Practical IoT Hacking is an incredibly detailed guide to a niche side of penetration testing that is penned by an all-star team of five highly regarded security researchers, Practical IoT Hacking is the indispensable, comprehensive blueprint for mastering modern connected device security. This engaging guide addresses the urgent demands of the rapidly growing Internet of Things (IoT) — the world of smart cameras, speakers, and Wi-Fi devices often rushed to market without sufficient security testing. Drawing from real-life exploits, the book immediately equips readers with a robust methodology for threat modeling, passive reconnaissance, and system testing. It provides a quick-start path to exploiting weaknesses across all layers: teaching readers to crack MQTT authentication, abuse UPnP, and perform deep hardware hacking against embedded devices via UART and SWD interfaces. Using only affordable, readily available tools, this volume is the essential text for any security professional or aspiring penetration tester.

The foreword begins with the origins and history of the IoT, explaining how the rapid manufacturing of small electronics has given consumers both convenience and vulnerability to hackers. The first chapters quickly establish that the book is not entry-level but geared toward an expertise in digital hacking. Like most books from No Starch Press, it heavily focuses on Kali Linux and assumes the reader is already familiar with using a virtual machine. Using Kali Linux, the book immediately details a horror story of criminal hackers. I will follow the book's lead and provide a few ethical hacking breadcrumbs, but not the actual recipe for carrying out cyberattacks. When I use the term "hacker," I am referring to an ethical hacker or a penetration tester who uses Kali Linux in a virtual machine to test software vulnerability for lucrative bug bounties.

The second chapter mirrors most cybersecurity courses by emphasizing threat modeling as the first critical step. A common principle in cybersecurity is that learning the tools is insufficient; one must also develop the discipline to fully assess potential coding flaws. The chapter explores common IoT threats and attacks on firmware, serving as the foundational start to IoT hacking.

Chapter Three emphasizes the importance of passive reconnaissance, which can involve using social media to digitally research software developers. Spoiler alert: much of the information needed to unlock administrative privileges for IoT devices can often be found directly within publicly published manuals and documentation. Sometimes in cybersecurity, simply searching the manuals can greatly reward you in web bug bounty reports. Passive reconnaissance can also lead you to customers publicly complaining about a device not working, unintentionally revealing how to tamper with an electronic device's locks. Another key concept in this chapter is how the boot environment can be an excellent entry point for novice IoT hackers.

Chapter Four stresses the importance of network attacks, specifically detailing how MQTT (Message Queuing Telemetry Transport) can be exploited using Ncrack on Kali Linux to create custom passwords for IoT devices. This chapter may be familiar to those with Kali Linux experience. The authors explain how to carry out both VLAN attacks on network switches and the similar attack of Switch Spoofing, which is a protocol thieves use to impersonate a legitimate network switch. This information could be harmful in the wrong hands, but it is crucial for preventing cyberattacks before they happen.

Chapter Five continues the network analysis thread, detailing how to utilize packet analyzers like Wireshark after conducting initial scans with Nmap. The chapter covers tools for fuzzing and testing encryption, leaving the reader with a clear understanding of how to leverage network analysis for protocol attacks which I have learned is a gemstone of penetration testing.

Chapter Six introduces the reader to zero-configuration networking to automate the scanning for IoT vulnerabilities. The majority of the chapter focuses on acquiring and configuring the powerful Umap tool. Automating scans using AI is a technique employed by top-tier hackers, and the book strongly recommends this growing skill for anyone pursuing a career in penetration testing.

Chapter Seven transitions from software and firmware hacking to real-world hardware hacking. While I greatly appreciate this unique content, one criticism is the lack of guidance on testing hardware in a virtual environment. Though universal in principle, protocols can vary regionally (e.g., due to the European Union's regulations or different measurement systems). However, learning how to debug UART pins offers a practical skill applicable to nearly all IoT devices. The book wisely recommends a quality multimeter, as tools like a multimeter or even a Geiger counter can reveal significant insider information when testing IoT hardware.

Chapter Eight may be the most challenging chapter to read, particularly for those with limited familiarity with Serial Peripheral Interfaces (SPIs). The IT world is a non-stop list of acronyms, and this chapter continues the trend.

Chapter Nine expands on Chapters Two and Seven, going into much greater detail on the various methods of firmware hacking. IoT devices are often overlooked in ethical hacking, but this chapter reviews introductory methods for hacking the Wi-Fi routers to which these devices are connected.

