to spot them
30 Jun 2020
Congrats, you got everyone remote. But did you do it securely?
29 Jun 2020
Embedded security fails in ICS
17 Jun 2020
Revisiting old tools
12 Jun 2020
A cyber warning light. The canary in the mine
11 Jun 2020
Unclamping the Barnacle
04 Jun 2020
Introduction to PLCs and Ladder Logic
01 Jun 2020
Reverse Engineering a 5g ‘Bioshield’
28 May 2020
In Flight Entertainment System Security
27 May 2020
Docker Desktop for Windows PrivEsc (CVE-2020-11492)
22 May 2020
Ethical dilemmas with responsible disclosure
22 May 2020
Short beacon analysis on the NHS iOS Tracking application
12 May 2020
Housemates. The new Red Team?
06 May 2020
How quickly can you respond?
05 May 2020
Speaking at security events
04 May 2020
Jeopardising aircraft through TCAS spoofing
01 May 2020
GDPR.EU has er… a data leakage issue
27 Apr 2020
From a TCU to Corporate Domain Admin
24 Apr 2020
Are you cyber seaworthy?
17 Apr 2020
You can’t build a great IoT system without a strong foundation
17 Apr 2020
SweetPotato – Service to SYSTEM
14 Apr 2020
Authenticating your call centre when everyone is remote
06 Apr 2020
Honeyroasting. How to detect Kerberoast breaches with honeypots
01 Apr 2020
Quick wins with Adobe Experience Manager
27 Mar 2020
Turning an OBD-II reader into a USB / NFC attack tool
25 Mar 2020
Spying on old folks
23 Mar 2020
PrivEsc in Lenovo Vantage. Two minutes later
20 Mar 2020
Introduction to Bluetooth Low Energy
12 Mar 2020
9 things to consider when staff work from home unexpectedly
10 Mar 2020
Hardware Router CTF
10 Mar 2020
Fill your Boots with credential stuffing protections
06 Mar 2020
A not so Clearview?
04 Mar 2020
From Minecraft to Metasploit. Game hacking could start your cyber security career
03 Mar 2020
Hardcoding Keys. Is that Wyse?
25 Feb 2020
Ships can’t be hacked. Wrong
20 Feb 2020
Out Of Band, Out Of Sight, Out Of Mind
17 Feb 2020
Business Email Compromise. What to do
14 Feb 2020
Reverse Engineering the Tesla Firmware Update Process
12 Feb 2020
Reverse Engineering Tesla Hardware
12 Feb 2020
Password managers for all staff. Why the resistance?!
10 Feb 2020
2×4 Security
07 Feb 2020
Pen Testing Ships. A year in review
04 Feb 2020
HTTP Request Smuggling. A how-to
31 Jan 2020
ASSURE Aviation Cyber Security Testing
30 Jan 2020
Embedded devices. Typical security issues
26 Jan 2020
IR & Forensics in the Cloud
10 Jan 2020
Quick Wins to Combat Data Leaks
08 Jan 2020
Kids Tracker Watches: CloudPets, exploiting athletes and hijacking reality TV
17 Dec 2019
Xmas Light Security Improves… a bit
10 Dec 2019
Hacking Hardware Password Managers: The RecZone
06 Dec 2019
Hacking Hardware Password Managers: passwordsFAST
06 Dec 2019
Hacking Hardware Password Managers: Royal Vault Password Keeper
06 Dec 2019
Nuclear Satcoms
04 Dec 2019
Commands and Tools for Embedded Reverse Engineering
03 Dec 2019
Analysing the Attack Surface of an Industrial Data Acquisition Device
03 Dec 2019
The snooping girl on a train, again. How to compromise a business
02 Dec 2019
Embedded device research. The tools you’ll need
29 Nov 2019
Ships engines, a guide for pen testers
29 Nov 2019
Christmas socialising. Goodwill to all, and keep your devices safe
28 Nov 2019
The Disgruntled Employee?
15 Nov 2019
Updating Airplanes
11 Nov 2019
Schiphol hijack false alarm. An insiders view of what happened
07 Nov 2019
Pwning a Smart Car Charger, Building a Botnet
06 Nov 2019
Objections to IoT regulation. A rational reply
24 Oct 2019
Unmasking mystery boxes on ship’s bridges
14 Oct 2019
Mapping the Attack Surface of an Airport
11 Oct 2019
Help, my accounts have been hacked! What should I do?
10 Oct 2019
Too Interested?
08 Oct 2019
Real-life social engineering. Another two days in tweets
04 Oct 2019
OSINT for Avionics
04 Oct 2019
The 5 breach readiness mistakes
30 Sep 2019
My environmental journey
28 Sep 2019
A security researcher has made contact. What do I do?
27 Sep 2019
Think you’ve had a breach? Top 5 things to do
23 Sep 2019
Drilling open a smart door lock in 4 seconds
23 Sep 2019
A Pen Tester’s First Solo: Aviation Security 101
20 Sep 2019
How to: Kerberoast like a boss
18 Sep 2019
IoT security. A retrospective
17 Sep 2019
Real-life social engineering. Two days in tweets
16 Sep 2019
Pwning a Siemens Scalance ICS switch through ARM reversing
03 Sep 2019
A Secure “Smart” Kettle?
30 Aug 2019
PrivEsc in Lenovo Solution Centre, 10 minutes later
22 Aug 2019
Lojack’d: Pwning Smart vehicle trackers
14 Aug 2019
Dating apps that track users from home to work and everywhere in-between
11 Aug 2019
Reverse Engineering 4G Hotspots for fun, bugs and net financial loss
10 Aug 2019
Breaking (Bad) Cross-Site Request Forgery Protection – The Netgear Nighthawk M1
10 Aug 2019
CVE-2019-12103 – Analysis of a Pre-Auth RCE on the TP-Link M7350, with Ghidra!
