Many small and medium-sized businesses still rely on one shared password. With WPA2-PSK, an attacker only needs to be in range long enough to kick a device off and capture the four-way handshake as it reconnects. Then they go home and crack it offline with Hashcat and a decent nothing, because none of it happens on your network.
A long, random passphrase helps. But what happens when someone leaves? Unless you change it on every laptop, printer and gadget in the building, they can still get on.
Our Eime has written up the whole attack cycle and what we’d do instead: WPA2/3-Enterprise with certificate-based auth, protected management frames, and guest and IoT networks kept well away from anything that matters.
Because the real question isn’t who can connect to your Wi-Fi. It’s what they can do once they’re on it.
📌 pentestpartners.com/security-blog/…
#CyberSecurity #WiFiSecurity #NetworkSecurity
A long, random passphrase helps. But what happens when someone leaves? Unless you change it on every laptop, printer and gadget in the building, they can still get on.
Our Eime has written up the whole attack cycle and what we’d do instead: WPA2/3-Enterprise with certificate-based auth, protected management frames, and guest and IoT networks kept well away from anything that matters.
Because the real question isn’t who can connect to your Wi-Fi. It’s what they can do once they’re on it.
📌 pentestpartners.com/security-blog/…
#CyberSecurity #WiFiSecurity #NetworkSecurity
0
1
2
182
Our Ken Munro gave a keynote at CyberSat 2026 in Virginia yesterday, asking why we’re still putting critical systems on the public internet.
From vulnerable satcoms and refrigeration controllers to connected devices hidden within organisations, the examples may change, but the themselves.
The takeaway was simple: know what’s connected, bring it under your oversight, patch it and build relationships with the people responsible for it.
Basic. Cyber. Hygiene.
#CyberSat #SpaceCybersecurity #CyberSecurity
From vulnerable satcoms and refrigeration controllers to connected devices hidden within organisations, the examples may change, but the themselves.
The takeaway was simple: know what’s connected, bring it under your oversight, patch it and build relationships with the people responsible for it.
Basic. Cyber. Hygiene.
#CyberSat #SpaceCybersecurity #CyberSecurity
0
0
6
265
Warehouses are becoming more automated, but not resilient. Behind the scenes, you've got complex OT environments with many interdependent systems from multiple third parties, shared and cellular networks, and often no one responsible for securing the whole operation.
We've seen halt simply because its label printers stopped working. An attacker could cause greater disruption by manipulating stock locations and leaving the warehouse running, with robots and conveyors moving, but unable to reliably locate its inventory. Putting that right could take days.
Our @cybergibbons explains how these security gaps develop, why they're so difficult to fix and what operators can do about them.
📌 pentestpartners.com/security-blog/…
#OTSecurity #CyberSecurity #WarehouseAutomation
We've seen halt simply because its label printers stopped working. An attacker could cause greater disruption by manipulating stock locations and leaving the warehouse running, with robots and conveyors moving, but unable to reliably locate its inventory. Putting that right could take days.
Our @cybergibbons explains how these security gaps develop, why they're so difficult to fix and what operators can do about them.
📌 pentestpartners.com/security-blog/…
#OTSecurity #CyberSecurity #WarehouseAutomation
0
1
3
223
Much of the attention around PHP2Shell has focused on how AI helped researchers discover the vulnerabilities and develop exploits. While that's significant, the immediate problem for organisations remains the same.
They need to identify affected systems, patch them quickly and romise. AI is giving both attackers and defenders new capabilities. Security researchers find weaknesses faster, but attackers use the same technology to develop exploits.
Our Lambros explains what's behind PHP2Shell and what organisations should be doing now.
📌 pentestpartners.com/security-blog/…
#PHP2Shell #CyberSecurity #PHP
They need to identify affected systems, patch them quickly and romise. AI is giving both attackers and defenders new capabilities. Security researchers find weaknesses faster, but attackers use the same technology to develop exploits.
Our Lambros explains what's behind PHP2Shell and what organisations should be doing now.