Chapter Ten covers radio hacking, as IoT devices utilize Bluetooth, wireless, and short-range radio signals. Radio Frequency Identification (RFID) is commonly found in smart door locks and key cards. While Kali Linux offers debugging tools, Proxmark3 is highlighted as the key tool for cloning RFID tags. Bug bounty programs typically do not reward brute-force attacks because developers are already aware of their disruptive potential. However, with IoT devices, one can use Proxmark3 to run commands that read memory, potentially revealing major security flaws.

Chapter Eleven covers the wide range of Bluetooth Low Energy (BLE) attacks that compromise electronic devices. Understanding how Bluetooth functions is critical for attacking devices that communicate data signals through other devices. Though brief, this chapter provides valuable hands-on learning for this niche, and increasingly relevant, hacking strategy.

Chapter Twelve addresses Wi-Fi, the most popular IoT device connection method. The powerful commands Aircrack-ng and Airmon-ng are essential for IoT hacking, but the authors caution that their use which can jam other key software devices. A detailed threat model is necessary to anticipate the monotony and growing pains associated with Denial-of-Service (DoS) testing. While DoS attacks are often ruthless, it's best to research if any bug bounty rewards exist for them, similar to how brute-force attacks rarely result in a payout. Wi-Fi has many protocols, and penetration methods must be varied to fool devices into accepting Kali Linux and Proxmark3 as the legitimate source of internet connection.

Chapter Thirteen covers Low-Power Wide Area Network (LPWAN) technology, an affordable connectivity method known for its exceptional battery life. Like Linux, LPWAN has an open-source counterpart called LoRaWAN, often found in hidden infrastructure devices such as railway crossings and motion sensors, which could be incredibly harmful in the wrong hands. While using an open-source tool to pentest open-source software can be challenging, the rapid innovation and reliance on LPWAN technology make IoT security testing an urgent need. Although using Linux to uncover errors in Python code on IoT infrastructure may seem daunting, the book provides a clear strategy for accessing the device's file store system from a home office.

Chapter Fourteen covers one of the most emerging trends in cybersecurity: attacking mobile applications. I began studying mobile web application hacking because it offers some of the most lucrative web bug bounty programs available. Covering both iOS and Android, Chapter Fourteen provides brief but detailed explanations of APIs (Application Programming Interfaces), which are crucial for overriding authentication controls. For more on APIs, check out my previous review at the link below.

Chapter Fifteen of this otherwise highly technical and informative book details how to compromise common Internet of Things (IoT) devices — from smart treadmills and cameras to HVAC systems — devices few consider significant security threats. Following dense chapters on topics like attacking Serial Peripheral Interfaces (SPI) and Message Queuing Telemetry Transport (MQTT), compromising a device's remote shell access is, by comparison, remarkably straightforward. The chapter illustrates this with the seemingly fun example of remotely adjusting a smart treadmill's speed and incline — a move that quickly shifts from a theoretical prank to a serious security concern, as the true value for cybercriminals lies not in mischief but in the harvesting of user data for sale on the dark web. The authors caution against pen-testing owned hardware due to the genuine risk of electronically damaging the device and, more importantly, the legal fine print that often reserves the right to repair or hack.

The book then abruptly concludes with the death of Dave Goldberg, CEO of SurveyMonkey and husband of former Facebook COO Sheryl Sandberg, who died from a treadmill accident. This anecdote, meant to underscore the physical risks of smart treadmills that may vulnerable IoT devices; suddenly devolves into a surprisingly timely rabbit hole concerning Sandberg's alleged association with unsavory friendship with figures like Ghislaine Maxwell and Larry Summers, of the 2008 financial crisis notoriety. Published in 2021, the technical content of Practical IoT Hacking remains sharp, but this final, editorial detour leads the reader about unaddressed workplace sexual violence. An odd way to end a very informative book, but while researching this anecdotal story that kind of ties into cyber security led me to learning that Sheryl Sandberg has been married to three men, dated a very problematic CEO, and has multiple sexual assault accusers who were all young women who worked at Facebook. One of the alleged sexual assaults was reported to have occurred between Sheryl Sandberg while traveling on Facebook's private jet, which may have an IoT device secretly recording their conversations. Some internet-of-things (IoT) devices can secretly record you through security vulnerabilities or by design which includes: Voice-activated assistants, Smart TVs, Webcams, Smartphones, Smartwatches and fitness trackers, and Wireless earbuds as well as there is a separate category for spy devices disguised as everyday objects like pens, USB flash drives, and keychains. IoT devices Sheryl Sandberg is a billionaire, but she also might be a bi-sexual predator like Ghislaine Maxwell.

