Hackers Are Hurting the Internet of Things in More Ways Than You Think by David D Geer

1. Hackers Are Hurting the Internet of Things in More Ways Than You Think By David D. Geer Summary: The Internet of Things (IoT) has connected hospitals, factories, cities, and homes—but it has also created billions of new entry points for hackers. In 2025, IoT breaches surged, and every insecure sensor or smart device now represents a liability waiting for threat actors to exploit it. A growing and fragile ecosystem The world now runs on connected devices. Industry analysts estimate that more than eighteen billion IoT endpoints—cameras, thermostats, production robots, medical monitors, and vehicles—are active today. Each one is a potential target. Nearly forty percent of companies surveyed in 2025 admitted to at least one IoT‑related breach, according to recent global threat indices. The reason is simple: most vendors built IoT devices for function, not defense. Manufacturers often ship them with weak or default passwords, outdated firmware, and minimal patch support. Even when patches exist, many devices cannot be updated remotely, leaving vulnerabilities permanently exposed. Once attackers compromise a single device, they can often pivot to the entire corporate network. From nuisance to national threat The first wave of IoT abuse revolved around large‑scale botnets used to conduct distributed denial‑of‑service attacks. The 2025 BadBox 2.0 botnet compromised over 10 million vulnerable internet-connected devices. The new generation of IoT attacks is more insidious. Hackers now embed themselves invisibly in connected ecosystems. Through supply‑chain manipulation, they infiltrate firmware at the factory level or hide malware in legitimate updates. Attackers can then exfiltrate sensor data, audio feeds, or video streams, or use devices as covert jump points to higher‑value

2. systems. In healthcare, compromised infusion pumps and patient monitors have already triggered data exposures and, in a few incidents, forced emergency shutdowns. Industrial IoT under siege The rise of the Industrial Internet of Things (IIoT) has made manufacturing, transportation, and energy sectors primary targets. Connected valves, controllers, and predictive‑maintenance sensors provide efficiency but also open a digital gateway to physical operations. State‑sponsored and criminal groups have attacked electrical grids, water plants, and logistics systems to create disruption or political leverage. Many critical‑infrastructure incidents in 2025 originated through IIoT exploitation. Even a minor configuration error or exposed maintenance port can allow an attacker to alter readings or issue rogue commands. When someone falsifies industrial control data, operators may make harmful decisions, halting production, misallocating resources, or, in severe cases, causing safety incidents. As more factories adopt smart systems, the line between IT and operational technology security grows dangerously thin. Third‑party blind spots Many IoT breaches emerge not from internal oversight but from vendor negligence. Contractors, service providers, or device suppliers often integrate networked gear without following the organization’s security policy. Attackers track these weak links using search tools that locate live IoT nodes across the internet, complete with software version details and known vulnerabilities. Organizations must therefore hold suppliers to measurable standards. Enforcing baseline encryption, strong authentication, and prompt patch distribution for all devices connecting to enterprise networks is now as vital as employee background screening. If vendors cannot certify compliance, their devices should remain isolated in segmented networks or sandboxes. Preventive architecture and monitoring

3. Protecting IoT begins with visibility. Companies must know which devices they own, where they operate, and which networks they touch. This inventory becomes the foundation for segmentation—separating IoT traffic from sensitive applications and data. AI‑driven monitoring tools can identify anomalies such as irregular transmission intervals, traffic spikes, or unauthorized firmware changes. These indicators often reveal infiltration long before data theft or sabotage occurs. Encryption of data in motion and at rest ensures that intercepted signals remain unreadable, even when eavesdroppers capture communication streams. Organizations should enforce regular patch cycles, risk‑based endpoint grouping, and password rotations through centralized management platforms. Automated updates or over‑the‑air patching eliminate many of the maintenance gaps that make IoT exploitation so attractive. What forward‑thinking organizations do next Leading enterprises now integrate IoT security into their overall risk strategy rather than treating it as an afterthought. Recommended actions include: Conduct quarterly audits of all connected assets and firmware versions. Deploy network segmentation policies that prevent lateral movement. Replace obsolete devices that cannot receive modern encryption. Require vendors to disclose vulnerabilities within fixed timeframes. Educate employees on how the misuse of IoT can impact brand trust and physical safety. The bottom line Every connected device is both a convenience and a conduit. While IoT technology powers global efficiency and insight, it also amplifies the reach of

4. cybercrime. The path forward lies in treating device security as inseparable from enterprise resilience. Analysts expect the installed base of connected devices to exceed 70 billion by 2026, including industrial, medical, and building systems. Securing this expanding and complex “extended IoT” landscape is significantly hindered by a talent gap.