# Breaking Embedded IoT Systems | Ken Munro, Partner at Pen Test Partners | #IoTMakers E036

- Show: [IoT For All Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast)
- Published: 2019-08-07
- Length: 44m
- Page: https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e
- Listen: https://podcasters.spotify.com/pod/show/iot-for-all/episodes/Breaking-Embedded-IoT-Systems--Ken-Munro--Partner-at-Pen-Test-Partners--IoTMakers-E036-e28bp7a

## Summary

Ken Munro, Partner at Pen Test Partners, explains how his team conducts 'vanilla research' by purchasing and breaking embedded IoT devices to find security vulnerabilities, such as the My Friend Kayla doll and smart heated drinks cups. He argues that security is often treated as an afterthought by startups, leading to catastrophic failures when wrong chipsets are chosen early in development, making over-the-air updates impossible. Munro details the responsible disclosure process, noting that when vendors ignore or stonewall reports, companies often go out of business, and he advocates for government regulation like California's SB 327 to enforce reasonable security controls.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=0) Introduction: Ken Munro and Pen Test Partners
- [5:49](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=349) The Testing Process: Vanilla Research and Responsible Disclosure
- [8:25](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=505) Security as an Afterthought: Startup Risks and Liability
- [12:09](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=729) Case Study: My Friend Kayla and the Catalyst for Regulation
- [17:12](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=1032) Hardware Constraints: Chipset Selection and OTA Updates
- [23:07](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=1387) Weaponized IoT: Mirai, VxWorks, and Interconnected Vulnerabilities
- [25:16](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=1516) Driving Change: Regulation, California SB 327, and Labeling
- [31:58](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e#t=1918) Consumer Advice: Due Diligence, Passwords, and Data Privacy

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Starting a product company](https://hardwarepodcasts.com/topic/starting-a-company)
- [Policy, trade & tariffs](https://hardwarepodcasts.com/topic/policy-trade-and-tariffs)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)

## Most relevant to

early-stage companies

## Mentioned

- Pen Test Partners (company)
- My Friend Kayla (product)
- Mirai (other)
- VxWorks (other)
- California Senate Bill 327 (other)
- Black Hat (other)
- Defcon (other)
- Capital One (company)

## Related episodes from other shows

- [192: Button Connected To Nothing](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing) (Embedded.fm)
- [390: Irresponsible At the Time](https://hardwarepodcasts.com/podcast/embedded-fm/2021-10-21-390-irresponsible-at-the-time) (Embedded.fm)
- [515: Script Boomers](https://hardwarepodcasts.com/podcast/embedded-fm/2025-11-27-515-script-boomers) (Embedded.fm)
- [#000: How New IoT Security Regulations Will Shape the Industry's Future](https://hardwarepodcasts.com/podcast/coredump-sessions/2024-09-17-000-how-new-iot-security-regulations-will-shape-the-industrys-future) (Coredump Sessions)
- [#019: END-OF-YEAR CELEBRATION: Moments You Loved, Stories You Missed, and 2026 Predictions You Need](https://hardwarepodcasts.com/podcast/coredump-sessions/2025-12-11-019-end-of-year-celebration-moments-you-loved-stories-you-missed-and-2026-predic) (Coredump Sessions)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2019-08-07-breaking-embedded-iot-systems-ken-munro-partner-at-pen-test-partners-iotmakers-e. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to IoT For All Podcast.