Top all-time · #776
Pen Test Partners
Company blog · pentestpartners.com/security-blogsecurity
Pen Test Partners is the company blog at pentestpartners.com, writing about security. Since 2015, 85 different Hacker News readers have linked it 127 times, most often “Reverse Engineering the Tesla Firmware Update Process (2020)”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Too few sampled comments (20) to say how often HN recommends it.?
Why HN links it
Pen Test Partners' security blog publishes hands-on research on devices and systems such as IoT cameras, car computers, Ring doorbells and 4G hotspots. Commenters mostly cite its posts as sources.
Summarised by Claude from a sample of 20 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Pen Test Partners provides cyber security consulting and testing to a huge variety of industries and organisations. With offices in the US and UK, we're never too far away.
Most-linked posts?
- Reverse Engineering the Tesla Firmware Update Process (2020)5 people · 5 mentions · first linked 2020-02-12
- Exploiting Copilot AI for SharePoint4 people · 4 mentions · first linked 2025-05-07
- Pen Testing Ships. A year in review3 people · 3 mentions · first linked 2020-02-18
- Reverse Engineering a 5g ‘Bioshield’3 people · 3 mentions · first linked 2020-05-28
- Ring Doorbell Vulnerability Exposes Wifi Password3 people · 3 mentions · first linked 2016-01-13
- Vulnerabilities that aren’t. ETag headers2 people · 2 mentions · first linked 2022-06-08
- Tic Toc Pwned – Child tracking smartwatch API flaws2 people · 2 mentions · first linked 2019-04-16
- Build an NFC tag emulator device for around $102 people · 2 mentions · first linked 2018-01-18
- Tea kettle backdoor into wireless networks2 people · 2 mentions · first linked 2015-10-20
- We turned a real car into a Mario Kart controller by intercepting CAN data2 people · 2 mentions · first linked 2025-06-27
What Hacker News says?
they often do at least the smaller vessels[1]. should be able to find interesting exposed endpoints on shodan. Pentest-Partners did a post[2] on interfering with load management software in container ships. [1] https://www.livewire-connections.com/sites/default/files/fil... [2] https://www.pentestpartners.com/security-blog/sinking-contai...
Comment linking /security-blog/sinking-container-ships-by-hacking-load-plan-software/
on “Suez canal blocked by a massive ship”Submitted Group sex app leaks locations, pics and personal details as a story · 362 points
HN discussionThat was FUD[1] spread by Chris Roberts who has been called out for it. He claimed he was able to issue climb commands from the IFE to the CAN bus. Apart from this being technologically impossible, if he would have really done it he would have been charged for endangering an aircraft and prosecuted. (So the only explanation why he isn't in prison is that it didn't happen). The technical reason is Data diodes are com…
Comment linking /security-blog/a-pen-testers-first-solo-aviation-security-101/
on “US passes emergency waiver over fuel pipeline cyber-attack”Submitted Drilling open a smart door lock in 4 seconds as a story · 263 points
HN discussionTesla is. Failed updates are non-destructive, they also have an RTOS gateway isolating entertainment software from the software needed to drive the vehicle. https://www.pentestpartners.com/security-blog/reverse-engine... And this is their decade old architecture. If you watch some cybertruck videos you’ll see it is much more elegant now.
Comment linking /security-blog/reverse-engineering-tesla-hardware/
on “A recent software update was not successful. Your vehicle cannot be driven”Submitted Sinking container ships by hacking load plan software as a story · 193 points
HN discussionThis is a political article. If you're interested in the technicals read this linked one instead (far shorter, and actually talks about the technical problems in detail): https://www.pentestpartners.com/security-blog/tic-toc-pwned/ I think the mods should leave it pointed to the Hunt article since seems people want to discuss the politics more anyway.
Comment linking /security-blog/tic-toc-pwned/
on “How to Track Your Kids (and Other People's Kids) with the TicTocTrack Watch”Submitted Backdoor in DVR firmware sends CCTV camera snapshots to email address in China as a story · 188 points
HN discussionThe original blog post with more details can be found here: https://www.pentestpartners.com/security-blog/eyedisk-hackin...
Comment linking /security-blog/eyedisk-hacking-the-unhackable-again/
on “‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text”Submitted ‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text as a story · 175 points
HN discussionShips are full of holes: https://www.pentestpartners.com/security-blog/pen-testing-sh...