The next time you are having a bad day, just remember that the media once dubbed Sheryl Sandberg one of the most powerful women in the world which may have been true until a 2025 article about Sandberg mentions her connection to Ghislaine Maxwell. A review of Sheryl Sandberg's book, Lean In mentions a 2001 photo of Ghislaine Maxwell, Prince Andrew, and Virginia Roberts Giuffre, which places their reputation together in an odd context. Sheryl Sandberg is the protege of Larry Summers who left his position as President of Harvard University in 2006 after a vote of no confidence from the faculty, which was largely triggered by his controversial 2005 speech suggesting potential aptitude differences between men and women in science. Larry Summers was one of the villains in the movie The Social Network and one of the villains in the documentary Inside Job about the 2008 financial crisis. Sheryl Sandberg is related to actor Jon Bernthal who is related professional wrestler Kurt Angle all of which has nothing to do with IoT hacking but I bring it up because I need to remind the readers, do not hack Sheryl Sandberg or Larry Summers or any of Jeffery Epstein's chomo friends because I do not want to see you get into trouble. This book is filled with powerful information and before you start thinking you are going to take this powerful information to bring justice to powerful people you, need to remind yourself that is not what this book was written for. Published in 2021, the technology details still hold up, just not on the last page. Sheryl Sandberg's one-time mentor and the former Harvard president who helped notroious chomo Jeffery Epstein's bolster his reputation while taking $30 million from the chomo just to create Harvard's Epstein Program for Mathematical Biology and Evolutionary Dynamics.

There are several authors who contributed to this book as IoT hacking requires several skills and lengthy experience in a number of diverse aspects of computer science; but it is is spectacularly jarring to end your book on a rabbit hole that leads to learning that about unaddressed sexual violence by senior Facebook executives is definitely the editors fault. This is the only No Starch Press that I have read twice as No Starch Press books provide excellent real world scenarios to help grow your cyber security skills, but Practical IoT Hacking was certainly a challenge for me. For a meticulously detailed guide to hacking computer code, the book remains a powerful, five-star resource for tech nerds who are serious about a legitimate career in cybersecurity or penetration testing; it's just a shame the editors can't hack an IoT time machine to correct his bizarre ending to an otherwise amazing book.

Despite its challenging nature, Practical IoT Hacking excels at detailing the possible scenarios and technologies found within an IoT environment. The authors thoroughly cover the methodologies, techniques, tools, and gadgets required for successful penetration testing and lucrative web bug bounty programs. While comprehensive, the book omits discussing how many Internet of Things (IoT) devices — including voice assistants, smart TVs, webcams, smartwatches, and even wireless earbuds — can be secretly leveraged to record users, either through security vulnerabilities or by design. It also only briefly touches on essential personal privacy protection measures. For comprehensive personal security, users should: regularly update software to patch vulnerabilities; use strong, unique passwords instead of default settings; utilize cybersecurity tools like reputable antivirus programs and VPNs; disable or physically cover unused features (like cameras or microphones); and actively monitor network activity for unrecognized devices.

IoT hacking has some narrow focus that gives the impression that due to the simplicity of IoT devices they can be hacked easily, but the truth is that while IoT devices are rudimentary, the hacking tools are not. It takes time to learn IoT hacking tools and if you are interested in a novel that is full of horror and non-IoT device topics, then check out my 2022, self-published memoir Iowa Trouble; which contains the type of Midwestern trouble that would lead me to study cyber security. Check out the link below for my book trailer and please like, comment, and subscribe for more book reviews on information hacking.

Tyler Granger

Iowa Author

10/22/2025

The Annual Windsor Heights Book Fair is held on the first Sunday in October and features over two dozen local authors with a free will donation to a local food bank. The opinion of this article does not reflect the authors of the Windsor Heights Book Fair but uses sources from The Des Moines Register, Associated Press, KCCI, Times-Delphic, WOI, Daily Iowan, WHO-13, Wikipedia, Google, and ESPN; all rights reserved.