📌 pentestpartners.com/security-blog/…
#PHP2Shell #CyberSecurity #PHP
0
0
2
242
Hundreds of supermarkets across France have been left with spoiled food, damaged refrigeration equipment, and losses running into tens of millions of euros.
No sophisticated nation state capabilities required. Just exposed systems, outdated firmware, and some knowledge of how refrigeration works.
The Danfoss refrigeration controllers involved have a built-in login mechanism that uses a code derived from the current date. The vulnerabilities have been known for years, with fixes available, yet controllers were still exposed directly to the internet.
@cybergibbons explains how the attack could have worked, why third-party remote access is part of the problem, and how basic cyber hygiene could have prevented it.
📌 pentestpartners.com/security-blog/…
#CyberSecurity #OTSecurity #RetailSecurity
No sophisticated nation state capabilities required. Just exposed systems, outdated firmware, and some knowledge of how refrigeration works.
The Danfoss refrigeration controllers involved have a built-in login mechanism that uses a code derived from the current date. The vulnerabilities have been known for years, with fixes available, yet controllers were still exposed directly to the internet.
@cybergibbons explains how the attack could have worked, why third-party remote access is part of the problem, and how basic cyber hygiene could have prevented it.
📌 pentestpartners.com/security-blog/…
#CyberSecurity #OTSecurity #RetailSecurity
0
1
3
296
Prompt injection is often only the start of an AI security finding.
If an attacker can influence the model, can they use that to access customer data, retrieve internal documents or trigger actions in production systems?
Our Cory Stone looks at how the risks in the 2026 OWASP how the impact depends on what the model can read, what it can reach and how the application handles its output.
Your AI can access it. Can an attacker?
📌 pentestpartners.com/security-blog/…
#AISecurity #LLMSecurity #PromptInjection #CyberSecurity
If an attacker can influence the model, can they use that to access customer data, retrieve internal documents or trigger actions in production systems?
Our Cory Stone looks at how the risks in the 2026 OWASP how the impact depends on what the model can read, what it can reach and how the application handles its output.
Your AI can access it. Can an attacker?
📌 pentestpartners.com/security-blog/…
#AISecurity #LLMSecurity #PromptInjection #CyberSecurity
2
2
2
259
Fire pumps, steering gear and propulsion are obviously critical, and the rules are built around them. But the IT that keeps a ship commercially operating often gets far less assurance, even though we regularly compromise those systems during testing.
On one vessel, ransomware is ship runs degraded, she is late, and the rest of the fleet carries on.
Our @cyberrgibbons looks at where the industry is moving. More IT is coming on board, more systems talk back to shore, fleet wide Windows domains are becoming common, and connectivity has gone from VSAT to Starlink speeds.
A vessel now looks much more like a branch office than an isolated site. The impact becomes significant when we point out that the same systems can be taken out on every ship in the fleet at once.
📌 pentestpartners.com/security-blog/…
#MaritimeCyberSecurity #Ransomware #Shipping #CyberSecurity
On one vessel, ransomware is ship runs degraded, she is late, and the rest of the fleet carries on.
Our @cyberrgibbons looks at where the industry is moving. More IT is coming on board, more systems talk back to shore, fleet wide Windows domains are becoming common, and connectivity has gone from VSAT to Starlink speeds.
A vessel now looks much more like a branch office than an isolated site. The impact becomes significant when we point out that the same systems can be taken out on every ship in the fleet at once.
📌 pentestpartners.com/security-blog/…
#MaritimeCyberSecurity #Ransomware #Shipping #CyberSecurity
0
0
2
267
We’re at International Cyber Expo!
Darryl, Kira and Dan are on stand K90 today with the AI Talkie Toaster and plenty of PTP security socks.
Come over, chat with the team and keep your security on its toes.
📌 Stand K90
#InternationalCyberExpo #ICE #ISE
Darryl, Kira and Dan are on stand K90 today with the AI Talkie Toaster and plenty of PTP security socks.
Come over, chat with the team and keep your security on its toes.
