# Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

- Show: [IoT For All Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast)
- Published: 2023-01-26
- Length: 18m
- Page: https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o
- Listen: https://podcasters.spotify.com/pod/show/iot-for-all/episodes/Biggest-Firmware-Vulnerabilities--How-to-Fix-Them--NetRises-Thomas-Pace--Internet-of-Things-Podcast-e28bk12

## Summary

Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=0) Introduction: Thomas Pace and NetRise
- [1:13](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=73) Historical Firmware Analysis and Manual Consulting
- [3:05](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=185) XIOT Device Categories: Embedded Linux, RTOS, and Windows
- [5:00](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=300) Biggest Firmware Vulnerabilities: CVEs, Weak Credentials, and Keys
- [7:03](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=423) The Firmware Analysis Process for Manufacturers and Enterprises
- [9:16](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=556) Challenges in Generating Software Bill of Materials (SBOM)
- [12:42](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=762) Device Security Strategy: Visibility and Vulnerability Correlation
- [14:22](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o#t=862) Industry Challenges and Mainstream Acceptance of Firmware Security

## Topics

- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Sourcing & supply chain](https://hardwarepodcasts.com/topic/sourcing-and-supply-chain)

## Most relevant to

early-stage companies

## Mentioned

- NetRise (company)
- VxWorks (other)
- Green Hills (other)
- uC/OS (other)
- eCos (other)
- UEFI (other)
- Armis (company)
- Dragos (company)

## Related episodes from other shows

- [515: Script Boomers](https://hardwarepodcasts.com/podcast/embedded-fm/2025-11-27-515-script-boomers) (Embedded.fm)
- [192: Button Connected To Nothing](https://hardwarepodcasts.com/podcast/embedded-fm/2017-03-22-192-button-connected-to-nothing) (Embedded.fm)
- [042 - Diwali in the Morning](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-11-24-042-diwali-in-the-morning) (Unnamed Reverse Engineering Podcast)
- [311: Attack Other People's Refrigerators](https://hardwarepodcasts.com/podcast/embedded-fm/2019-11-22-311-attack-other-peoples-refrigerators) (Embedded.fm)
- [Offensive Cybersecurity with Ryan Torvik](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2025-04-09-offensive-cybersecurity-with-ryan-torvik) (The Pragmatic Embedded Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to IoT For All Podcast.