Blogs by
Ken Munro
The Pen Test Partners Security Blog brings you the latest news and trends in penetration testing and the internet security industry.
More about our security blog »
For the best user experience please upgrade your browser
Did security gaps at Antwerp port enable drug smuggling operations?
12 Nov 2024
Maritime lawyers assemble!
05 Nov 2024
Testing the security of CCTV systems
30 Oct 2024
Leave the World Behind, or don’t
24 Jul 2024
UK PSTI? You’ll need a Vulnerability Disclosure Program!
24 May 2024
The big play of autonomous vehicles
12 Mar 2024
Hacking Electronic Flight Bags. Airbus NAVBLUE Flysmart+ Manager
01 Feb 2024
10 years on from the Target breach. Has building cyber security improved?
24 Jan 2024
Helping a banking fraud victim
02 Jan 2024
Helping a mobile malware fraud victim
02 Jan 2024
Socks! Our cyber prediction for 2024
22 Dec 2023
Are Vehicle to Grid spikes coming?
27 Nov 2023
Scorpion CBS show. Plane hack
14 Aug 2023
Die Hard 2. Or how not to hack airplanes
14 Aug 2023
Vulnerability disclosure in aviation
09 Aug 2023
Netflix MH370: The plane that wasn’t hacked
12 May 2023
Monetising hacking by shorting commodity shipments
08 Mar 2023
Causing incidents with in-flight entertainment systems
07 Feb 2023
Consumer advice for buying smart IoT devices this Christmas
02 Dec 2022
Effecting positive change in the Internet of Things
21 Oct 2022
Airbus AoA – Angle of Attack sensor issue
03 Oct 2022
When disclosure goes wrong. People
02 Sep 2022
747 Hackathon
25 May 2022
We need to talk about sex toys and cyber security
23 May 2022
Domestic CCTV and audio recording
17 Jan 2022
Audio bugging with the Fisher Price Chatter Bluetooth Telephone
22 Dec 2021
What does the Product Security and Telecommunications Infrastructure bill mean for me?
25 Nov 2021
When the IoT vendor goes bust
28 Sep 2021
Why the Raspberry Pi isn’t suitable for IoT
01 Sep 2021
Why hackers don’t fly coach
11 Jun 2021
Deploying EFBs securely
04 Jun 2021
Smart lighting security
21 May 2021
Out of cyber class. Maritime compliance.
15 Mar 2021
Is IoT ever really yours?
08 Mar 2021
K&R insurance. Kidnap and Ransom(ware)
22 Feb 2021
Schneider T200 RTU vulnerabilities
07 Jan 2021
A Vulnerability Disclosure Program is not just a page on a web site
26 Aug 2020
A cyber warning light. The canary in the mine
11 Jun 2020
In Flight Entertainment System Security
27 May 2020
Ethical dilemmas with responsible disclosure
22 May 2020
Speaking at security events
04 May 2020
Jeopardising aircraft through TCAS spoofing
01 May 2020
Are you cyber seaworthy?
17 Apr 2020
9 things to consider when staff work from home unexpectedly
10 Mar 2020
Ships can’t be hacked. Wrong
20 Feb 2020
Out Of Band, Out Of Sight, Out Of Mind
17 Feb 2020
ASSURE Aviation Cyber Security Testing
30 Jan 2020
Xmas Light Security Improves… a bit
10 Dec 2019
Nuclear Satcoms
04 Dec 2019
Updating Airplanes
11 Nov 2019
Schiphol hijack false alarm. An insiders view of what happened
07 Nov 2019
Objections to IoT regulation. A rational reply
24 Oct 2019
Mapping the Attack Surface of an Airport
11 Oct 2019
My environmental journey
28 Sep 2019
A security researcher has made contact. What do I do?
27 Sep 2019
IoT security. A retrospective
17 Sep 2019
A Secure “Smart” Kettle?
30 Aug 2019
PTP at DEF CON 27
05 Aug 2019
Why we shouldn’t use sequential booking references
19 Jun 2019
Tesla Killer: The Fuzzed and the Furious
16 May 2019
FUD 101: How not to report healthcare cybersecurity issues
15 May 2019
UK Government gets serious about consumer IoT security. Legislation on the way
01 May 2019
Business banking fraud. Keep your eggs in TWO baskets. Here’s why…
26 Mar 2019
Connected camera cock up
20 Mar 2019
Gone in six seconds? Exploiting car alarms
08 Mar 2019
Sinking a ship and hiding the evidence
18 Feb 2019
Vulnerability disclosure buzzword bingo!