10 Aug 2019
Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1
10 Aug 2019
ZTE MF910 – An end of life router, running lots of vivacious hidden code
10 Aug 2019
Group sex app leaks locations, pics and personal details. Identifies users in White House and Supreme Court
08 Aug 2019
PTP at DEF CON 27
05 Aug 2019
DCMS Practical Guidelines. Actionable information
02 Aug 2019
Vehicle Telematics Security; getting it right
26 Jul 2019
Social engineering. When you’re the mark…
23 Jul 2019
Fails and Fixes with IoT
19 Jul 2019
Burning down the house with IoT
12 Jul 2019
Getting your head under the hood and out of the sand: Automotive security testing
05 Jul 2019
Slok API
03 Jul 2019
The null choice. A social engineering example in the wild
02 Jul 2019
Ninja Turtles in your network: LAN Turtle 3G. A how-to for red teaming
01 Jul 2019
Don’t ‘Roley’ your own encryption, says Bob the Builder
28 Jun 2019
The not so ultra lock
27 Jun 2019
F5 Networks Endpoint Inspector – Browser-to-RCE?
26 Jun 2019
Double-Free RCE in VLC. A honggfuzz how-to
21 Jun 2019
Why we shouldn’t use sequential booking references
19 Jun 2019
Ewon Flexy IoT Router. A Deep dive
18 Jun 2019
Sharing the Secrets: Pwning an industrial IoT router
18 Jun 2019
Covert Keylogging: Sniping your Typing
13 Jun 2019
Bloodhound walkthrough. A Tool for Many Tradecrafts
07 Jun 2019
Don’t get burnt on pay day. How to buy IoT gadgets sensibly
31 May 2019
Securing your red team kit with Uncomplicated Firewall
29 May 2019
Pwning the Nokelock API
24 May 2019
Tesla Killer: The Fuzzed and the Furious
16 May 2019
FUD 101: How not to report healthcare cybersecurity issues
15 May 2019
eyeDisk. Hacking the unhackable. Again
09 May 2019
Pwning WordPress GraphQL
08 May 2019
How To Do Firmware Analysis. Tools, Tips, and Tricks
03 May 2019
UK Government gets serious about consumer IoT security. Legislation on the way
01 May 2019
Tic Toc Pwned
15 Apr 2019
Cobalt Strike. Walkthrough for Red Teamers
15 Apr 2019
Hacking Superyachts. Advice for integrators
01 Apr 2019
Hacking Superyachts. Advice for captains
01 Apr 2019
Hacking Superyachts. Advice for owners
01 Apr 2019
Business banking fraud. Keep your eggs in TWO baskets. Here’s why…
26 Mar 2019
Remote command injection through an endpoint security product
21 Mar 2019
Connected camera cock up
20 Mar 2019
Walkthrough. Investigating an SSD
15 Mar 2019
Gone in six seconds? Exploiting car alarms
08 Mar 2019
Hacking ski helmet audio
04 Mar 2019
Cisco RV130 – It’s 2019, but yet: strcpy
28 Feb 2019
Different ‘smart’ lock, similar security issues
18 Feb 2019
Sinking a ship and hiding the evidence
18 Feb 2019
Oracle MAF store bypass, a how-to
15 Feb 2019
Vulnerability disclosure buzzword bingo!
14 Feb 2019
BBC Inside Out. Consumer advice for the ‘smart’ homeowner
11 Feb 2019
Burp HMAC header extensions, a how-to
07 Feb 2019
Super-systemic IoT flaws
05 Feb 2019
Hacking floating hotels. Cruise ship compromise on the high seas
30 Jan 2019
GPS watch issues… AGAIN
29 Jan 2019
IoT: OFF by default
11 Jan 2019
Shipping operators, what you need to know about phishing and CEO fraud
08 Jan 2019
Hacking the Echo echo echo
02 Jan 2019
Hackers in Hot Water. Pwning smart hot tubs, yes really
22 Dec 2018
Satellite communications equipment security
13 Dec 2018
Worried about Spouseware?
05 Dec 2018
BBC: MiSafes’ child-tracking smartwatches are ‘easy to hack’
26 Nov 2018
ITV: New rules to prevent children’s ‘smart’ toys from being hacked
26 Nov 2018
Advice on buying ‘smart’ gadgets for Christmas
21 Nov 2018
Consumer Advice: Kids GPS tracker watch security
15 Nov 2018
Tracking and snooping on a million kids
15 Nov 2018
Flogging a dead smart horse
09 Nov 2018
No need for lock picking tools
02 Nov 2018
Ghost hardware. Device No.1, the Ghost Pro
31 Oct 2018
Ghost hardware. Device No.3, the Ghost Rover
31 Oct 2018
Ghost hardware. Device No.2, the Boo Buddy
31 Oct 2018
Hacking ghost hunters
30 Oct 2018
Cisco device config dumping
26 Oct 2018
Time Travel Debugging: finding Windows GDI flaws
10 Oct 2018
‘Secure by Design’ & SB-327. Standards for a secure IoT?
