Millions of Abandoned IoT Apps Leak Sensitive Data to Broken Servers
Researchers found that nearly 75% of abandoned Android IoT companion apps contain vulnerable dependencies and transmit sensitive user data to defunct or insecure servers.
Millions of users remain reliant on outdated Internet of Things (IoT) companion apps, many of which have not received updates in years, creating significant security and privacy risks. A recent study by the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT apps and revealed a startling statistic: nearly three-quarters of these applications contained software dependencies with documented vulnerabilities.
The research team sourced its data from AndroZoo, a vast repository of Android applications, and filtered for apps specifically designed to control IoT devices. An app was classified as abandoned if it had not been updated for at least two years or had been removed from the Google Play Store by March 2025. The majority of these apps had been entirely delisted, while a smaller portion remained accessible but untouched by developers for extended periods.
This abandonment is particularly concerning given the long lifespan of IoT devices, which users often expect to function for around a decade. Vendor support for companion applications, however, rarely matches this longevity. Consequently, users are left managing sensitive IoT data through unmaintained or delisted applications, dramatically increasing their exposure to security threats. The study noted that many of these abandoned apps had accumulated millions of downloads before development ceased.
The analysis uncovered that most of these outdated apps bundle software libraries associated with known vulnerabilities, many of which are classified as high severity. Furthermore, the app code contained thousands of hard-coded web addresses. Approximately a quarter of these unique domains no longer resolve, and every app exhibited at least one fully qualified domain name (FQDN) that failed DNS reachability tests, suggesting a widespread issue with defunct infrastructure.
These abandoned applications serve as persistent attack vectors. Unlike maintained apps that can react to endpoint failures, unmaintained ones cannot. A review of domain registration history revealed that a notable portion of still-active domains had changed ownership since the app's last update, impacting over 2,000 applications. A separate scan matched hundreds of extracted web addresses against threat intelligence blocklists, identifying links associated with phishing, scams, spyware, and malware. Alarmingly, over two-thirds of the analyzed apps contained at least one blocklisted domain.
The data collected by these apps often includes sensitive information, as they frequently request permissions for external storage access, precise location, and camera usage. This data is primarily transmitted over Wi-Fi. The study highlighted a critical gap: 38.4% of unique data-flow sources and sinks in abandoned apps were linked to domains classified as unreachable, blocklisted, or under changed ownership. In stark contrast, less than 1% of actively maintained IoT apps exhibited similar issues.
While the use of outdated cryptography algorithms like DES, MD5, or RC4 was found to be more prevalent in actively maintained apps, the core issue of data transmission to insecure endpoints remains a significant problem for abandoned applications. Researchers attempted to notify developers of thousands of apps, but nearly one in five emails bounced. Of the replies received, some vendors removed their apps, others disputed the findings, and a few acknowledged the issues and committed to fixes.
Ultimately, the research underscores a critical disconnect between the expected lifespan of IoT devices and the maintenance commitment for their accompanying software. The widespread use of vulnerable dependencies and the transmission of sensitive data to defunct or compromised servers by abandoned IoT apps present a clear and present danger to user privacy and security.