All Things Considered: An Analysis of IoT Devices on Home Networks
Deepak Kumar‡ Kelly Shen† Benton Case† Deepali Garg/
Galina Alperovich/ Dmitry Kuznetsov/ Rajarshi Gupta/ Zakir Durumeric†† Stanford University/ Avast Software‡ University of Illinois Urbana-Champaign

Abstract

vulnerabilities. Leveraging data collected from user-initiatednetwork scans in 16M households that have agreed to sharedata for research and development purposes, we describe thecurrent landscape of IoT devices and their security posture.
IoT devices are widespread. More than half of households
have at least one IoT device in three global regions and in
North America more than 66% of homes have a networkconnected device. Media devices like smart televisions aremost common in seven of eleven global regions, but there
is significant variance otherwise. For example, surveillancecameras are most popular in South and Southeast Asia, while
work appliances prevail in East Asia and Sub-Saharan Africa.
Home assistants are present in 10% of homes in North America but have yet to see significant adoption in other markets.
There is a long tail of 14K total manufacturers, but surprisingly we find that 90% of devices worldwide are produced
by only 100 vendors. A handful of companies like Apple,
HP, and Samsung dominate globally, but there also exist a
set of smaller vendors with significant regional adoption. For
example, Vestel, a Turkish manufacturer, is the third largest
media vendor in North Africa and the Middle East, but has
negligible broader adoption.
A surprising number of devices still support FTP and Telnet
with weak credentials. In Sub-Saharan Africa, North Africa,
the Middle East, and Southeast Asia, around half of devices
support FTP and in Central Asia, nearly 40% of home routers
use Telnet. Similar to the regional differences in device typeand manufacturer popularity, there are dramatic differencesin the use of weak credentials. For example, while less than
15% of devices with FTP allow weak authentication in Europe and Oceania, more than half do in Southeast Asia and
Sub-Saharan Africa. Interestingly, this is not entirely due tomanufacturer preference. While less than 20% of TP-Link
home routers allow access to their administration interface
with a weak password in North America, nearly half do in
Eastern Europe, Central Asia, and Southeast Asia. About 3%of homes in our dataset are externally visible and more thanhalf of those have a known vulnerability or weak password.
Our results indicate that IoT is not a security concern of the

In this paper, we provide the first large-scale empirical analysis of IoT devices in real-world homes by leveraging datacollected from user-initiated network scans of 83M devices
in 16M households. We find that IoT adoption is widespread:on several continents, more than half of households alreadyhave at least one IoT device. Device types and manufacturer popularity vary dramatically across regions. For example, while nearly half of North American homes have anInternet-connected television or streaming device, less than
three percent do in South Asia where the majority of devices
are surveillance cameras. We investigate the security postureof devices, detailing their open services, weak default credentials, and vulnerability to known attacks. Device security
similarly varies geographically, even for specific manufacturers. For example, while less than 17% of TP-Link homerouters in North America have guessable passwords, nearly
half do in Eastern Europe and Central Asia. We argue that
IoT devices are here, but for most homes, the types of devices
adopted are not the ones actively discussed. We hope thatby shedding light on this complex ecosystem, we help thesecurity community develop solutions that are applicable totoday’s homes.

1

Introduction

The weak security posture of many popular IoT devices
has enabled attackers to launch record-breaking DDoS attacks [4], compromise local networks [43, 57], and break into
homes [22, 41]. However, despite much attention to IoT in
the security community [22, 23, 29, 33, 55], there has been
little investigation into what devices consumers are adopting
and how they are configured in practice. In this work, we
provide a large-scale empirical analysis of 83M IoT devices
in 16M real-world homes. We partner with Avast Software,a popular antivirus company, whose consumer security software lets customers scan their local network for IoT devices
that support weak authentication or have remotely exploitable1

(a) Data Sharing Consent(b) WiFi Inspector Drawer(c) WiFi Inspector Initiation

Figure 1: WiFi Inspector—WiFi Inspector allows users to scan their local network for insecure IoT devices. Data sharing backto Avast for research purposes is an explicit part of the installation process, and presented to the user in plain English. For ease ofreading, we duplicate the text shown in panel (a) in Appendix A.
Network Scanning To inventory the local network, WiFi
Inspector first generates a list of scan candidates from entries
in the local ARP table as well through active ARP, SSDP, andmDNS scans. It then probes targets in increasing IP order
over ICMP and common TCP/UDP ports to detect listening
services.1 Scans terminate after the local network has beenscanned or a timeout occurs. After the discovery processcompletes, the scanner attempts to gather application layer
data (e.g., HTTP root page, UPnP root device description,
and Telnet banner) from listening services.

future, but rather one of today. We argue that there alreadyexists a complex ecosystem of Internet-connected embedded
devices in homes worldwide, but that these devices are different than the ones considered by most recent work. We hopethat by shedding light on the devices consumers are purchasing, we enable the security community to develop solutions
that are applicable to today’s homes.

