Your Smart Devices Aren’t as Safe as You Think — IoT Security Explained
What is IoT Security? How Connected Devices Get Hacked, Real Attacks & How to Protect Every Device in Your Home and Business (Complete 2026 Guide)
From my experience: Most IoT vulnerabilities I’ve seen are not complex — they are simple misconfigurations like default passwords or outdated firmware that remain unnoticed for years.
IoT security focuses on protecting connected devices like smart TVs, routers, and cameras from attacks such as botnets, firmware exploits, and default credential abuse. This guide explains how real IoT attacks like Mirai and BadBox 2.0 work, why most devices are vulnerable, and exactly how to secure them step-by-step.
In early 2025, researchers discovered that a single piece of malware called BadBox 2.0 had silently infected more than 10 million internet-connected devices worldwide — smart TVs, set-top boxes, Android tablets, smartphones, and digital projectors. The infected devices had not been hacked by their owners clicking anything or making any mistake. They had shipped from the factory with malware already installed in the firmware, waiting to be activated. The infected devices were being used to commit advertising fraud, create fake accounts, and serve as proxies for criminal activity — all without the owners having any idea.
BadBox 2.0 is the most vivid illustration of why IoT security is one of the most urgent and underestimated cybersecurity challenges of 2026. There are approximately 21 billion connected devices on the internet today. 57% of them are vulnerable to medium or high severity attacks. 98% of all IoT device traffic is unencrypted. And 820,000 malicious attacks target IoT devices every single day.
Your smart TV, home router, security camera, baby monitor, smart doorbell, fitness tracker, and office printer are all computers connected to the internet. Unlike your laptop, most of them never receive security updates, run with default credentials that are publicly documented, and cannot run conventional antivirus software. They are ideal targets.
- What IoT security is — and why IoT devices are so vulnerable
- How IoT devices get attacked — the 6 main techniques
- Real IoT attacks — Mirai, BadBox 2.0, and the Aisuru 29.7 Tbps botnet
- IoT in critical infrastructure — when device attacks become physical threats
- The OWASP IoT Top 10 — the most critical device vulnerabilities
- How to secure your home IoT devices — step by step
- Enterprise IoT security — shadow IoT and industrial threats
- IoT security checklist
This guide is for beginners, cybersecurity learners, and anyone using smart devices at home or work who wants to understand real IoT risks and how to prevent them.
What IoT Security Is — And Why IoT Devices Are So Vulnerable
The Internet of Things (IoT) refers to any physical device with internet connectivity beyond traditional computers and smartphones: smart TVs, routers, security cameras, smart speakers, wearables, smart home devices, industrial sensors, medical equipment, connected vehicles, and the billions of other "smart" devices embedded into homes, offices, factories, hospitals, and cities.
IoT security is the set of practices, technologies, and policies designed to protect these devices and the networks they connect to from attack, unauthorised access, and exploitation.
The reason IoT devices are disproportionately vulnerable is structural — most were designed with functionality and cost as the primary constraints, not security:
- Limited computing resources: Many IoT devices have too little memory and processing power to run encryption, security software, or complex authentication systems. A $15 smart bulb controller does not have the resources to run the same security stack as a laptop.
- No update mechanism: Many IoT devices ship with firmware that was never designed to be updated. Vulnerabilities discovered after manufacture have no patch path — the device remains vulnerable for its entire operational life, which may be 5-10 years.
- Default credentials: Manufacturers ship devices with factory default usernames and passwords (admin/admin, root/root, admin/1234) documented in public manuals. Many users never change these. Attackers maintain and continuously update lists of default credentials for every device model.
- Always-on connectivity: IoT devices are designed to be online 24/7. Unlike a laptop that users turn off, a security camera or smart TV is always connected and always potentially accessible to attackers scanning the internet.
- No visibility: Users and IT teams typically have no security monitoring on IoT devices — no logs, no alerts, no way to know if a device has been compromised.
How IoT Devices Get Attacked — The 6 Main Techniques
Default Credential Exploitation
Automated scanning tools continuously probe internet-facing IoT devices, checking known default username/password combinations for every device model. A router shipped with admin/admin credentials, a camera with admin/12345, or a NAS device with factory defaults will be found and logged within hours of going online. Attackers maintain constantly-updated credential databases. The Mirai botnet — which caused the internet outage of 2016 — used just 61 default credential pairs to infect hundreds of thousands of devices.
Unpatched Firmware Vulnerabilities
IoT device firmware contains software vulnerabilities — buffer overflows, command injection flaws, authentication bypasses — just like any other software. Unlike desktop operating systems that receive regular automatic updates, most IoT devices require manual firmware updates that most users never perform. Some manufacturers stop providing updates after a few years, leaving devices permanently vulnerable. Routers are particularly targeted — critical vulnerabilities in major router brands have been exploited within days of disclosure, before most users are even aware a vulnerability exists.
