Abandoned IoT apps keep sending sensitive data to broken servers
UMass Amherst researchers found 61,500 abandoned Android IoT apps send sensitive data to unreachable, blocklisted, or re-registered domains.
Researchers at the University of Massachusetts Amherst built a dataset of 61,500 abandoned IoT companion apps from AndroZoo and found 73.6% bundled dependencies with vulnerabilities listed in the National Vulnerability Database. About a quarter of extracted domains no longer resolved, roughly one in nine URLs matched threat-intelligence blocklists for phishing, scam, spyware, or malware links, and domains affecting over 2,000 apps had changed ownership since the apps' last update. 38.4% of unique data-flow sources and sinks in abandoned apps were tied to unreachable, blocklisted, or ownership-changed domains, versus under 1% in 500 actively maintained comparison apps. Disclosure emails prompted some app removals and fixes, including a Tuya SDK issue patched on the vendor's cloud platform.
- 73.6% of 61,500 abandoned IoT apps contain dependencies with known NVD vulnerabilities
- 38.4% of data flows in abandoned apps target unreachable, blocklisted, or re-registered domains
- One in nine extracted URLs matched blocklists for phishing, scams, spyware, or malware
- Domains affecting over 2,000 apps changed ownership after development stopped
- Disclosure led to app removals; a Tuya SDK flaw was fixed on the vendor's cloud
- Vendors
- Tuya
- Products
- Google Play StoreAndroZoo
- Organizations
- University of Massachusetts Amherst
From the original article
4 min read at helpnetsecurity.com
Millions of people still run smart home and IoT companion apps, the apps used to control devices like smart plugs, cameras, and thermostats, that stopped receiving updates years ago. Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT apps and found that nearly three in four contained software dependencies associated with documented vulnerabilities.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.