14 Feb 2019
BBC Inside Out. Consumer advice for the ‘smart’ homeowner
11 Feb 2019
Super-systemic IoT flaws
05 Feb 2019
IoT: OFF by default
11 Jan 2019
Shipping operators, what you need to know about phishing and CEO fraud
08 Jan 2019
Hacking the Echo echo echo
02 Jan 2019
Hackers in Hot Water. Pwning smart hot tubs, yes really
22 Dec 2018
Satellite communications equipment security
13 Dec 2018
Worried about Spouseware?
05 Dec 2018
BBC: MiSafes’ child-tracking smartwatches are ‘easy to hack’
26 Nov 2018
ITV: New rules to prevent children’s ‘smart’ toys from being hacked
26 Nov 2018
Advice on buying ‘smart’ gadgets for Christmas
21 Nov 2018
Consumer Advice: Kids GPS tracker watch security
15 Nov 2018
Ghost hardware. Device No.1, the Ghost Pro
31 Oct 2018
Ghost hardware. Device No.3, the Ghost Rover
31 Oct 2018
Ghost hardware. Device No.2, the Boo Buddy
31 Oct 2018
Hacking ghost hunters
30 Oct 2018
‘Secure by Design’ & SB-327. Standards for a secure IoT?
09 Oct 2018
Which? Magazine recommends vulnerable smart home camera
08 Oct 2018
Speaking at TEDx
28 Sep 2018
Container theft, the legal system and poor maritime security
21 Sep 2018
Hacking AIS
18 Sep 2018
Automotive theft affects shipping security
07 Sep 2018
Smart Locks: Dumb Security
31 Aug 2018
PTP, IoT & the Norwegian Government
15 Aug 2018
Hacking the Bitfi Part 5: MITM transactions
14 Aug 2018
Bitfi research receives Pwnie Award for ‘lamest vendor response’
09 Aug 2018
Hacking the Bitfi Part 3: The device with no storage
03 Aug 2018
COSCO incident. Phishing frenzy and exploding goods?
03 Aug 2018
Hacking the Bitfi. Part 2: John McAfee’s video
02 Aug 2018
Hacking the Bitfi. Part 1
31 Jul 2018
“Unhackable” Bitfi crypto wallet. What’s all the fuss about?
30 Jul 2018
FLIR FX / Lorex video stream hijack: Disclosure train wreck
26 Jul 2018
EU Cybersecurity Act IoT FAIL
19 Jul 2018
Breaking up is hard to do… with IoT
06 Jul 2018
Hacking Navtex maritime warning messages
03 Jul 2018
Hacking Serial Networks on Ships
25 Jun 2018
Totally Pwning the Tapplock (the API way)
15 Jun 2018
Hacking, tracking, stealing and sinking ships
04 Jun 2018
Stealing container ship cargo through LOC messaging
15 May 2018
What can maritime insurers learn from cyber liability insurers?
10 May 2018
Hacking train passenger Wi-Fi
08 May 2018
‘Hacking’ the Nespresso Prodigio and Jura E8 coffee machines
17 Apr 2018
Maersk wasn’t hacked
03 Apr 2018
Crashing ships by hacking NMEA sentences
26 Mar 2018
PTP and Microsoft to brief EU Parliament
19 Mar 2018
Tactical Advice for Maritime Cyber Security – Top 10
12 Mar 2018
WHY is consumer IoT insecure?
07 Mar 2018
Security by Design. UK Gov’s first stab at IoT consumer protection isn’t good enough
07 Mar 2018
Hacking / ruining the Samsung Smart Fridge
14 Feb 2018
NoT: Taking the ‘internet’ out of IoT
25 Jan 2018
Hacking maritime IFTFCC messaging for invoice fraud
09 Jan 2018
Tracking & hacking ships with Shodan & AIS
03 Jan 2018
Top 10 things to improve OT security
03 Jan 2018
Sinking bulk carrier ships by hacking HSMS
13 Dec 2017
Too cold to work? School closed? Sure your BMS hasn’t been hacked?
11 Dec 2017
Hacking a talking toy parrot
01 Dec 2017
Practical security advice for keyless cars
27 Nov 2017
Destroy kids GPS watches says German Federal Network Agency
17 Nov 2017
IoT vendors. Avoid recalls, choose a secure chip
17 Nov 2017
Making prawn espressos, or hacking ships by deciphering BAPLIE EDIFACT messaging
17 Nov 2017
Sinking container ships by hacking load plan software
16 Nov 2017
How to crack private APN keys with hashcat
31 Oct 2017
Hacking IoT vendors & smart cars via private APNs
23 Oct 2017
OSINT from ship satcoms
13 Oct 2017
Maritime OT networks. A Primer
10 Oct 2017
Brick or Bot? Solving OTA update issues
16 Aug 2017
Analysis: Draft US Senate IoT security bill
10 Aug 2017
“Alexa, use IoT to kill the power grid”
07 Aug 2017
Which IoT product should I buy?
