Your smart thermostat, security camera, NAS drive, and Wi-Fi router all share something in common: they run embedded operating systems, connect to the internet 24/7, and receive security updates far less frequently than your laptop or phone. The global IoT device count exceeded 17 billion in 2025. Each of those devices is a potential entry point into your network — and attackers know it.
Why IoT Security Is So Bad
The IoT security problem has structural roots:
- Low-cost hardware leaves little room for security features or processing power for encryption
- Embedded Linux distributions are often outdated at the time of shipping — sometimes using kernels from 2019 on devices sold in 2025
- No auto-update mechanisms — many devices require manual firmware updates that users never apply
- Default credentials that ship the same across millions of units
- No security testing requirements — until recently, there were no mandatory baseline standards for consumer IoT security
- Long deployment lifetimes — industrial IoT and building management systems often run for 10–20 years
The Biggest IoT Threats in 2026
IoT Botnets
Mirai (2016) was the watershed moment — a botnet of 600,000 compromised cameras and routers took down Dyn DNS, knocking offline Twitter, Netflix, and Reddit for hours. Mirai’s source code was released publicly, spawning dozens of variants.
By 2026, the landscape includes:
- Mirai variants (Moobot, Satori, Echobot) that target hundreds of different device types
- Raptor Train — a Chinese state-sponsored botnet discovered in 2024 with over 200,000 compromised SOHO routers
- KV-Botnet — attributed to Volt Typhoon, targeting Cisco RV, Netgear ProSAFE, and Fortinet devices
These botnets are used for DDoS attacks, proxying malicious traffic, and as staging infrastructure for nation-state operations.
Credential Attacks on IoT Management Interfaces
Web-based management interfaces for routers, cameras, and NAS devices are frequent targets. Attack techniques include:
- Credential stuffing using the Mirai-style database of default username/password combinations
- Brute force against Telnet (port 23), SSH (port 22), and HTTP management panels
- CSRF attacks — tricking authenticated administrators into clicking malicious links that change settings
The Shodan search engine indexes millions of internet-facing management interfaces. Attackers use Shodan queries like product:"Hikvision" port:8080 to find thousands of cameras with exposed management panels.
Firmware Vulnerabilities
IoT firmware frequently contains:
- Hardcoded credentials — backdoor accounts compiled into the firmware image
- Buffer overflow vulnerabilities in network-facing services (telnetd, httpd, upnpd)
- Outdated libraries — embedded copies of OpenSSL, BusyBox, or uClibc with known CVEs
The Forescout AMNESIA:33 research (2020) found 33 vulnerabilities in four popular open-source TCP/IP stacks used in millions of IoT devices. These are the kinds of bugs that never get patched because the device manufacturer goes out of business or simply stops maintaining firmware.
Privacy Violations via Compromised IoT
Security cameras, baby monitors, and smart speakers are particularly sensitive:
- Ring and Wyze camera breaches demonstrated how attackers gain unauthorized access to home security feeds
- Smart TVs with embedded microphones can be turned into listening devices
- Medical IoT — pacemakers, insulin pumps, and hospital equipment running outdated firmware are attacked for espionage or to extort healthcare providers
Supply Chain Attacks on IoT Devices
Some IoT devices ship with malware pre-installed. The BadBox campaign (discovered 2023–2024) infected millions of off-brand Android TV boxes and tablets at the factory with the Triada backdoor. By the time consumers bought these devices, they were already reporting to command-and-control servers in China.
How to Secure Your IoT Devices
1. Network Segmentation — The Single Most Effective Control
Your IoT devices should be on a separate network — a VLAN or IoT SSID — that cannot reach your computers, NAS, or other sensitive devices. Even if your security camera is compromised, it cannot pivot to your desktop or steal your files.
