Hardware Podcasts

Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036

IoT For All Podcast · 7 Aug 2019 · 44m

What this episode covers

Ken Munro, Partner at Pen Test Partners, explains how his team conducts 'vanilla research' by purchasing and breaking embedded IoT devices to find security vulnerabilities, such as the My Friend Kayla doll and smart heated drinks cups. He argues that security is often treated as an afterthought by startups, leading to catastrophic failures when wrong chipsets are chosen early in development, making over-the-air updates impossible. Munro details the responsible disclosure process, noting that when vendors ignore or stonewall reports, companies often go out of business, and he advocates for government regulation like California's SB 327 to enforce reasonable security controls.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Pen Test Partners, Capital One
Products
My Friend Kayla
Also
Mirai, VxWorks, California Senate Bill 327, Black Hat, Defcon

Related episodes from other shows

Other shows on the same ground, closest first.

  • Embedded.fm · 1h 13m

    192: Button Connected To Nothing

    Terry Dunlap, founder and CEO of Tactical Network Solutions, discusses the critical lack of security in Internet of Things (IoT) devices, citing the Mirai botnet, the TrendNet FTC lawsuit, and the St. Jude Medical defibrillator alert as key examples of failure. He explains that common vulnerabilities stem from insecure coding practices, such as buffer overflows and hardcoded keys, often exacerbated by outsourcing firmware development without source code visibility. Dunlap highlights the emergence of standards like UL 2900 and the work of organizations like CableLabs to enforce firmware evaluation, while noting that consumers often remain vulnerable due to poor router configurations and a lack of firmware update support. He advises manufacturers to implement secure coding practices, use source code auditing tools, and encrypt firmware images to reduce the attack surface before devices reach the field.

    Security & privacyEmbedded firmware
    11 chapters

  • Embedded.fm · 1h 12m

    390: Irresponsible At the Time

    Tyler Hoffman, co-founder of Memfault, discusses the challenges of managing firmware updates, device diagnostics, and remote monitoring for millions of IoT devices. He draws on his experience at Pebble and Fitbit to explain why existing cloud platforms are often unsuitable for resource-constrained embedded systems, highlighting the need for secure boot, staged rollouts, and efficient heartbeat reporting. Hoffman details how Memfault’s platform helps engineers detect crashes, track battery life trends, and prioritize bugs by aggregating data from large device fleets. The conversation emphasizes the importance of defensive programming and building robust OTA systems to prevent bricking devices at scale.

    Embedded firmwareConnected products & IoT
    8 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • Coredump Sessions · 55m

    #019: END-OF-YEAR CELEBRATION: Moments You Loved, Stories You Missed, and 2026 Predictions You Need

    François Baldassari and Chris Coleman, co-founders of Memfault, reflect on the 20th episode of Coredump Sessions, highlighting lessons from guests like Nick Sinas of Oval, Dan Mangum of Golioth, and Chad from Gabb. They discuss the critical importance of Over-the-Air (OTA) updates, the rise of AI-assisted firmware development using tools like Claude and Cursor, and the evolving security landscape for devices from Pebble to modern smart rings. The hosts predict that 2026 will see OTA become a regulatory requirement and AI offload processing to the edge, while emphasizing the need for engineers to adapt to higher-level abstractions.

    Connected products & IoTAI & machine learning
    11 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by IoT For All Podcast. The episode itself belongs to its publisher.