2

Methodology and Dataset

Our study leverages several network vantage points, including
data collected from Avast, a passive network telescope, andactive Internet-wide scans. In this section, we discuss thesedatasets and the role they play in our analysis.

2.1

Detecting Device Types To provide users with a humanreadable list of hosts on their network, WiFi Inspector runs aclassification algorithm against the application-and transportlayer data collected in the scan. This algorithm buckets devices into one of fourteen categories:

WiFi Inspector

1. Computer
2. Network Node (e.g., home router)
3. Mobile Device (e.g., iPhone or Android)

Avast Software is a security software company that provides
a suite of popular antivirus and consumer security software
products like Avast Free Antivirus. Avast software is sold ona freemium model: the company provides a free basic versionof their product and charges for more advanced versions.
Avast estimates that their software runs on 160 M Windows
and 3 M Mac OS computers, and makes up approximately
12% of the antivirus market share [45].
As of 2015, all antivirus products from Avast include atool called WiFi Inspector that helps users secure IoT devices
and other computers on their home networks. WiFi Inspector
runs locally on the user’s personal computer and performs
network scans of the local subnet to check for devices
that accept weak credentials or have remotely exploitable
vulnerabilities. Scans can also be manually initiated by theend user. WiFi Inspector alerts users to security problems
it finds during these scans and additionally provides aninventory of labeled IoT devices and vulnerabilities in the
product’s main interface (Figure 1). We next describe how
WiFi Inspector operates:

4. Wearable (e.g., Fitbit, Apple Watch)
5. Game Console (e.g., XBox)
6. Home Automation (e.g., Nest Thermostat)
7. Storage (e.g., home NAS)
8. Surveillance (e.g., IP camera)
9. Work Appliance (e.g., printer or scanner)
10. Home Voice Assistant (e.g., Alexa)
11. Vehicle (e.g., Tesla)
12. Media/TV (e.g., Roku)
13. Home Appliance (e.g., smart fridge)
14. Generic IoT (e.g., toothbrush)
1 WiFi Inspector scans several groups of TCP/UDP ports: common TCP
ports (e.g., 80, 443, 139, 445); TCP ports associated with security problems(e.g., 111, 135, 161); common UDP ports (e.g., 53, 67, 69); and ports
associated with services that provide data for device labeling (e.g., 20, 21,
22). When hosts are timely in responding, the scanner will additionally probea second set of less common ports (e.g., 81–85, 9971). In total, the scanner
will target up to 200 ports depending on host performance. The scanner will
identify devices so long as they are connected to the network.

2

Protocol

Field

Search PatternDevice Type Label

Confidence

DHCP
UPnP
HTTP
mDNS

Class ID
Device Type
Title
Name

(?i)SAMSUNG[- :_]Network[- :_]Printer.*hub2.*(?i)Polycom - (?:SoundPoint IP )?(?:SoundStation IP )?
(?i)_nanoleaf(?:api|ms)?\._tcp\.local\.

Printer
IoT Hub
IP PhoneLighting

0.90
0.90
0.85
0.90

Table 1: Example Device Classification Rules—Our device labeling algorithm combines a collection of 1,000 expert rules anda supervised classifier, both of which utilize network and application layer data. Here, we show a few examples of these expert
rules, which provide 60% coverage of devices in a random sample of 1,000 devices.
We consider devices in the latter eleven categories to be IoT
devices for the remainder of this work. Because the classifier greatly affects the results of this work, we describe thealgorithm in detail in Section 2.2.

scribe the algorithm that Avast has developed in this section:
Classifier WiFi Inspector labels device type (e.g., computer, phone, game console) through a set of expert rules
and a supervised classification algorithm, both of which run
against network and application layer data. Classification istypically possible because manufacturers often include model
information in web administration interfaces as well as in FTP
and Telnet banners [4]. Additionally, devices broadcast device details over UPnP and mDNS [14]. WiFi Inspector uses
expert rules—regular expressions that parse out simple fields(e.g., telnet banner or HTML title)— to label hosts that follow
informal standard practices for announcing their manufacturer
and model. This approach, while not comprehensive, reliably
identifies common devices [4, 21]. WiFi Inspector contains
approximately 1,000 expert rules that are able to identify devices from around 200 manufacturers. We show a sample ofthese rules in Table 1. However, these rules only identify 60%
of devices from a random sample of 1,000 manually-labeleddevices. To categorize the remaining devices, WiFi Inspector
leverages an ensemble of four supervised learning classifiers
that individually classify devices using network layer-data,
UPnP responses, mDNS responses, and HTTP data. Therefore, when identifying a device, WiFi Inspector first tries theexpert rules, and in the case of no match, next applies theensemble of four supervised classifiers.
The network classifier is built using a random forest, which
aggregates the following network features of a device:
1. MAC address
2. Local IP address
3. Listening services (i.e., port and protocol)
4. Application-layer responses on each port
5. DHCP class_id and hostname
The UPnP, mDNS and HTTP classifiers leverage raw text
responses. The classifier treats each response as a bag-ofwords representation, and uses TF-IDF to weight words acrossall responses. This representation is fed as input to a Naïve
Bayes classifier.