Pre-Installed Malware (Supply Chain Compromise)
BadBox 2.0 demonstrated this at massive scale — devices infected at the manufacturing stage or through the distribution supply chain before they reach consumers. Cheap Android devices, set-top boxes, smart TVs, and other consumer electronics sourced from unverified manufacturers may contain backdoors or malware baked into the firmware. The compromise is invisible — the device functions normally, but malicious code runs silently. This is particularly common in inexpensive devices from unknown manufacturers purchased through grey-market channels.
Network Lateral Movement — IoT as a Pivot Point
Even if an IoT device itself contains no sensitive data, compromising it can give an attacker a foothold inside your network from which to attack more valuable targets. A compromised smart TV or printer on the same network as work computers can be used to scan for other devices, intercept unencrypted local network traffic, and attempt to access network-connected storage or cloud credentials. This is the "everything on the same flat network" problem — when IoT devices share a network with laptops and servers, a compromised device becomes a stepping stone.
Insecure Data Transmission and Storage
98% of IoT device traffic is unencrypted. Smart home devices, wearables, and medical IoT transmit sensitive data — health metrics, location, audio clips, video feeds, usage patterns — often without encryption. This data can be intercepted by anyone on the same network or by monitoring internet traffic. Additionally, cloud storage for IoT device data is frequently misconfigured, as covered in the cloud security guide — publicly accessible buckets containing years of home camera footage, smart lock history, and health data are regularly discovered by security researchers.
Botnet Recruitment — Your Device Attacking Others
Compromised IoT devices are recruited into botnets and used to launch DDoS attacks, send spam, conduct credential stuffing attacks, and commit fraud — all at the device owner's expense (bandwidth, electricity, potential legal liability). The Aisuru botnet in 2025 used compromised IoT devices to launch a 29.7 Tbps DDoS attack — the largest at the time. IoT botnets are attractive to attackers because the devices are powerful enough to generate significant traffic, have unlimited bandwidth (from the owner's perspective), and remain compromised for months or years without detection. The relationship between IoT botnets and DDoS is detailed in the DDoS guide.
Real IoT Attacks — Mirai, BadBox 2.0, and the 29.7 Tbps Aisuru Botnet
Mirai Botnet — The Attack That Changed IoT Security (2016)
How it worked: Mirai was malware that scanned the entire internet for IoT devices using default credentials, then infected them automatically. It used a hardcoded list of just 61 default username/password combinations — the factory defaults for cameras, DVRs, and routers from dozens of manufacturers.
Scale reached: 600,000 infected devices. The combined bandwidth was enormous. Mirai launched the attack that took down Dyn DNS in October 2016, making Twitter, Reddit, Netflix, PayPal, Amazon, and Spotify inaccessible across the eastern United States for hours.
The lesson: Default credentials on internet-connected devices are not just a minor inconvenience — they enable attacks that can take down internet infrastructure for entire regions. And the barrier to this attack was essentially zero: automated scanning, public default credential databases, and malware that anyone could download from GitHub after the source code was published.
BadBox 2.0 — Pre-Infected at the Factory (2025)
What happened: Security researchers at Human Security and Google identified that more than 10 million consumer devices — Android TV boxes, smart TVs, tablets, smartphones, digital projectors — had been infected with malware at the manufacturing or distribution stage. The malware was embedded in the firmware, invisible to users.
What the malware did: The infected devices were used for: residential proxy services (routing malicious traffic through victims' home IP addresses), advertising fraud (generating fake ad impressions and clicks), fake account creation across social media platforms, and credential stuffing attacks. Each infected device was effectively renting out its identity and internet connection to criminals.
Who was affected: Users who had done everything right — bought a device, connected it, used it normally. The compromise happened before they ever touched it. The devices functioned perfectly for their intended purpose while simultaneously participating in criminal operations.
The lesson: Supply chain compromise means you cannot trust the security of a device based solely on its behaviour. Buying from reputable manufacturers with established security practices and update commitments is a genuine security decision, not just a brand preference.
Aisuru / TurboMirai Botnet — 29.7 Tbps (2025)
In August 2025, a botnet composed primarily of compromised IoT devices launched a DDoS attack measuring 29.7 terabits per second — one of the largest ever recorded. The botnet, tracked as Aisuru (also called TurboMirai), was assembled by exploiting known vulnerabilities in home routers, security cameras, and DVRs. The attack exploited the fundamental IoT security gap: millions of unpatched, perpetually-connected devices with no security monitoring, functioning as involuntary weapons. Cloudflare's infrastructure absorbed it. An organisation without enterprise DDoS mitigation would have been completely offline.