09 Oct 2018
Smart male chastity lock cock-up – plot thickening
09 Oct 2018
Which? Magazine recommends vulnerable smart home camera
08 Oct 2018
Running a security awareness program
01 Oct 2018
Speaking at TEDx
28 Sep 2018
Container theft, the legal system and poor maritime security
21 Sep 2018
Hacking AIS
18 Sep 2018
Hacking an assault tank… A Nerf one
13 Sep 2018
Automotive theft affects shipping security
07 Sep 2018
Smart Locks: Dumb Security
31 Aug 2018
Smart Lock Security: Interview with hardware.io
30 Aug 2018
PTP, IoT & the Norwegian Government
15 Aug 2018
Hacking the Bitfi Part 5: MITM transactions
14 Aug 2018
Bitfi research receives Pwnie Award for ‘lamest vendor response’
09 Aug 2018
Tamper proofing review: the iZettle card payment terminal
08 Aug 2018
Copycat Kali, with mykali for Kali Linux
07 Aug 2018
Hacking the Bitfi Part 3: The device with no storage
03 Aug 2018
COSCO incident. Phishing frenzy and exploding goods?
03 Aug 2018
Hacking the Bitfi. Part 2: John McAfee’s video
02 Aug 2018
Hacking the Bitfi. Part 1
31 Jul 2018
“Unhackable” Bitfi crypto wallet. What’s all the fuss about?
30 Jul 2018
Security Alarm Round-up
30 Jul 2018
FLIR FX / Lorex video stream hijack: Disclosure train wreck
26 Jul 2018
Hacking Swann & FLIR/Lorex home security camera video
26 Jul 2018
Bluetooth vuln CVE-2018-5383 explained
24 Jul 2018
EU Cybersecurity Act IoT FAIL
19 Jul 2018
Data exfiltration techniques
11 Jul 2018
Breaking up is hard to do… with IoT
06 Jul 2018
Hacking Navtex maritime warning messages
03 Jul 2018
Hacking Serial Networks on Ships
25 Jun 2018
Hardware reverse engineering. A tale from the workbench
22 Jun 2018
Windows Server settings. Administrative Templates – Network Items. A security how-to
21 Jun 2018
Totally Pwning the Tapplock (the API way)
15 Jun 2018
Totally Pwning the Tapplock Smart Lock
13 Jun 2018
Hacking, tracking, stealing and sinking ships
04 Jun 2018
So, you just caused a data breach, by CCing the wrong person in an email…
01 Jun 2018
Z-Shave. Exploiting Z-Wave downgrade attacks
23 May 2018
Penetration Testing Requirements for GDPR
18 May 2018
Hijacking Philips Hue
16 May 2018
Stealing container ship cargo through LOC messaging
15 May 2018
What can maritime insurers learn from cyber liability insurers?
10 May 2018
Hacking train passenger Wi-Fi
08 May 2018
Man Climbs Severn Bridge. Your office is twice as easy and half as scary
03 May 2018
‘Hacking’ the Nespresso Prodigio and Jura E8 coffee machines
17 Apr 2018
Soldering for Reverse Engineering. Swapping out eSIMs with “normal” SIMs
13 Apr 2018
Accidentally “hacking” Red Hat
08 Apr 2018
A day in the life of Open Banking
06 Apr 2018
From PNG tEXt to Persistent XSS
06 Apr 2018
Maersk wasn’t hacked
03 Apr 2018
Crashing ships by hacking NMEA sentences
26 Mar 2018
PTP and Microsoft to brief EU Parliament
19 Mar 2018
Abusing Duo 2FA
16 Mar 2018
Tactical Advice for Maritime Cyber Security – Top 10
12 Mar 2018
If you aren’t soldering, you probably aren’t testing IoT thoroughly
08 Mar 2018
Docker for Hackers? A pen tester’s guide
08 Mar 2018
WHY is consumer IoT insecure?
07 Mar 2018
Security by Design. UK Gov’s first stab at IoT consumer protection isn’t good enough
07 Mar 2018
Hijacking & rick rolling a smart guitar amp
26 Feb 2018
Reverse Engineering BLE from Android apps with Frida
23 Feb 2018
IoT vulns are unexploitable by the masses. Wrong
21 Feb 2018
Xiong Mai DVR Revisited
19 Feb 2018
Hacking / ruining the Samsung Smart Fridge
14 Feb 2018
Hacking maritime blockchains
12 Feb 2018
A smart sex toy that pings your employer?
12 Feb 2018
Reverse engineering microcontrollers WITHOUT a datasheet
09 Feb 2018
Want entropy? Don’t use a floating ADC input
06 Feb 2018
Runtastic deserves more ‘heat’ than Strava!
02 Feb 2018
Blockchain. Changing the attackers aim
26 Jan 2018
NoT: Taking the ‘internet’ out of IoT
25 Jan 2018
VTech strikes again
18 Jan 2018
Building half a ‘Proxmark’ for $10
18 Jan 2018
Hacking maritime IFTFCC messaging for invoice fraud
09 Jan 2018
NRF51822 code readout protection bypass- a how-to
05 Jan 2018
Tracking & hacking ships with Shodan & AIS
03 Jan 2018
Top 10 things to improve OT security
03 Jan 2018
The most common IoT device security failings of 2017
02 Jan 2018
Sinking bulk carrier ships by hacking HSMS
13 Dec 2017
Too cold to work? School closed? Sure your BMS hasn’t been hacked?