01 Aug 2017
Update your PLC firmware. A reminder
25 Jul 2017
Adult IoT toys. Privacy invasion or worse?
24 Jul 2017
Could ‘Right to Repair’ heighten the risk for IoT and smart devices?
12 Jul 2017
Obfuscating consumer IoT hardware. Is it worth it?
29 Jun 2017
Petya/NotPetya. What you need to know
28 Jun 2017
What did Mirai Miss? Making a better, bigger botnet
06 Jun 2017
IN THE NEWS: BBC Click. The IoT at Dover Castle
24 May 2017
IN THE NEWS: Samsung’s S8 Iris and biometric revocation
24 May 2017
WannaCry ransomware. It’s not all bad news
15 May 2017
Responsible disclosure didn’t work? How to get an IoT vendor to take notice
05 May 2017
IoT Aga. Cast iron Security Flaw
12 Apr 2017
In The News. DW TV. Driverless/connected car security
14 Mar 2017
Weeping Angel / Fake OFF for Android TV
08 Mar 2017
Weeping Angel. Old News?
08 Mar 2017
No Genesis Toys, My Friend Cayla can be hacked even if you do follow the instructions!
06 Mar 2017
CloudPets data breach
28 Feb 2017
PTP brief UK Government on Cyber Security and call for IoT legislation
23 Feb 2017
MyFriendCayla banned. Are all listening Bluetooth devices set for the bin?
21 Feb 2017
Leaked DVR creds added to the IoT Fail list
11 Jan 2017
Who wants a hairbrush that’s connected to the internet?
06 Jan 2017
Edimax Wi-Fi Extender can disclose your WPA key
06 Jan 2017
Christmas lights. Festive security issues?
05 Jan 2017
BMW integrates Alexa / Echo. Did I read that right?!
16 Dec 2016
Just in time for Christmas- the Cayla reminder
16 Dec 2016
TalkTalk router hack. Consumers, what should you do?
07 Dec 2016
IoT Encryption: The challenge of missing entropy
07 Dec 2016
My Friend Cayla wakes up and smells the lawsuits
06 Dec 2016
TalkTalk and other ISPs need to replace customer routers urgently
03 Dec 2016
TR-064 worm. It’s not Mirai and the outages are interesting
02 Dec 2016
Password stuffing: How to avoid breaches from password re-use
30 Nov 2016
Can Linux really be owned by holding the Enter key?
16 Nov 2016
Filling in gaps in Mirai. It’s about DVRs, not cameras
11 Nov 2016
The Wi-Fi enabled LG air conditioner
08 Nov 2016
Too little, too late. IoT vendors wake up and smell the coffee. …and the lawsuits
27 Oct 2016
Smart Fridge. Dumb idea?
21 Oct 2016
Optimising Mirai: A better IoT DDoS botnet?
06 Oct 2016
Yet another vulnerability in the Smarter Wi-Fi Kettle
06 Oct 2016
IoT DDoS – we haven’t seen the half of it yet. Nor have utilities…
27 Sep 2016
Argos MyTablet FUBAR
09 Sep 2016
Stupidly insecure electronic / RFID door lock
19 Aug 2016
wigle.net suppresses Mitsubishi Outlander Wi-Fi hits
11 Aug 2016
Hacking the Mitsubishi Outlander. Working out the protocol
14 Jun 2016
Consumer IoT security is often terrible, but it doesn’t have to be…
14 Jun 2016
Snooping Sony Bravia TV
20 May 2016
Advice for IoT device manufacturers
22 Apr 2016
BBC Panorama. How we hacked the house
16 Apr 2016
BLN’s IoT Forum. What went down
10 Mar 2016
Are your phones listening to you?
02 Mar 2016
PowerShell and VBScript: Getting full DB access via restricted desktop apps
18 Feb 2016
Cisco ASA Remote Code Execution – Buffer Overflow in IKE code
16 Feb 2016
When VTech meets the GDPR
11 Feb 2016
Steal your Wi-Fi key from your doorbell? IoT WTF! UPDATE
12 Jan 2016
Star Wars BB-8 IoT toy: awesome fun, but can it be turned to the Dark Side with this vulnerability?
06 Jan 2016
Wi-Fi HaLow 802.11ah for IoT. 802.11uh-oh?
05 Jan 2016
VTech Innotab Max vulnerable to trivial data extraction
02 Dec 2015
Collateral Damage: Top 5 Reasons You Should be Scared of Your Customers
26 Nov 2015
The IoT: Innovation or Exploitation?