On consumer routers (Asus, Netgear, TP-Link), this is often called a “Guest Network” or “IoT Network.” On prosumer equipment like pfSense, OPNsense, or Ubiquiti UniFi, configure a dedicated VLAN:
# OPNsense: Interfaces > Assignments > Add new VLAN
# Assign VLAN 20 for IoT, restrict inter-VLAN routing in firewall rules
# Block IoT VLAN from reaching LAN (trusted devices):
Action: Block | Interface: IoT_VLAN | Source: IoT_net | Destination: LAN_netThe IoT VLAN should have internet access but no lateral connectivity to other VLANs.
2. Change Default Credentials
Every device — router, camera, NAS, smart switch — must have its default credentials changed on first boot. Use a password manager to generate and store unique, complex passwords for each device.
Default credential databases like RouterSploit contain credentials for thousands of device models. If your device is still using the default password, it is effectively already compromised.
3. Keep Firmware Updated
- Enable auto-updates where available
- Check manufacturer websites monthly for firmware releases for critical devices (router, NAS, cameras)
- Subscribe to CVE notifications for your device models via NIST NVD or Vulmon
- If a device has not received a firmware update in over a year and it is internet-facing, consider replacing it
4. Disable Unnecessary Services
IoT devices often run more services than needed:
# Check what services are running on a device (if it has a CLI)
netstat -tlnp
# Or use nmap from another device on the network
nmap -sV -p 1-65535 192.168.20.xCommon services to disable if unused:
- Telnet (port 23) — unencrypted, always disable
- UPnP — allows devices to punch holes in your router firewall automatically
- Remote management from the WAN side
- mDNS/Bonjour if cross-network discovery is not needed
5. Use a DNS Firewall to Block Malicious Outbound Traffic
A DNS firewall can block compromised IoT devices from reaching botnet C2 servers. Set your IoT VLAN’s DNS to Quad9 (9.9.9.9) or configure Pi-hole with threat intelligence feeds:
# Add a blocklist to Pi-hole for IoT-specific malicious domains
# In Pi-hole Admin > Adlists, add:
# https://raw.githubusercontent.com/nicehash/NiceHashQuickMiner/main/blocklists/iot-malicious.txt6. Disable UPnP on Your Router
Universal Plug and Play lets IoT devices automatically configure port forwarding on your router. This is convenient but dangerous — malware on any device can use UPnP to open inbound ports without your knowledge.
Disable UPnP in your router’s administration interface. Manually configure any port forwarding you actually need.
7. Use a Dedicated Threat Intelligence Feed for IoT
Shodan Monitor alerts you when your public IP addresses expose services. Set up monitoring for your home or business public IP to be notified if an IoT device becomes internet-facing unexpectedly.
IoT Security Standards in 2026
The regulatory landscape is improving:
- UK PSTI Act (2024) — manufacturers must not use universal default passwords, must publish vulnerability disclosure policies, and must state how long they will support devices with security updates
- EU Cyber Resilience Act (2027 enforcement) — mandatory security requirements for all connected products sold in the EU
- US IoT Cybersecurity Improvement Act — NIST guidelines for federal agency IoT procurement, increasingly adopted by enterprise buyers
Look for devices that comply with ETSI EN 303 645 — the European IoT security standard — as a baseline quality indicator.
Quick Checklist: IoT Security Essentials
| Action | Done? |
|---|---|
| IoT devices on separate VLAN/network | |
| Default credentials changed on all devices | |
| Firmware updated to latest version | |
| Telnet and UPnP disabled | |
| WAN-side management access disabled | |
| DNS filtering enabled for IoT network | |
| Shodan Monitor set up for your public IP | |
| Quarterly firmware check scheduled |
Conclusion
IoT security is not glamorous, but neglecting it hands attackers a persistent foothold inside your network that bypasses every perimeter control you have built. Network segmentation alone eliminates the most dangerous consequence of a compromised device — lateral movement. Combine that with firmware hygiene, credential management, and service hardening, and your IoT devices go from easy targets to hardened endpoints. The effort is modest; the payoff is substantial.