Whether we want it to be or not, the Internet of Things is upon us. Network interfaces are the racing stripes of today's consumer device market. And if you put a network interface on a device, you have to make it do something right? That's where a Simple Object Access Protocol (SOAP) service comes in. SOAP services are designed with ease-of-access in mind, many times at the expense of security. Ludicrous amounts of control over device functionality, just about every category of vulnerability you can think of, and an all-around lack of good security practice about sums it up. This is going to be a talk about the dangers of insecure SOAP/UPnP interfaces on embedded and "smart" devices. The talk will be divided into two parts: First, "Let's talk about all the good things" - I will start by defining SOAP and its intended use with real world examples. And second, "And the bad things" - This is where I'll give descriptions and demonstrations of the various vulnerabilities to be found therein, including XML parsing and memory corruption, SQL/SOAP/OS command injection, ENTITY tricks and information disclosure, and straight-up unauthenticated device control. This will involve live demos against a small selection of devices. Full details of new vulnerabilities may be given dependent upon vendor disclosures/patches, but I'll at least have demos.