📌 Stand K90
#InternationalCyberExpo #ICE #ISE
0
0
1
235
Thirty minutes from walking into an office to taking over the domain. Our Paul Brownridge is at @GrrCON in Grand Rapids, Michigan, showing how preparation and a few overlooked building systems can turn physical access into the keys to the kingdom… “Mission Improbable?”
JP Paul too, so if you spot either of them, come and say hello!
#GrrCON #PhysicalSecurity #PenTesting
JP Paul too, so if you spot either of them, come and say hello!
#GrrCON #PhysicalSecurity #PenTesting
0
0
4
284
Red Dwarf fans will know Talkie Toaster isn’t good at keeping quiet. When our Colin Kitchen built his own AI-powered version, he discovered that extends to passwords…
What started as a long-held ambition to bring a favourite character to life became a practical experiment in turned it into a CTF challenge, sometimes all it took to get the password was an ultimatum… Toast or secrets!
The blog post follows the whole build, from choosing and configuring a local model and recreating Talkie’s voice to 3D printing the body. Along the way came a few familiar AI security problems and an unhealthy obsession with toasted goods.
See the Talkie Toaster in action below:
📌 pentestpartners.com/security-blog/…
#AISecurity #RedDwarf
What started as a long-held ambition to bring a favourite character to life became a practical experiment in turned it into a CTF challenge, sometimes all it took to get the password was an ultimatum… Toast or secrets!
The blog post follows the whole build, from choosing and configuring a local model and recreating Talkie’s voice to 3D printing the body. Along the way came a few familiar AI security problems and an unhealthy obsession with toasted goods.
See the Talkie Toaster in action below:
📌 pentestpartners.com/security-blog/…
#AISecurity #RedDwarf
0
1
2
261
Oops, “We weren’t supposed to find that”...
Yesterday our Sam Thom (@Blackf3ll) presented at the IET Cyber Security for Critical Industries Conference, sharing a few stories from our OT testing.
A remote access device that wasn’t on the network diagram. A corporate Wi-Fi to an OT network because someone needed internet access for their laptop. Understandable reasons for connecting things, but consequences that hadn’t been thought through.
There’s plenty of guidance on securing OT. The challenge is checking how well it holds up on site, including the kit your suppliers have installed and the workarounds people have made.
Thanks to the IET for having us!
#OTSecurity #CriticalInfrastructure #IET
Yesterday our Sam Thom (@Blackf3ll) presented at the IET Cyber Security for Critical Industries Conference, sharing a few stories from our OT testing.
A remote access device that wasn’t on the network diagram. A corporate Wi-Fi to an OT network because someone needed internet access for their laptop. Understandable reasons for connecting things, but consequences that hadn’t been thought through.
There’s plenty of guidance on securing OT. The challenge is checking how well it holds up on site, including the kit your suppliers have installed and the workarounds people have made.
Thanks to the IET for having us!
#OTSecurity #CriticalInfrastructure #IET
0
2
6
351
Passback attacks… When the printer refuses to print your document but happily hands over credentials.
We quite often find insecure printer settings during testing that make these attacks possible. Even so, passback attacks receive less attention than other ways of stealing n Davies built a fake printer interface to show how the attack works. The attacker may not be able to see or extract the printer's stored credentials, but they don't need to. If they can change the LDAP server it connects to, they can get the printer's credentials sent to a system they control when it authenticates.
Read Morgan's attack breakdown and mitigations so your printer isn't quite so helpful:
📌pentestpartners.com/security-blog/…
#PassbackAttacks #PenetrationTesting
We quite often find insecure printer settings during testing that make these attacks possible. Even so, passback attacks receive less attention than other ways of stealing n Davies built a fake printer interface to show how the attack works. The attacker may not be able to see or extract the printer's stored credentials, but they don't need to. If they can change the LDAP server it connects to, they can get the printer's credentials sent to a system they control when it authenticates.