IoT in Critical Infrastructure — When Device Attacks Become Physical Threats
Industrial IoT (IIoT) — connected devices in manufacturing, energy, water treatment, healthcare, and transportation — represents the most dangerous IoT security frontier. A compromised temperature sensor in a pharmaceutical cold chain can damage life-saving medication. A hacked controller in a water treatment facility can alter chemical dosing levels. A ransomware attack on hospital medical devices can directly delay patient care.
In 2021, an attacker accessed the control systems of the Oldsmar, Florida water treatment plant through a compromised remote access tool and attempted to change the sodium hydroxide concentration to a dangerously high level. An operator noticed the cursor moving and intervened. The incident demonstrated that IoT attacks on critical infrastructure are not theoretical — they are active, ongoing, and potentially lethal.
OWASP IoT Top 10 — The Most Critical Device Vulnerabilities
OWASP maintains an IoT-specific Top 10 list of the most critical security vulnerabilities in connected devices. Understanding this list helps you evaluate any IoT device you are considering:
- Weak, guessable, or hardcoded passwords — default credentials that cannot be changed, or hardcoded backdoor accounts in firmware
- Insecure network services — unnecessary services exposed on the network, particularly Telnet and unencrypted HTTP management interfaces
- Insecure ecosystem interfaces — weak APIs, web interfaces, and cloud backends connected to the device
- Lack of secure update mechanism — no firmware update capability, or updates delivered without signature verification (susceptible to update injection)
- Use of insecure or outdated components — outdated libraries, deprecated cryptographic algorithms, or known-vulnerable open source components
- Insufficient privacy protection — collecting more data than necessary, storing it insecurely, or transmitting without encryption
- Insecure data transfer and storage — sensitive data transmitted in plaintext or stored without encryption on the device
- Lack of device management — no asset tracking, no ability to remotely identify compromised devices or push security configurations
- Insecure default settings — devices shipped with security features disabled by default, requiring active configuration to achieve a secure state
- Lack of physical hardening — USB ports, JTAG interfaces, and serial ports accessible without authentication, enabling firmware extraction and modification by physical attackers
How to Secure Your Home IoT Devices — Step by Step
IoT Security Checklist — Home and Small Business
- Change default credentials on every device immediately. Every router, camera, smart TV, NAS device, and any other internet-connected device. The default admin/admin username and password for your router model is documented publicly. Use a unique strong password stored in your password manager. This single action stops the largest category of IoT attacks.
- Keep firmware updated on all devices. Enable automatic updates where supported. For devices without auto-update (most routers require manual updates), schedule a quarterly check. Your router's manufacturer website has the latest firmware version — compare it to what's running and update if behind. This is especially critical for routers, which are the highest-value IoT targets for attackers.
- Put IoT devices on a separate network segment. Most home routers support a guest network — put all IoT devices (smart TV, cameras, speakers, smart home devices) on the guest network, completely isolated from your laptops, phones, and computers. If an IoT device is compromised, the attacker cannot reach your main devices across network segments. This is the single most impactful architectural control available to home users.
- Disable features you don't use. Universal Plug and Play (UPnP) on your router allows devices to automatically open ports — disable it unless you specifically need it, as it is a common attack vector. Remote access features on cameras and NAS devices should be disabled unless actively needed. The principle: every enabled feature is an attack surface.
- Research before you buy. Before purchasing any IoT device, search the model name + "security vulnerability" and "default credentials." Check whether the manufacturer has a published security policy, provides regular firmware updates, and has responded professionally to past vulnerability disclosures. Cheap no-brand devices from unknown manufacturers carry significantly higher risk of pre-installed malware and permanent unpatched vulnerabilities.
- Replace devices that no longer receive updates. An IoT device whose manufacturer no longer provides firmware updates is a permanently vulnerable device. Routers are especially important — if your router model is no longer supported, replace it. The risk of running an unpatched, internet-facing router is not theoretical.
- Monitor for unusual network activity. Many modern routers (and router management apps like the ones provided by major ISPs) show you which devices are connected and their network activity. Any device showing unexpected large outbound data transfers or connecting to unusual destinations may be compromised. Tools like Pi-hole (a DNS-level ad blocker that also provides network visibility) can help monitor IoT device traffic.
- Physically secure high-risk devices. Security cameras accessible to physical tampering, routers in publicly accessible locations, and any IoT device with a USB port can be compromised physically. Ensure routers and network equipment are not physically accessible to non-authorised individuals — especially important in offices, shared accommodation, and rental properties.
IoT Security FAQs
Key Takeaways
- IoT devices are one of the most vulnerable attack surfaces in modern cybersecurity
- Most attacks succeed due to default credentials and unpatched firmware
- Botnets like Mirai turn simple devices into powerful attack tools
- Network segmentation is the most effective home-level defense
- Buying secure devices is as important as configuring them securely
Comments
Post a Comment