# How to Discover & Handle IoT Firmware Vulnerabilities | Terry Dunlap, Co-Founder & CEO, ReFirm Labs | #IoTFounders E027

- Show: [IoT For All Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast)
- Published: 2019-05-15
- Length: 59m
- Page: https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo
- Listen: https://podcasters.spotify.com/pod/show/iot-for-all/episodes/How-to-Discover--Handle-IoT-Firmware-Vulnerabilities--Terry-Dunlap--Co-Founder--CEO--ReFirm-Labs--IoTFounders-E027-e28bp6c

## Summary

Terry Dunlap, Co-Founder & CEO of ReFirm Labs, explains how his background in offensive cyber operations at the NSA led to the creation of a platform for proactive IoT firmware security. He details the discovery of hard-coded credentials in IoT devices that enabled the Mirai botnet and discusses how low-cost manufacturers often ignore security until faced with legal liability. Dunlap highlights ReFirm Labs' work with telecom providers like AT&T and Charter to vet firmware before deployment, and explores emerging markets like cyber insurance and automotive security, including a demonstration of vulnerabilities in an OBD-II dongle.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=0) Introduction: Terry Dunlap and ReFirm Labs
- [2:18](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=138) Dunlap's Early Hacking and NSA Career
- [14:07](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=847) Founding ReFirm Labs and the Shift to Defense
- [19:05](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=1145) Understanding Firmware and the Mirai Botnet
- [24:31](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=1471) Manufacturer Negligence and Supply Chain Liability
- [30:28](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=1828) Telcos as Early Adopters of Firmware Vetting
- [34:22](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=2062) Case Study: Dahua Cameras and State-Sponsored Backdoors
- [41:23](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=2483) Competitive Landscape and Cyber Insurance Opportunities
- [48:19](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=2899) Automotive Security: OBD-II Dongle Vulnerabilities
- [53:42](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo#t=3222) Consumer Advice and Final Thoughts

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Sourcing & supply chain](https://hardwarepodcasts.com/topic/sourcing-and-supply-chain)
- [Starting a product company](https://hardwarepodcasts.com/topic/starting-a-company)
- [Retail, wholesale & distribution](https://hardwarepodcasts.com/topic/retail-and-distribution)

## Most relevant to

companies scaling up

## Mentioned

- ReFirm Labs (company)
- NSA (company)
- Mirai (product)
- AT&T (company)
- Charter Communications (company)
- D-Link (company)
- Trendnet (company)
- Dahua (company)
- Hikvision (company)
- Armas (company)
- Eclipseum (company)
- IoT Inspector (tool)
- bin walk (tool)
- Centrifuge (product)

## Related episodes from other shows

- [192: Button Connected To Nothing](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing) (Embedded.fm)
- [042 - Diwali in the Morning](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-11-24-042-diwali-in-the-morning) (Unnamed Reverse Engineering Podcast)
- [311: Attack Other People's Refrigerators](https://hardwarepodcasts.com/podcast/embedded-fm/2019-11-22-311-attack-other-peoples-refrigerators) (Embedded.fm)
- [390: Irresponsible At the Time](https://hardwarepodcasts.com/podcast/embedded-fm/2021-10-21-390-irresponsible-at-the-time) (Embedded.fm)
- [Offensive Cybersecurity with Ryan Torvik](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2025-04-09-offensive-cybersecurity-with-ryan-torvik) (The Pragmatic Embedded Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-05-15-how-to-discover-handle-iot-firmware-vulnerabilities-terry-dunlap-co-founder-ceo. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to IoT For All Podcast.