Researchers Find Security Risks in 73.6% of 61,500 Abandoned IoT Apps

Researchers have identified significant security and privacy risks across 61,500 abandoned Android Internet-of-Things (IoT) companion applications.

Their study found that 73.6% of these apps contained at least one potential vulnerability, risky embedded resource, or insecure communication path.

Risks in Abandoned IoT Apps

Titled “When Apps Outlive Vendors: Security Implications of IoT Abandonware,” the study examines a frequently overlooked aspect of the IoT lifecycle: mobile apps that remain installed and operational after their vendors remove them from app stores or stop issuing updates.

The researchers define “IoT abandonware” as apps removed from Google Play or those that have not received updates for over two years. Among the dataset analyzed, 54,886 apps had been removed from Google Play, while 6,614 apps had not been updated since March 2023.

The most common issue identified was the use of outdated third-party software. The researchers found that 45,248 apps, which is 73.6% of the total, included libraries associated with known Common Vulnerabilities and Exposures (CVEs).

Among these CVEs, 67.6% were rated as High or Critical severity. The study warned that abandoned apps cannot receive fixes when new vulnerabilities are disclosed, creating a persistent attack surface for applications that may still have access to device controls, cloud accounts, location data, cameras, microphones, contacts, or local storage.

However, the authors cautioned that the method used to match CVEs to libraries may generate false positives. A manual validation of a sample of 100 apps revealed a 52.5% false-positive rate for CVE applicability after version matching.

Therefore, treat the finding that 73.6% of apps are at risk as a large-scale risk indicator rather than definitive evidence that every flagged app is directly exploitable.

Abandoned IoT apps also maintained numerous references to obsolete or potentially unsafe online infrastructure. Every app in the dataset contained at least one unreachable fully qualified domain name, and 69.4% included at least one blocklisted domain.

Researchers extracted 168,718 unique domains and found that 24.2% were unreachable through DNS resolution. In a representative sample that included available historical registration data, 5.6% of domains had changed ownership.

Such changes are particularly dangerous when an app has hard-coded endpoints and lacks a vendor update path, as a new domain owner could potentially receive traffic intended for the original service.

The researchers found 3,066 applications with at least one malicious URL, which included infrastructure categorized as malware, phishing, scams, spyware, or suspicious.

The most concerning abandonment finding involved data flows. Static analysis revealed that 40.8% of unique data sinks in abandoned apps were associated with unreachable, blocklisted, or ownership-changed domains.

In contrast, only 0.4% of a reference sample of 500 actively maintained IoT apps exhibited this issue. These data flows included potentially sensitive information, such as device identifiers, subscriber data, and precise GPS coordinates.

The study found that 98% of observed sensitive data flows used Wi-Fi, increasing exposure risks where applications rely on poorly secured channels or compromised backend infrastructure.

Additionally, the researchers assessed the 1,000 most-installed abandoned apps. They found that popularity did not correlate with stronger post-abandonment security. Nearly 40% contained one to three Critical CVEs, 62% had High-severity CVEs, and 30 apps transmitted data to broken external endpoints.

These findings reinforce the idea that IoT security does not end when a device is sold or when its app is removed from an app store.

Organizations and consumers should inventory companion apps, remove unsupported software when possible, revoke unnecessary permissions, isolate legacy IoT devices, and switch to vendors that provide clear commitments on end-of-life and security updates.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC