When Apps Outlive Vendors: Security Implications of IoT Abandonware

• URL: http://arxiv.org/abs/2609.14798v1
• Date: Sun, 13 Sep 2026 21:18:28 GMT
• Title: When Apps Outlive Vendors: Security Implications of IoT Abandonware
• Abstract summary: We analyze 61,500 IoT companion Android applications that had not been updated for at least two years or were no longer in service as of March 2025.<n>We identified security risks in 73.6% of our dataset, with 30 of the top 1,000 most-installed apps sending data to broken external endpoints.
• Score: 1.064377250844068
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As the Internet of Things (IoT) market continues to expand, many companion apps are being published in app stores, raising security concerns for those whose vendors have abandoned support. Even after vendors discontinue support, such applications frequently remain operational on users' mobile devices, continue to interface with users' IoT devices and collect user data without receiving security updates. This leaves known and newly discovered vulnerabilities unmitigated, increasing risks of remote exploitation, unauthorized device access, and prolonged data misuse. We define these abandoned applications as "IoT abandonware" and present the first large-scale measurement study of the security risks associated with discontinued applications. We analyze 61,500 IoT companion Android applications that had not been updated for at least two years or were no longer in service as of March 2025. From decompiled binaries, we extracted latent and embedded resources (e.g., bundled libraries, domain names, and permissions), and assessed their security implications. First, we identify outdated dependencies with post-abandonment CVE reports and discover domains vulnerable to takeover or data exfiltration. Second, we perform static data-flow analysis to trace how sensitive data, inferred from the extracted permissions, propagates to broken or hijackable external endpoints. We found that persistent analytics and third-party trackers continue aggregating user data and device telemetry long after vendor control lapses, creating data flows that adversaries can redirect or abuse. Overall, we identified security risks in 73.6% of our dataset, with 30 of the top 1,000 most-installed apps sending data to broken external endpoints.

Related papers

• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Security Evaluation of Android apps in budget African Mobile Devices [38.026369204707784]
  Pre-installed applications on widely distributed low-cost devices represent a significant and underexplored threat to user security and privacy.<n>These results demonstrate that pre-installed applications on widely distributed low-cost devices represent a significant and underexplored threat to user security and privacy.
  arXiv  Detail & Related papers  (2025-09-23T08:45:07Z)
• IoTFuzzSentry: A Protocol Guided Mutation Based Fuzzer for Automatic Vulnerability Testing in Commercial IoT Devices [1.5970777144214099]
  We present a mutation-based fuzzing tool, named IoTFuzzSentry, to identify specific non-trivial vulnerabilities in commercial IoT devices.<n>We show how these vulnerabilities can be exploited in real-world scenarios.<n>We have responsibly disclosed all these vulnerabilities to the respective vendors.
  arXiv  Detail & Related papers  (2025-09-11T05:40:18Z)
• Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway [45.70482328441101]
  This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic by analyzing network behavior at the edge.<n>We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic.<n>This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.
  arXiv  Detail & Related papers  (2025-04-22T09:40:05Z)
• Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures [47.435076500269545]
  Apache Log4J was found to be vulnerable to remote code execution attacks. More than 35,000 packages were forced to update their Log4J libraries with the latest version. It is practically reasonable for software developers to update their third-party libraries whenever the software vendors have released a vulnerable-free version.
  arXiv  Detail & Related papers  (2024-11-12T01:55:51Z)
• AutoFirm: Automatically Identifying Reused Libraries inside IoT Firmware at Large-Scale [13.107464371236148]
  Developers often reuse software libraries in the Internet of Things (IoT) firmware, leading to a major security concern. We propose the AutoFirm, an automated tool for detecting reused libraries in IoT firmware at a large scale. We conduct a large-scale empirical study of reused libraries of IoT firmware, investigating more than 6,900+ firmware and 2,700+ distinct vulnerabilities affecting 11,300+ vulnerable versions from 349 open-source software libraries.
  arXiv  Detail & Related papers  (2024-06-18T09:22:32Z)
• Is Your Kettle Smarter Than a Hacker? A Scalable Tool for Assessing Replay Attack Vulnerabilities on Consumer IoT Devices [1.5612101323427952]
  ENISA and NIST security guidelines emphasize the importance of enabling default local communication for safety and reliability. We propose a tool, named REPLIOT, able to test whether a replay attack is successful or not, without prior knowledge of the target devices. We find that 75% of the remaining devices are vulnerable to replay attacks with REPLIOT having a detection accuracy of 0.98-1.
  arXiv  Detail & Related papers  (2024-01-22T18:24:41Z)
• Finding Vulnerabilities in Mobile Application APIs: A Modular Programmatic Approach [0.0]
  Application Programming Interfaces (APIs) are becoming increasingly popular to transfer data in a variety of mobile applications. These APIs often process sensitive user information through their endpoints, which are potentially exploitable due to developer mis implementation. This paper created a custom, modular endpoint vulnerability detection tool to analyze information leakage in various mobile Android applications.
  arXiv  Detail & Related papers  (2023-10-22T00:08:51Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• Analyzing Maintenance Activities of Software Libraries [55.2480439325792]
  Industrial applications heavily integrate open-source software libraries nowadays.<n>I want to introduce an automatic monitoring approach for industrial applications to identify open-source dependencies that show negative signs regarding their current or future maintenance activities.
  arXiv  Detail & Related papers  (2023-06-09T16:51:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.