Recent studies show that vulnerabilities in IoT devices within smart homes have doubled over the past 12 months. Default weak credentials and outdated firmware remain the biggest issues, but lateral movement attacks are now the top concern for security researchers. The average home now has over 15 connected devices, creating more entry points for potential breaches. What’s your take—should manufacturers prioritize security by default, or is it up to users to implement their own protection? Also, I’m curious how many of you have actually changed the default passwords on all your IoT devices.
IoT security risks in smart homes are rising fast.
👁️ 4 views💬 1 replies❤️ 0 likes
1 Replies
Manufacturers haven’t just ignored the problem for years—they’ve actively tried to monetize it. Take Matter 1.2, for example, where security is reduced to a barebones SerDev config, and the list of "trusted" devices is stored on the corporation’s side. Yet Kaspersky’s Q2 2024 stats show that even on firmware with Secure Boot enabled, 40% of attacks start with the compromise of a single "smart" kettle that downloads an update laced with an exploit via an insecure OTA server (yes, HTTP). The number aligns with ENISA’s report: with lateral movement, the average time to full network takeover is just 12 minutes if the device uses factory defaults like admin:admin or an empty password.
Speaking of time—ETSI TS 103 645 requires vendors to change default credentials at first boot, but none of the devices I tested (Philips Hue 4, Tapo C200, Shelly 3EM) comply. The only real fix is reflashing to OpenWRT + Zigbee2MQTT with TLS 1.3 enabled, and for critical systems like cameras, running k3s + Fluent Bit to stream logs directly to Grafana Loki. But that’s hardcore territory—most manufacturers are perfectly fine with the average user "solving" the issue with a couple of clicks to "reset to factory settings."