Read Morgan's attack breakdown and mitigations so your printer isn't quite so helpful:
📌pentestpartners.com/security-blog/…
#PassbackAttacks #PenetrationTesting
0
1
5
332
Public Wi-Fi is often portrayed as inherently dangerous, but many of the commonly cited threats have not fully caught up with the widespread adoption of HTTPS and modern browser security controls.
Someone sharing a coffee shop network cannot simply sniff passwords, messages or properly secured HTTPS session. TLS, certificate validation and HSTS make interception far harder than many warnings suggest.
The network itself should still be treated as untrusted. HTTPS protects the contents of a legitimate connection, but a malicious access point can still steer users towards a phishing site. It also does nothing for an unpatched device, an exposed local service or a certificate warning that someone clicks straight through.
A reputable VPN can reduce what the local network can see and add another layer of protection. However, it also shifts trust to the VPN provider and cannot make a compromised device or malicious website safe.
In our latest blog post, Eime Adomaviciute explains where the risk sits, with practical advice for users and small businesses offering public Wi-Fi.
📌 pentestpartners.com/security-blog/…
#PublicWiFi #CyberSecurity #NetworkSecurity #DataSecurity
Someone sharing a coffee shop network cannot simply sniff passwords, messages or properly secured HTTPS session. TLS, certificate validation and HSTS make interception far harder than many warnings suggest.
The network itself should still be treated as untrusted. HTTPS protects the contents of a legitimate connection, but a malicious access point can still steer users towards a phishing site. It also does nothing for an unpatched device, an exposed local service or a certificate warning that someone clicks straight through.
A reputable VPN can reduce what the local network can see and add another layer of protection. However, it also shifts trust to the VPN provider and cannot make a compromised device or malicious website safe.
In our latest blog post, Eime Adomaviciute explains where the risk sits, with practical advice for users and small businesses offering public Wi-Fi.
📌 pentestpartners.com/security-blog/…
#PublicWiFi #CyberSecurity #NetworkSecurity #DataSecurity
1
1
5
406
A friend’s father used strong, unique passwords and kept a record of them in an encrypted Excel spreadsheet.
Unfortunately, he passed away. His family found the spreadsheet but nobody knew its password. Everything was safely locked away from the people who now needed it.
With , our @AlanMonie used office2john and Hashcat to attack it. But brute force and dictionary attacks got nowhere. The breakthrough came when the family found a format he commonly used. Two dictionary words and a predictable structure made it much easier to attack offline.
Luckily, the story has a bittersweet end, and the family got back into the systems they needed. However, it required a powerful cracking server and lots of electricity.
Strong passwords are meant to keep people out. But make sure the people you trust have a secure way back in.
Alan has written up some helpful guidance below:
📌pentestpartners.com/security-blog/…
#PasswordSecurity #CyberSecurity
Unfortunately, he passed away. His family found the spreadsheet but nobody knew its password. Everything was safely locked away from the people who now needed it.
With , our @AlanMonie used office2john and Hashcat to attack it. But brute force and dictionary attacks got nowhere. The breakthrough came when the family found a format he commonly used. Two dictionary words and a predictable structure made it much easier to attack offline.
Luckily, the story has a bittersweet end, and the family got back into the systems they needed. However, it required a powerful cracking server and lots of electricity.
Strong passwords are meant to keep people out. But make sure the people you trust have a secure way back in.
Alan has written up some helpful guidance below:
📌pentestpartners.com/security-blog/…
#PasswordSecurity #CyberSecurity
0
2
3
331
They could break IT/OT segregation without having to do… Anything?
During an OT engagement, @Blackf3ll and @OPSEC_failed found that a spare corporate access point had been plugged into the control room network to give staff internet access. It reused the corporate SSID, so went into the control room, they … roamed.
This broke segregation, exposing IT threats to the OT network and threatening to bring commodity malware back in to the IT network.
The technical fix was easy enough. But if you fix a segmentation issue without finding its root cause, it will come back in another form.
📌 pentestpartners.com/security-blog/…
#OTSecurity #ICSSecurity #NetworkSegmentation #WiFiSecurity
During an OT engagement, @Blackf3ll and @OPSEC_failed found that a spare corporate access point had been plugged into the control room network to give staff internet access. It reused the corporate SSID, so went into the control room, they … roamed.
