Craig Heffner

At Black Hat 2010 he showed how DNS rebinding could reach the admin interface of millions of routers from inside the browser. In 2011 he released Reaver, which brute-forces the WPS PIN: the protocol checks the PIN in two halves, so a hundred million guesses shrink to about 11,000. Stefan Viehböck found the same flaw independently.

binwalk hunts for filesystems, compressed blocks and known signatures inside a firmware image, and is now the first step in nearly every IoT teardown.