Comment linking /security-blog/pen-testing-ships-a-year-in-review/
on “Maersk prepares to lay off the Maidenhead staffers who rescued it from NotPetya”Submitted Breaking Samsung Firmware, or Turning Your S8/S9/S10 into a DIY “Proxmark” as a story · 146 points
HN discussionWardriving for sex toys! https://www.pentestpartners.com/security-blog/screwdriving-l...
Comment linking /security-blog/screwdriving-locating-and-exploiting-smart-adult-toys/
on “Modern Wardriving (2023)”Submitted Social engineering dos and don'ts as a story · 131 points
HN discussionI guess it’s referring to this post: https://www.pentestpartners.com/security-blog/steal-your-wi-...
Comment linking /security-blog/steal-your-wi-fi-key-from-your-doorbell-iot-wtf/
on “Cracking the Tapplock Smart Lock”Submitted Cracking the Tapplock Smart Lock as a story · 99 points
HN discussionApparently it is a 128Mb stick, with a pdf on it. "The stick comes loaded with a 25 page PDF version of the material from 5GbioShield ‘s website. It included a Q&A of distances for the “bubble” and how to know if it is working. It’s an “always on” system apparently, is always working, powered or not, so no visual checks needed. A review of the stick’s properties revealed nothing more that what you’d expect from a re…
Comment linking /security-blog/reverse-engineering-a-5g-bioshield/
on “Pulling apart a £339 anti-5G USB stick”Submitted Warning as 4G Hotspots Are Hacked as a story · 96 points
HN discussionshould probably point to source URL: https://www.pentestpartners.com/security-blog/reverse-engine...
Comment linking /security-blog/reverse-engineering-a-5g-bioshield/
on “Pulling apart a £339 anti-5G USB stick”Submitted Gone in six seconds? Exploiting car alarms as a story · 95 points
HN discussionThe page with the most technical content is https://www.pentestpartners.com/security-blog/breaking-bad-f... with a title of "Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1" . Non-technical Forbes summary and headline is good for discovery (e.g. search/bots), technical overview links threads of research, and case study enables replication. Each page has a role.
Comment linking /security-blog/breaking-bad-firmware-encryption-case-study-on-the-netgear-nighthawk-m1/
on “Warning as 4G Hotspots Are Hacked”Submitted Pen Testing Ships. A year in review as a story · 80 points
HN discussionHere's the original source, it's not linked directly in the article: https://www.pentestpartners.com/security-blog/reverse-engine...
Comment linking /security-blog/reverse-engineering-4g-hotspots-for-fun-bugs-and-net-financial-loss/
on “Warning as 4G Hotspots Are Hacked”Submitted Hacking an assault tank...a Nerf one as a story · 59 points
HN discussionHowever your IOMMU may not actually be in use. It's not in use by default on Linux and on most Linux distros as it tends to break things on random hardware that isn't setup right. It tends to work most of the time on servers. Ubuntu 22.04 tried to turn it on by default but switched it off again due to random mostly graphics related regressions on random hardware: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/…
Comment linking /security-blog/hack-demo-video/firewire-memory-attack-a-how-to-video/
on “Giving Rust a chance for in-kernel codecs”Submitted Screwdriving: Locating and exploiting smart adult toys as a story · 59 points
HN discussionUsing HTTP meta-headers is actually something we seem to have forgotten how to do. The one that annoys me most is the accept-language header which is almost entirely ignored in favour of GeoIP lookups to figure out regionality... which I find super odd ; as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak). ETAG's though,…
Comment linking /security-blog/vulnerabilities-that-arent-etag-headers/
on “A sysadmin's rant about feed readers and crawlers (2022)”Submitted Hacking the Mitsubishi Outlander PHEV hybrid as a story · 59 points
HN discussionThey're just mass scanning for known IoT ports. UPnP opens up the port for everyone. My port number is an example. This blogger found his camera opening up port 80 via UPnP: https://www.pentestpartners.com/blog/hacking-the-aldi-ip-cct... Also Brian Krebs examined that Foscam camera and found it enabled a P2P protocol and opened a port on the firewall using UPnP as well: https://krebsonsecurity.com/2016/02/this-is-wh…
Comment linking /blog/hacking-the-aldi-ip-cctv-camera-part-2/
on “This security camera was infected by malware 98 seconds after it was plugged in”Submitted If you aren't soldering, you probably aren't testing IoT thoroughly as a story · 57 points
HN discussion