11 Dec 2017
Hacking a talking toy parrot
01 Dec 2017
This week’s IoT security news
27 Nov 2017
Practical security advice for keyless cars
27 Nov 2017
Hacking your office through your screen caster
24 Nov 2017
Destroy kids GPS watches says German Federal Network Agency
17 Nov 2017
IoT vendors. Avoid recalls, choose a secure chip
17 Nov 2017
Making prawn espressos, or hacking ships by deciphering BAPLIE EDIFACT messaging
17 Nov 2017
Sinking container ships by hacking load plan software
16 Nov 2017
Exfiltration by encoding data in pixel colour values
08 Nov 2017
How to crack private APN keys with hashcat
31 Oct 2017
Hacking IoT vendors & smart cars via private APNs
23 Oct 2017
Compromising unencrypted butt plug comms
18 Oct 2017
OSINT from ship satcoms
13 Oct 2017
Girl on a train. The snooping girl on a train: The Sequel
12 Oct 2017
Maritime OT networks. A Primer
10 Oct 2017
The art of finding JTAG on PCBs
04 Oct 2017
Screwdriving. Locating and exploiting smart adult toys
29 Sep 2017
Dumping CC2540 Firmware. An IoT how-to
18 Sep 2017
Social engineering in the (festival) field
05 Sep 2017
Tearing down the Star Wars Battle Drone toy from Propel
01 Sep 2017
Bypass Windows auth & BitLocker with forgotten password function
25 Aug 2017
IoT: Convenience vs. Privacy. Where do you draw the line?
24 Aug 2017
Blockchain Implementation Security. A hardening how-to
22 Aug 2017
Brick or Bot? Solving OTA update issues
16 Aug 2017
Analysis: Draft US Senate IoT security bill
10 Aug 2017
“Alexa, use IoT to kill the power grid”
07 Aug 2017
Which IoT product should I buy?
01 Aug 2017
Update your PLC firmware. A reminder
25 Jul 2017
Adult IoT toys. Privacy invasion or worse?
24 Jul 2017
IoT security testing methodologies
20 Jul 2017
Project Dumb2Smart. How to build a secure IoT device. Part One: Dumb
18 Jul 2017
Could ‘Right to Repair’ heighten the risk for IoT and smart devices?
12 Jul 2017
UnBrickerBot? XiongMai fix Mirai DVR security issues… and fail
03 Jul 2017
Obfuscating consumer IoT hardware. Is it worth it?
29 Jun 2017
Petya/NotPetya. What you need to know
28 Jun 2017
Cyber Mum Vs Cyber Daughter
28 Jun 2017
Home Wi-Fi routers. Is yours secure?
23 Jun 2017
What did Mirai Miss? Making a better, bigger botnet
06 Jun 2017
Hacking wireless house alarms
05 Jun 2017
IN THE NEWS: BBC Click. The IoT at Dover Castle
24 May 2017
IN THE NEWS: Samsung’s S8 Iris and biometric revocation
24 May 2017
What I learned about managing worm outbreaks… 14 years ago
16 May 2017
WannaCry ransomware. It’s not all bad news
15 May 2017
How to reverse engineer MSWord malware
08 May 2017
Responsible disclosure didn’t work? How to get an IoT vendor to take notice
05 May 2017
Faster EEPROM firmware reads? Use a Pi!
04 May 2017
Girl on a train. The snooping girl on a train
28 Apr 2017
Hacking tractors is a thing. Is it the start of something else for connected cars?
26 Apr 2017
Decoding React Native creds on Android
21 Apr 2017
Keep your IoT schematics private
19 Apr 2017
IoT Aga. Cast iron Security Flaw
12 Apr 2017
Vulnerable Wi-Fi dildo camera endoscope. Yes really
03 Apr 2017
Nifty XSS in Annke SP1 HD wireless camera
23 Mar 2017
Jurassic Poke: Hacking a Dino toy
16 Mar 2017
In The News. DW TV. Driverless/connected car security
14 Mar 2017
LAN surfing. How to use JavaScript to Execute Arbitrary Code on Routers
13 Mar 2017
Weeping Angel / Fake OFF for Android TV
08 Mar 2017
Weeping Angel. Old News?
08 Mar 2017
No Genesis Toys, My Friend Cayla can be hacked even if you do follow the instructions!
06 Mar 2017
You can have your cookie and eat it!
03 Mar 2017
CloudPets data breach
28 Feb 2017
Pathway to driverless cars. UK law and liability.
27 Feb 2017
PTP brief UK Government on Cyber Security and call for IoT legislation
23 Feb 2017
MyFriendCayla banned. Are all listening Bluetooth devices set for the bin?
21 Feb 2017
Our Friend Cayla: No Longer Welcome in Germany!
17 Feb 2017
Help users spot phishing. Tag fake “internal” emails for them
16 Feb 2017
Screw Cayla: Use Chromecast for rogue Amazon Echo voice control!
14 Feb 2017
Secure all the things with other things via the Blockchain!
10 Feb 2017
End of the line, Internet of Things
02 Feb 2017
How to avoid blowing your privacy online
25 Jan 2017
Leaked DVR creds added to the IoT Fail list
11 Jan 2017
Who wants a hairbrush that’s connected to the internet?
06 Jan 2017
Edimax Wi-Fi Extender can disclose your WPA key
06 Jan 2017
Christmas lights. Festive security issues?
05 Jan 2017
BMW integrates Alexa / Echo. Did I read that right?!
16 Dec 2016
Just in time for Christmas- the Cayla reminder
16 Dec 2016
TalkTalk router hack. Consumers, what should you do?
07 Dec 2016
IoT Encryption: The challenge of missing entropy
07 Dec 2016
My Friend Cayla wakes up and smells the lawsuits
06 Dec 2016
TalkTalk and other ISPs need to replace customer routers urgently
03 Dec 2016
TR-064 worm. It’s not Mirai and the outages are interesting
02 Dec 2016
Password stuffing: How to avoid breaches from password re-use
30 Nov 2016
Can Linux really be owned by holding the Enter key?
16 Nov 2016
Netgear EX7000 Wi-Fi Range Extender. Minor XSS and Poor Password Handling
15 Nov 2016
Filling in gaps in Mirai. It’s about DVRs, not cameras
11 Nov 2016
Can’t get data onto that machine? Download a tunnel client over DNS
10 Nov 2016
The Wi-Fi enabled LG air conditioner
08 Nov 2016
Scripting Metasploit to exploit a group of hosts. A how-to.
