Avast, a cybersecurity software firm, in collaboration with Stanford University, has found that about 40% of households across the globe now contain at least one IoT device. In Western Europe, that number is 57%, bringing with it an associated growth in cyber security risks.

For the research paper, All Things Considered: An Analysis of IoT Devices on Home Networks, Avast scanned 83m IoT devices in 16m homes worldwide to understand the distribution and security profile of IoT devices by type and manufacturer. The findings were then validated and analysed by research teams at Avast and Stanford University.

“The security community has long discussed the problems associated with emerging IoT devices,” said Zakir Durumeric, assistant professor of computer science at Stanford University. “Unfortunately, these devices have remained hidden behind home routers and we’ve had little large-scale data on the types of devices deployed in actual homes. This data helps us shed light on the global emergence of IoT and the types of security problems present in the devices real users own.”

Why digital trust matters in the IoT

As IoT adoption continues to rise, business success in the world of connected devices depends on building digital trust with consumers

Overall, the findings reveal a complex picture of the IoT ecosystem and subsequent cybersecurity challenges in homes across the world. For example:

• North America has the highest density of IoT devices of any region, with 66% of homes possessing at least one IoT device, compared to the global average of 40%.
• Even with over 14,000 IoT manufacturers worldwide, 94% of all IoT devices are manufactured by just 100 vendors.
• Obsolete protocols like FTP and Telnet are still used by millions of devices; over 7% of all IoT devices still use these protocols, making them especially vulnerable.

Distribution of IoT vendors around the globe

The paper further explored the distribution of global IoT vendors. While there is a very long tail of over 14,000 global IoT vendors, market dominance is limited to a select few.

“A key finding of this paper is that 94% of the home IoT devices were made by fewer than 100 vendors, and half are made by just ten vendors,” says Rajarshi Gupta, Head of AI at Avast. “This puts these manufacturers in a unique position to ensure that consumers have access to devices with strong privacy and security by design.”

AI and IoT: two sides of the same coin

The market is seeing significant investments in the convergence of AI and IoT, and its already begun creating new markets and opportunities

By hardening these devices against unwanted access, manufacturers can help prevent bad actors from compromising these devices for spying or denial of service attacks.

Significant security risks not being addressed

As part of the study, Avast also found that a significant number of devices still use obsolete protocols such as Telnet and FTP — 7% of all IoT devices support one of these protocols.

This is also the case for 15% of home routers, which act as a gateway into the home network. This is problematic because when routers have weak credentials they can open up other devices and potentially entire homes to an attack.

There is little reason for IoT devices to support Telnet in 2019. Yet, the research shows that surveillance devices and routers consistently support the protocol. Surveillance devices have the weakest Telnet profile, along with routers and printers. This aligns with historical evidence, such as the role of Telnet in the Mirai botnet attacks, that suggests these kinds of devices are both numerous and easy to compromise.