This broke segregation, exposing IT threats to the OT network and threatening to bring commodity malware back in to the IT network.
The technical fix was easy enough. But if you fix a segmentation issue without finding its root cause, it will come back in another form.
📌 pentestpartners.com/security-blog/…
#OTSecurity #ICSSecurity #NetworkSegmentation #WiFiSecurity
0
4
7
565
We were proud to support the @SecureAerospace and @ICS_Village this year at @defcon 34! In case you missed it, here's a wrap-up of what our team was up to: pentestpartners.com/security-blog/…
Nine cases of hardware. Seven people. Three talks and a flight sim with a mind of its own...
A Ken, Adam, Sam, Andrew, Paul, JP and Mark, for getting all that hardware to Las Vegas, rebuilding it on site and giving visitors plenty to get stuck into.
#DEFCON34 #AviationSecurity #OTSecurity #CyberResearch
Nine cases of hardware. Seven people. Three talks and a flight sim with a mind of its own...
A Ken, Adam, Sam, Andrew, Paul, JP and Mark, for getting all that hardware to Las Vegas, rebuilding it on site and giving visitors plenty to get stuck into.
#DEFCON34 #AviationSecurity #OTSecurity #CyberResearch
0
1
7
446
The battery itself is good. The networking decisions were not.
In 2015, we recovered a home Wi-Fi password from a connected kettle. Nearly ten years later, we found a GivEnergy home battery repeating the trick. But worse than that...
The kettle needed a deauthentication attack not. It was usually already connected to the customer’s home network, creating a much more direct backdoor.
The gateway exposed Telnet and other local services. Earlier installations recommended either 12345678 or the inverter serial number as the Wi-Fi password. The serial number is also broadcast in the SSID!
Once connected, we could recover the customer’s home Wi-Fi password and change how the battery behaved, including preventing it from charging. Given enough time, we could also potentially have affected the battery management system and caused the battery to overheat. We did not test this, for obvious reasons.
GivEnergy addressed the credentials used for newer installations. However, we never received a remediation plan for existing customers before GivEnergy Ltd entered administration.
That is the awkward reality of connected products. The manufacturer can enter administration while the hardware and its security problems remain in people’s homes.
We have published the full research and practical steps owners can take now.
📌 pentestpartners.com/security-blog/…
#IoTSecurity #HardwareHacking #ProductSecurity #PSTI #EnergySecurity
In 2015, we recovered a home Wi-Fi password from a connected kettle. Nearly ten years later, we found a GivEnergy home battery repeating the trick. But worse than that...
The kettle needed a deauthentication attack not. It was usually already connected to the customer’s home network, creating a much more direct backdoor.
The gateway exposed Telnet and other local services. Earlier installations recommended either 12345678 or the inverter serial number as the Wi-Fi password. The serial number is also broadcast in the SSID!
Once connected, we could recover the customer’s home Wi-Fi password and change how the battery behaved, including preventing it from charging. Given enough time, we could also potentially have affected the battery management system and caused the battery to overheat. We did not test this, for obvious reasons.
GivEnergy addressed the credentials used for newer installations. However, we never received a remediation plan for existing customers before GivEnergy Ltd entered administration.
That is the awkward reality of connected products. The manufacturer can enter administration while the hardware and its security problems remain in people’s homes.
We have published the full research and practical steps owners can take now.
📌 pentestpartners.com/security-blog/…
#IoTSecurity #HardwareHacking #ProductSecurity #PSTI #EnergySecurity
0
2
5
390
One exposed cloud secret took us into AWS, GitHub and Azure. It then led us back into another AWS account with admin access.
It began with a Terraform state file in an overly permissive S3 bucket. The file contained credentials for a private GitHub repository. Inside that other secret. This led us to Azure Key Vault, which held admin keys for a separate AWS account!