04 Nov 2016
What is Mirai? The malware explained
03 Nov 2016
Too little, too late. IoT vendors wake up and smell the coffee. …and the lawsuits
27 Oct 2016
Smart Fridge. Dumb idea?
21 Oct 2016
A “Neet” CSRF to Reverse Shell in Wi-Fi music streamer
13 Oct 2016
Optimising Mirai: A better IoT DDoS botnet?
06 Oct 2016
Yet another vulnerability in the Smarter Wi-Fi Kettle
06 Oct 2016
IoT DDoS – we haven’t seen the half of it yet. Nor have utilities…
27 Sep 2016
ASUS RT-AC66U router. A couple of bug fixes
27 Sep 2016
Attacking Android through custom updates
20 Sep 2016
BT Wi-Fi Extender. Multiple security issues. Upgrade ASAP
19 Sep 2016
Argos MyTablet FUBAR
09 Sep 2016
CSRFing Facebook games
07 Sep 2016
All your video are belong to us part 3. The D-Link 932L webcam
05 Sep 2016
Sandbox vuln in Tales of Maj’Eyal
05 Sep 2016
How to abuse SSH keys
31 Aug 2016
Stupidly insecure electronic / RFID door lock
19 Aug 2016
wigle.net suppresses Mitsubishi Outlander Wi-Fi hits
11 Aug 2016
Samsung’s smart camera. A tale of IoT & network security
11 Aug 2016
Thermostat Ransomware: a lesson in IoT security
08 Aug 2016
Smarter Coffee machines still being found unconfigured
19 Jul 2016
XSS in SAP BI Documents
12 Jul 2016
Home security camera isn’t secure. SpotCam in the spotlight
07 Jul 2016
Symantec endpoint protection. Update now!
06 Jul 2016
Alarm systems alarmingly insecure. Oh the irony
29 Jun 2016
All your video are belong to us part 2. The TP Link TL-SC3230’s CSRF
27 Jun 2016
All your video are belong to us. The Foscam webcam
21 Jun 2016
Hacking the Mitsubishi Outlander. Working out the protocol
14 Jun 2016
Consumer IoT security is often terrible, but it doesn’t have to be…
14 Jun 2016
Hacking the Mitsubishi Outlander PHEV hybrid
05 Jun 2016
Moodle e-Learning platform vulnerability
01 Jun 2016
Snooping Sony Bravia TV
20 May 2016
How I can gain control of your TP-LINK home switch
20 May 2016
An interesting route to domain admin- iSCSI
18 May 2016
Discrimination by telematics?
09 May 2016
RATing through the Steam Workshop
28 Apr 2016
Advice for IoT device manufacturers
22 Apr 2016
Snooping where the sun doesn’t shine
22 Apr 2016
BBC Panorama. How we hacked the house
16 Apr 2016
How-to subvert Android backups to export sandboxed app files
14 Apr 2016
XSS in SAP Business Intelligence Documents
12 Apr 2016
Mobile App Tips. Dealing with iOS and device requirements
10 Apr 2016
DOM XSS in iThemes Security Pro
05 Apr 2016
How a Pentester books a Squash court
31 Mar 2016
Another (un)smart Smarter app
24 Mar 2016
How we made the listening-in Android app
23 Mar 2016
How to defend against Pass-the-Hash (PtH) attacks
21 Mar 2016
DIY: How to build your own host-based IDS (HIDS) using OSSEC
16 Mar 2016
Apps and Après. Skiing and privacy
15 Mar 2016
New Chromecast & Chromecast Audio. Have they fixed their hijacking issue?
11 Mar 2016
BLN’s IoT Forum. What went down
10 Mar 2016
Are your phones listening to you?
02 Mar 2016
How to exploit XSS with CSRF
26 Feb 2016
glibc stack-based buffer overflow. What you need to know: UPDATE
24 Feb 2016
Pwning CCTV cameras: Update
23 Feb 2016
glibc stack-based buffer overflow. What you need to know
22 Feb 2016
PowerShell and VBScript: Getting full DB access via restricted desktop apps
18 Feb 2016
Cisco ASA Remote Code Execution – Buffer Overflow in IKE code
16 Feb 2016
When VTech meets the GDPR
11 Feb 2016
Pwning CCTV cameras
10 Feb 2016
How to reverse Wyse terminal password crypto: Method Two
10 Feb 2016
How to reverse Wyse terminal password crypto: Method One
09 Feb 2016
Just how secure is the average home Wi-Fi router?
08 Feb 2016
Why I think that U.S. house is hounded by phone trackers
25 Jan 2016
After the BBC contacted us for comment on this story I thought it’d be useful and interesting to share the details that were omitted, as well as the reasoning behind some of my assumptions (none of which involve the Bermuda triangle BTW).
Reading Atmel AVR MCUs
23 Jan 2016
Who is tracking your run? Run and bike activity tracking app privacy issues investigated
22 Jan 2016
Steal your Wi-Fi key from your doorbell? IoT WTF! UPDATE
12 Jan 2016
Steal your Wi-Fi key from your doorbell? IoT WTF!
08 Jan 2016
Star Wars BB-8 IoT toy: awesome fun, but can it be turned to the Dark Side with this vulnerability?
06 Jan 2016
Wi-Fi HaLow 802.11ah for IoT. 802.11uh-oh?