18 Nov 2015
Yet another Lovense smart vibrator flaw
17 Nov 2015
Some simple security advice for computer and smartphone users
13 Nov 2015
What if your fridge said “no”? What if indeed?
11 Nov 2015
The TalkTalk breach, Ken Munro will be on the BBC later…
23 Oct 2015
New Wi-Fi kettle, same old security issues? Meh.
15 Oct 2015
Tonight’s CSI Cyber: implausible Marla talking doll hack. Fiction stranger than truth for once
06 Oct 2015
AirDrop and Cyber Flashing, what’s the deal?
13 Aug 2015
Basic safety tips for mobile devices
08 Jul 2015
Finding wireless kettles with social networks
01 Jul 2015
Yet another attack against the iKettle wireless kettle. Rumpy pumpy and fire alarms?
23 Jun 2015
Change your password to smiling, winking, pensive, sleepy….
17 Jun 2015
Or not. Why I think emoji PINs are mostly pointless.
Extracting your WPA PSK from bathroom scales
08 Jun 2015
Hacking kettles & extracting plain text WPA PSKs. Yes really!
08 Jun 2015
GoPro Wi-Fi issues could mean stolen video, or worse…
01 Jun 2015
Short mobile PINs ARE bad, but I hate vendor FUD more!
29 May 2015
Cyber liability insurance. Will your underwriter wriggle out of the claim?
28 May 2015
Thought you had seen FUD? Now see this: a rock can protect your computer from viruses
22 May 2015
Ethical disclosure and the Internet of Things
20 May 2015
Ryanair. A timely reminder why Europeans need First Party Cyber Liability Insurance
01 May 2015
Move over SHA-1, SHA-2 is coming. Here’s the why and the how
09 Apr 2015
Protecting yourself from your customers
31 Mar 2015
Is your Samsung TV listening to you? – UPDATE
27 Feb 2015
Fight! Fight! Hello Barbie vs My Friend Cayla
18 Feb 2015
Making children’s toys swear
23 Jan 2015
Visual Basic for Applications and the dangers of allowing Office macros
30 Dec 2014
Data tethering on mobile devices – what are the risks?
09 Dec 2014
Bring Your Own Device or Bring Your Own Security Disaster? Some simple MDM policy advice
29 Nov 2014
Aldi Lifetab also vulnerable to data recovery from memory
28 Aug 2014
BBC Article: Tracking smartphones using Wi-Fi emissions
26 Aug 2014
New Rockchip firmware being released, but who is going to flash my grandma’s tablet?
22 Aug 2014
Tesco Hudl 2 – our wish list
18 Aug 2014
Yes, really. A car review on a pen test blog. It’s topical, honest!
07 Aug 2014
Adobe, eBay and other breaches. Should you change your password? Yes, but only if it’s a lousy password
05 Aug 2014
Work on our honeynet continues apace
30 Jul 2014
Don’t use PIN Patterns on Android
25 Jul 2014
ICO makes a mockery of disclosure
23 Jul 2014
Sketchy BIS Report Data, FUD, and Why You Need Cyber Liability Insurance
11 Jul 2014
Postal Services Breached, customers urged to change house numbers urgently
18 Jun 2014
CorrectHorseBatteryStaple isn’t a good password. Here’s why.
29 May 2014
BMW i3 password issues
28 May 2014
Defeating corporate anti-virus
20 May 2014
Wildcard SSL certificates, not good value any more, my Heartbleeds
15 Apr 2014
WTF Heartbleed? Don’t make me move all my HTTPS services to HTTP and ditch SSL completely
09 Apr 2014
Honey traps, a lesson in espionage, and managing your ego
25 Mar 2014
Create a honeynet, dupe your attackers, build threat intelligence
24 Mar 2014
8 ways to be great at password management, and protect your customers
13 Mar 2014
Really? A notebook to write down your passwords in, sold by Amazon?
10 Mar 2014
Threat Intelligence: Log File Hacking
26 Feb 2014
Password re-use: the game is changing, SO USE A PASSWORD VAULT!
21 Feb 2014
Can you really wipe a mobile device remotely?
20 Feb 2014
How can I be tracked using my mobile devices? Here’s how…
13 Feb 2014
It’s Safer Internet Day and we’ve got six tips to help you stay out of trouble
11 Feb 2014
Cyber liability insurance, you need it, and here’s why…
11 Feb 2014
Backwards phishing with Unicode – edocinU htiw gnihsihp sdrawkcaB
07 Nov 2013
Get your Macs back on track- Apple security for Windows experts
28 Oct 2013
The Antwerp hackers bundle demystified
23 Oct 2013
Pen Test Partners review online banking security for Which? Magazine
21 Oct 2013
Suffered a Security breach?
Mobile Security
Social Engineering
Web application testing
Security Consuting