Our Joe Durbin explains how to break the attack chain by making the secrets less useful to attackers in our latest blog post.
The aim is simple. One exposed secret should stay one problem.
📌 pentestpartners.com/security-blog/…
#CloudSecurity #AWS #Azure
It began with a Terraform state file in an overly permissive S3 bucket. The file contained credentials for a private GitHub repository. Inside that other secret. This led us to Azure Key Vault, which held admin keys for a separate AWS account!
Our Joe Durbin explains how to break the attack chain by making the secrets less useful to attackers in our latest blog post.
The aim is simple. One exposed secret should stay one problem.
📌 pentestpartners.com/security-blog/…
#CloudSecurity #AWS #Azure
1
1
2
353
Our @TheKenMunroShow is heading to @Hack_Glasgow on Saturday, 15th August.
He’ll be sharing some of what we’ve learned from testing connected aviation systems, including electronic flight bags, wireless maintenance systems, passenger Wi-Fi, and satellite communications.
Ken urity findings are disclosed and worked through with manufacturers, airlines and regulators.
He’ll be on Stage 1 at 3:30 pm.
📌 pretalx.hackglasgow.live/hack-glasgow-2…
#HackGlasgow #AviationSecurity #CyberSecurity
He’ll be sharing some of what we’ve learned from testing connected aviation systems, including electronic flight bags, wireless maintenance systems, passenger Wi-Fi, and satellite communications.
Ken urity findings are disclosed and worked through with manufacturers, airlines and regulators.
He’ll be on Stage 1 at 3:30 pm.
📌 pretalx.hackglasgow.live/hack-glasgow-2…
#HackGlasgow #AviationSecurity #CyberSecurity
0
0
4
325
The Hacker Summer Camp is nearly upon us! We’re heading to @defcon 34 with more kit than is probably sensible.
@TheKenMunroShow, @OPSEC_failed, @cybergibbons, and @Blackf3ll will be speaking across the @SecureAerospace and @ICS_Village. Expect new research into electronic DX aircraft networks, and programmable automation controllers used in critical infrastructure, plus a few impromptu talks along the way.
📌 Our full talk lineup and details: pentestpartners.com/security-blog/…
We will have one of our flight simulators with us, a half cockpit from an Airbus A320. We use it to demonstrate the effects of compromised engine performance calculations on a take off. This often leads to a tail strike and/or ‘runway excursion’ as crashes are sometimes euphemistically referred to as in aviation.
Or just try to land it safely!
We’re also bringing not one, but two Industrial Cocktail Systems. Both CTFs to help you learn about OT networks, so PLCs, HMIs and industrial switches & gateways.
If you succeed, they might just make you a drink too.
For anyone who prefers running, at 6:00 am, we’ll be joining DEFCON.run outside the Convention Center each morning.
There may even be some spare PTP running swag for those quick enough to claim it.
See you there!
#DEFCON34 #ICSVillage #AerospaceVillage
@TheKenMunroShow, @OPSEC_failed, @cybergibbons, and @Blackf3ll will be speaking across the @SecureAerospace and @ICS_Village. Expect new research into electronic DX aircraft networks, and programmable automation controllers used in critical infrastructure, plus a few impromptu talks along the way.
📌 Our full talk lineup and details: pentestpartners.com/security-blog/…
We will have one of our flight simulators with us, a half cockpit from an Airbus A320. We use it to demonstrate the effects of compromised engine performance calculations on a take off. This often leads to a tail strike and/or ‘runway excursion’ as crashes are sometimes euphemistically referred to as in aviation.
Or just try to land it safely!
We’re also bringing not one, but two Industrial Cocktail Systems. Both CTFs to help you learn about OT networks, so PLCs, HMIs and industrial switches & gateways.
If you succeed, they might just make you a drink too.
For anyone who prefers running, at 6:00 am, we’ll be joining DEFCON.run outside the Convention Center each morning.
There may even be some spare PTP running swag for those quick enough to claim it.
See you there!
#DEFCON34 #ICSVillage #AerospaceVillage
0
1
6
455