05 Jan 2016
OWASP Birmingham IoT Hackathon
17 Dec 2015
Why buying a smart toy for a child might be the craziest thing you could do
10 Dec 2015
Vtech Innotab Max file extraction: Finding the Superblock
07 Dec 2015
VTech Innotab Max: it’s getting even worse! Apps run in debug mode
03 Dec 2015
VTech Innotab Max vulnerable to trivial data extraction
02 Dec 2015
Collateral Damage: Top 5 Reasons You Should be Scared of Your Customers
26 Nov 2015
New Furby Teardown
24 Nov 2015
New, easier ways to make My Friend Cayla swear
20 Nov 2015
The IoT: Innovation or Exploitation?
18 Nov 2015
Yet another Lovense smart vibrator flaw
17 Nov 2015
Hacking a Wi-Fi Coffee Machine – Part 1
16 Nov 2015
Some simple security advice for computer and smartphone users
13 Nov 2015
What if your fridge said “no”? What if indeed?
11 Nov 2015
Concerned about KeeFarce? Don’t be. Why you should still use a password vault
09 Nov 2015
The TalkTalk breach, Ken Munro will be on the BBC later…
23 Oct 2015
New Wi-Fi kettle, same old security issues? Meh.
15 Oct 2015
Tonight’s CSI Cyber: implausible Marla talking doll hack. Fiction stranger than truth for once
06 Oct 2015
Hacking the Aldi IP CCTV Camera (part 2)
02 Oct 2015
Microsoft, phishing emails, and lessons to learn
25 Sep 2015
Should I enable encryption my Android handset?
23 Sep 2015
How to get Windows to give you credentials through LLMNR
22 Sep 2015
Android Lock Screen Bypass
16 Sep 2015
CESG and CPNI put passwords back in the spotlight. Have they got it right?
16 Sep 2015
44CON London: Our IoT Security Workshop
11 Sep 2015
Tweaking nmap for hostile networks. A How-to
09 Sep 2015
Pen Test Partners IoT workshop at 44CON London
07 Sep 2015
How do you know that you aren’t compromised?
28 Aug 2015
Grab the UI lock password from McAfee A/V, kill the service, send in the malware
26 Aug 2015
How to extract sensitive plaintext data from Android memory
19 Aug 2015
Hacking DefCon 23’s IoT Village Samsung fridge
18 Aug 2015
AirDrop and Cyber Flashing, what’s the deal?
13 Aug 2015
Inside the spy tank; a hardware review.
11 Aug 2015
Denial-of-Service bug in BIND
04 Aug 2015
How to create poisoned Office documents for your staff awareness training – part 2
30 Jul 2015
Going to DefCon 23? Come to our IoT Village workshop!
29 Jul 2015
How to create poisoned Office documents for your staff awareness training – part 1
28 Jul 2015
How to hack an app enabled device to make it truly internet enabled
17 Jul 2015
Android debug mode and apps. A cautionary tale
15 Jul 2015
Hydra the logon cracker, a brute-forcing how-to user guide
13 Jul 2015
Basic safety tips for mobile devices
08 Jul 2015
The tiniest PHP system shell ever?
07 Jul 2015
Oracle wants you to run vulnerable Java to remove vulnerable versions of Java
03 Jul 2015
Finding wireless kettles with social networks
01 Jul 2015
Abusing software updates. GoPro Studio desktop app: Samsung keyboard app-style fail
29 Jun 2015
Shiva, the spam honeypot. Tips and tricks for getting it up and running.
26 Jun 2015
Yet another attack against the iKettle wireless kettle. Rumpy pumpy and fire alarms?
23 Jun 2015
My Friend Cayla. Updated app; Updated security fails. How to make her swear (again!)
22 Jun 2015
Encrypting the database has done virtually nothing to secure the doll and app.
Change your password to smiling, winking, pensive, sleepy….
17 Jun 2015
Or not. Why I think emoji PINs are mostly pointless.
Common coding fails when writing Android mobile apps
17 Jun 2015
It’s amazing how many simple issues create significant security holes.
Why you’re better off buying expensive smart scales
15 Jun 2015
CVSSv3. What’s changed? …or why even bother?
12 Jun 2015
Extracting your WPA PSK from bathroom scales
08 Jun 2015
Hacking kettles & extracting plain text WPA PSKs. Yes really!
08 Jun 2015
Infosecurity Europe 2015 round up
05 Jun 2015
GoPro Wi-Fi issues could mean stolen video, or worse…
01 Jun 2015
Short mobile PINs ARE bad, but I hate vendor FUD more!
29 May 2015
Cyber liability insurance. Will your underwriter wriggle out of the claim?
28 May 2015
Thought you had seen FUD? Now see this: a rock can protect your computer from viruses
22 May 2015
Why I hate named vulnerabilities
22 May 2015
Ethical disclosure and the Internet of Things
20 May 2015
Why you need to make your passwords more complex
13 May 2015
Zero-code platforms? More like zero-clue platforms
07 May 2015
Honeypots; a usage guide
05 May 2015
Ryanair. A timely reminder why Europeans need First Party Cyber Liability Insurance
01 May 2015
How to read from an EEPROM
27 Apr 2015
MS15-034. What you need to know
16 Apr 2015
Hacking the IP camera (part 1)
10 Apr 2015
Move over SHA-1, SHA-2 is coming. Here’s the why and the how
09 Apr 2015
Protecting yourself from your customers
31 Mar 2015
DIY dual boot Nexus tablet; make your own mobile test rig with NetHunter
24 Mar 2015
EAP-TLS: Where Mac security is worse than Windows
19 Mar 2015
Messing around with dildos. How to drive a vibrator with RealTerm
13 Mar 2015
Apple watch. A must-have or another personal security nightmare?
