Researchers Find Security Risks in 73.6% of 61,500 Abandoned IoT Apps
A study of 61,500 abandoned Android IoT companion apps found 73.6% contain vulnerable libraries, dead domains, or insecure data flows exposing sensitive user data.
The study 'When Apps Outlive Vendors: Security Implications of IoT Abandonware' analyzed 61,500 abandoned Android IoT companion apps, including 54,886 removed from Google Play and 6,614 unpatched since March 2023. 45,248 apps (73.6%) contained libraries with known CVEs, 67.6% of them rated High or Critical, though manual validation showed a 52.5% false-positive rate for CVE applicability. Researchers extracted 168,718 unique domains, 24.2% unreachable, and found 3,066 apps with malicious URLs, while 40.8% of unique data sinks flowed to dead, blocklisted, or ownership-changed infrastructure versus 0.4% for maintained apps.
- 73.6% of abandoned apps embed libraries with known CVEs, 67.6% rated High or Critical.
- Manual validation found a 52.5% false-positive rate for CVE-to-library matching.
- 3,066 apps contained malicious URLs; 24.2% of 168,718 extracted domains were unreachable.
- 40.8% of data sinks flow to dead, blocklisted, or ownership-changed domains.
- Recommendations: inventory companion apps, revoke permissions, and isolate legacy IoT devices.
- Products
- Google Play
- Organizations
- Google Play
From the original article
3 min read at gbhackers.com
Researchers have identified significant security and privacy risks across 61,500 abandoned Android Internet-of-Things (IoT) companion applications. Their study found that 73. 6% of these apps contained at least one potential vulnerability, risky embedded resource, or insecure communication path.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.