11 Mar 2015
Samsung TV voice encryption UPDATE: Fixed, but not quite…
06 Mar 2015
The lowdown on the SKIP-TLS and FREAK flaws UPDATE
06 Mar 2015
The lowdown on the SKIP-TLS and FREAK flaws
05 Mar 2015
Biometric revocation not an option
04 Mar 2015
Speech recognition mobile assistants, the lowdown starts here
02 Mar 2015
Is your Samsung TV listening to you? – UPDATE
27 Feb 2015
The Right Way To Do Session Management
25 Feb 2015
Fight! Fight! Hello Barbie vs My Friend Cayla
18 Feb 2015
Is your Samsung TV listening to you?
16 Feb 2015
Exploiting SUID Executables
09 Feb 2015
Cracking Android passwords, a how-to
02 Feb 2015
Making children’s toys swear
23 Jan 2015
RC4 cipher considered harmful?
22 Jan 2015
How to test wireless systems: A step-by-step guide (part 2)
20 Jan 2015
Are your smart weighing scales lying to you? Quite possibly (part 2)
09 Jan 2015
Are your smart weighing scales lying to you? Quite possibly (part 1)
06 Jan 2015
How to test wireless systems: A step-by-step guide
05 Jan 2015
Visual Basic for Applications and the dangers of allowing Office macros
30 Dec 2014
Pwning git: A Proof of Concept (PoC)
24 Dec 2014
The internet of toys, and why we’re holding back this Xmas
23 Dec 2014
Git client – time to patch!
19 Dec 2014
Google’s No CAPTCHA reCAPTCHA, what we think
15 Dec 2014
Data tethering on mobile devices – what are the risks?
09 Dec 2014
Hacking Oracle Reporter- A how-to
02 Dec 2014
Bring Your Own Device or Bring Your Own Security Disaster? Some simple MDM policy advice
29 Nov 2014
Protocol vs Implementation. Why MS14-066 and SChannel got my goat
12 Nov 2014
Patch management, it’s sexy, here’s why
11 Nov 2014
App creep: Facebook security issues
10 Nov 2014
The spoofed number phone call scam
03 Nov 2014
Using nfsshell to compromise older environments
24 Oct 2014
Tearing down and reverse engineering Android (toys)
23 Oct 2014
Using hexdump analysis for firmware extraction: A how-to
20 Oct 2014
Efficient Password Cracking Where LM Hashes Exist for Some Users
17 Oct 2014
Critical SQL Injection Vulnerability in Drupal 7.0-7.31
16 Oct 2014
POODLE SSLv3 Redux: How to fix it
15 Oct 2014
Further Rockchip Android brokenness
13 Oct 2014
BBC article: Prevent devices being remotely wiped, here’s how to do it properly
10 Oct 2014
First Hudl2 Teardown?
08 Oct 2014
Using Applocker to protect your users from themselves, and you from your users
06 Oct 2014
Shell Shock: What it is, and what you can do
25 Sep 2014
Who watches the watchmen? A social engineer’s cautionary tale of spy watches
24 Sep 2014
Nmap for Sysadmins
22 Sep 2014
Socat-fu lesson
19 Sep 2014
Second hand budget Android tablets spark privacy and online safety concerns
17 Sep 2014
Is a remote wipe any better than a factory reset on an Android device?
16 Sep 2014
Recovering data from ‘wiped’ Android devices: A How To Guide
15 Sep 2014
More on tuning John the Ripper
15 Sep 2014
Custom charsets and rules with John The Ripper and oclhashcat
10 Sep 2014
Today’s BBC Article: Securing your nudie selfies
02 Sep 2014
Aldi Lifetab also vulnerable to data recovery from memory
28 Aug 2014
BBC Article: Tracking smartphones using Wi-Fi emissions
26 Aug 2014
New Rockchip firmware being released, but who is going to flash my grandma’s tablet?
22 Aug 2014
Top 10 ways to compromise your mobile security that you’d never believe
20 Aug 2014
Tesco Hudl 2 – our wish list
18 Aug 2014
Top 10 stupidest ways we’ve got domain admin
13 Aug 2014
Yes, really. A car review on a pen test blog. It’s topical, honest!
07 Aug 2014
Advanced traffic interception for mobile apps using Mallory and Burp
06 Aug 2014
Adobe, eBay and other breaches. Should you change your password? Yes, but only if it’s a lousy password
05 Aug 2014
Further IBM Maximo Asset Management Vulnerabilities Reported
31 Jul 2014
Work on our honeynet continues apace
30 Jul 2014
Shiny New Pen Test Report! So What…
29 Jul 2014
Don’t use PIN Patterns on Android
25 Jul 2014
ICO makes a mockery of disclosure
23 Jul 2014
Sketchy BIS Report Data, FUD, and Why You Need Cyber Liability Insurance
11 Jul 2014
PTP Code Respository
07 Jul 2014
Auditing AWS Security Groups – Part 2
07 Jul 2014
Hacking Sat Navs
04 Jul 2014
Unicode – the future of passwords? Possibly…
03 Jul 2014
Auditing AWS Security Groups
02 Jul 2014
Key Sniffing with Android
20 Jun 2014
Postal Services Breached, customers urged to change house numbers urgently
18 Jun 2014
Is everything actually broken? Software will always be flawed, but here’s what you can do about it
17 Jun 2014
One-way password hashing is essential, but it’s even better if you select the right algorithm
12 Jun 2014
Old pre-smartphones from eBay – Blackmail Central!
10 Jun 2014
Breaking Out of Citrix and other Restricted Desktop Environments
06 Jun 2014
How to scrape plain text from an encrypted Android phone OR why most MDM products just don’t cut it
04 Jun 2014
CorrectHorseBatteryStaple isn’t a good password. Here’s why.
29 May 2014
How to hardware hack Android over UART
29 May 2014
BMW i3 password issues
28 May 2014
The truth behind vulnerabilities, a missive from the trenches
23 May 2014
How to Hack the Hudl – We give Rockchip a good seeing to
22 May 2014
Defeating corporate anti-virus
20 May 2014
Quick and dirty binary analysis using sandboxes
14 May 2014
Shameless self promotion – Pen Test Partners at Infosecurity Europe 2014
30 Apr 2014
SayNoTo0870.com SayYesToCreditCardFraud.co.uk..?
25 Apr 2014
Keep your Android versions updated. Why? If you have to ask…
24 Apr 2014
Wildcard SSL certificates, not good value any more, my Heartbleeds
15 Apr 2014
Security vs the community: you’re doing it right!
14 Apr 2014
Heartbleed in the wild, the call of duty
14 Apr 2014
New Zeus variant may get lost in the clamour of Heartbleed
11 Apr 2014
WTF Heartbleed? Don’t make me move all my HTTPS services to HTTP and ditch SSL completely
09 Apr 2014
Heartbleed OpenSSL bug- overview and fixes
08 Apr 2014
WAF (Web Application Firewall) Testing for dummies
08 Apr 2014
Why you might want to rethink providing free wi-fi
07 Apr 2014
Top Tips For Internet Privacy
04 Apr 2014
Scanning for Default Files
01 Apr 2014
Honey traps, a lesson in espionage, and managing your ego
25 Mar 2014
Create a honeynet, dupe your attackers, build threat intelligence
24 Mar 2014
Hacking Computer Games
20 Mar 2014
Connected cars, signals systems, mischief and European drivers. These scare me.
14 Mar 2014
8 ways to be great at password management, and protect your customers
13 Mar 2014
Really? A notebook to write down your passwords in, sold by Amazon?
10 Mar 2014
Passwords: A step-by-step analysis of breaking them
06 Mar 2014
Need to avoid a honeypot? Here’s how
05 Mar 2014
Webcam Security: I can SEE you!
04 Mar 2014
Keylogging domain creds; who needs a hash? Lock the victim’s workstation to order and snarf them immediately
03 Mar 2014
Threat Intelligence: Log File Hacking
26 Feb 2014
Password re-use: the game is changing, SO USE A PASSWORD VAULT!
21 Feb 2014
Can you really wipe a mobile device remotely?
20 Feb 2014
DIY – Build Your Own “Pwn Pad” Style Nexus 7 Hack Box
19 Feb 2014
Analysis of reported Tesco account and password data
14 Feb 2014
How can I be tracked using my mobile devices? Here’s how…
13 Feb 2014
It’s Safer Internet Day and we’ve got six tips to help you stay out of trouble
11 Feb 2014
Cyber liability insurance, you need it, and here’s why…
11 Feb 2014
Hacker High School
06 Feb 2014
There are “pen tests” and then there are “PEN TESTS”…
28 Jan 2014
Encryption and cloud based storage
27 Jan 2014
Passwords, passwords, passwords (repeat)
24 Jan 2014
Belt AND Braces: Web apps and mod_security
22 Jan 2014
Data Exfiltration: DNS tunnelling using iodine
20 Jan 2014
Test early, test often: 6 things you should know about application security testing
17 Jan 2014
IBM Maximo Asset Management Vulnerability Reported
16 Jan 2014
Abusing Group Policy Preferences to Elevate Privileges
06 Jan 2014
Web application Unicode character transforms
03 Jan 2014
NSA – Never Safe Again?
02 Jan 2014
Hackey Phishmas!
16 Dec 2013
Cyber security kite mark being touted, but for what exactly? People? Passwords? Patches?
12 Dec 2013
iOS phone users still vulnerable to old PIN bypass vulnerabilities: Lesson – Update your stuff
09 Dec 2013
Transferring Data the Low Tech Way
04 Dec 2013
What we can learn from Meerkats?
03 Dec 2013
The Coming Revolution: Hardware attacks and the internet of things
26 Nov 2013
Brute Forcing Android PINs (or why you should never enable ADB part 2)
25 Nov 2013
Brute Forcing Android PINs (or why you should never enable ADB part 1)
14 Nov 2013
How to get into Information Security
13 Nov 2013
Backwards phishing with Unicode – edocinU htiw gnihsihp sdrawkcaB
07 Nov 2013
Is that a bug in your pocket or are you just happy to see me?
05 Nov 2013
How to remove IIS server response header banners
29 Oct 2013
Get your Macs back on track- Apple security for Windows experts
28 Oct 2013
The Salmon Fishing Bear Attack OR Grabbing password hashes off the network via NetBIOS
24 Oct 2013
The Antwerp hackers bundle demystified
23 Oct 2013
Pen Test Partners review online banking security for Which? Magazine
21 Oct 2013
Clickjacking explained, in detail
17 Oct 2013
Patch Tuesday 08/10/2013- notable items
09 Oct 2013
DRM – The conundrum for protecting intellectual property
09 Oct 2013
Duplicate Passwords: Why IT Support Needs a Wake Up Call
08 Oct 2013
Git Extraction – Abusing version control systems
04 Oct 2013
Simple steps to stop Social Engineers
01 Oct 2013
How to reverse engineer a protocol
24 Sep 2013
Browser support for TLS 1.1 and 1.2
17 Sep 2013
What to do if you find yourself being DDoSed
16 Sep 2013
Why porn is an effective malware distribution mechanism
13 Sep 2013
DefCon21 Ruminations
04 Aug 2013
Suffered a Security breach?
Mobile Security
Social Engineering
Web application testing
Security Consuting