Manufacturer Labeling To generate a full device label,
WiFi Inspector combines device type with the device’s manufacturer (e.g., Nintendo Game Console). Avast determines
manufacturer by looking up the first 24 bits of each device’s
MAC address in the public IEEE Organizationally Unique
Identifier (OUI) registry [32]. We note that at times, the vendor associated with a MAC address is the manufacturer ofthe network interface rather than the device. For example,
MAC addresses associated with some Sony Playstations belong to either FoxConn or AzureWave, two major electronic
component manufacturers, rather than Sony. In this work,
we manually resolve and document any cases that required
grouping manufacturers together.
Checking Weak Credentials WiFi Inspector checks fordevices that allow authentication using weak credentials byperforming a dictionary-based attack against FTP and Telnet
services as well as web interfaces that use HTTP basic authentication. When possible, WiFi Inspector will also try to log
into HTTP-based administration interfaces that it recognizes.
The scanner attempts to log in with around 200 credentials
composed of known defaults (e.g., admin/admin) and commonly used strings (e.g., user, 1234, love) from password
popularity lists, leaks, vendor and ISP default lists, and passwords checked by IoT malware. WiFi Inspector immediately
notifies users about devices with guessable logins.
Checking Common Vulnerabilities In addition to checking for weak credentials, WiFi Inspector checks devices forvulnerability to around 50 recent exploits that can be verified
without harming target devices (e.g., CVE-2018-10561, CVE2017-14413, EDB-ID-40500, ZSL-2014-5208, and NON2015-0211). Because there is bias towards more popular
manufacturers in these scans, we do not provide ecosystemlevel comparisons between different vulnerabilities.

2.2

Training and Evaluation To train the supervised algorithm, Avast collected data on approximately 500K random
devices from real-world scans. 200K of these were manually classified through an iterative clustering/labeling process,where experts clustered devices based on network properties

Device Identification Algorithm

A significant portion of our work is based on identifying the
manufacturers and types of IoT devices in homes. We de3

Classifier

Coverage

Accuracy

Macro F1

Supervised Ensemble
Network
UPnP
mDNS
HTTP

0.91
0.89
0.27
0.05
0.14

0.95
0.96
0.91
0.94
0.98

0.78
0.79
0.37
0.25
0.23

Final Classifier

0.92

0.96

0.80

time. We worked with Avast to analyze aggregate data about
the types of devices in each region. No individual records
or personally identifiable information was shared with our
team. Although WiFi Inspector supports automatic vulnerability scans, we only use data from user-initiated scans in thispaper so that we can guarantee that users knowingly scanned
their networks. In addition, we exclude scans of public networks by only analyzing networks that were marked as home
networks in Windows during network setup. We detail the
ethical considerations and our safeguards in Section 2.6.
We specifically analyze data about devices found in scansrun between December 1–31, 2018 on Windows installations.
This dataset consists of data about 83 M devices from 15.5 M
homes spanning 241 countries and territories, and 14.3 K
unique manufacturers. For installations with multiple scans
during this time period, we use the latest scan that found the
maximum number of devices. We aggregate each country
into 11 regions, defined by ISO 3166-2 [56]. As shown in
Table 3, WiFi Inspector is more popular in Europe and SouthAmerica than in North America. Because of this market share,
as well as significant regional differences in IoT deployment,
we discuss regions separately.

Table 2: Device Classifier Performance—Our final classifier combines the supervised classifier and expert rules, andachieves 92% coverage and 96% accuracy against a manuallylabeled set of 1,000 devices.
Region
North America
South America
Eastern Europe
Western Europe
East Asia
Central Asia
Southeast Asia
South Asia
N. Africa, Middle East
Oceania
Sub-Saharan AfricaHomes1.24 M
3.2 M
4.2 M
2.9 M
543 K
107 K
813 K
824 K
1.2 M
124 K
266 K

(8.0%)(20.9%)(27.2%)(19.1%)(3.5%)(0.7%)(5.3%)(5.3%)(7.5%)(0.8%)(1.7%)

Devices
9.2 M
18 M
18.8 M
15 M
3M
500 K
3.6 M
6.6 M
6.1 M
680 K
1.8 M

(11.1%)(21.6%)(22.6%)(18.0%)(3.7%)(0.6%)(4.3%)(7.7%)(7.3%)(0.8%)(2.2%)

Threats to Validity While WiFi Inspector is installed in asignificant number of homes, the dataset is likely colored byseveral biases. First, the data is predicated on users installing
antivirus software on their computers. There is little work thatindicates whether users with antivirus software have more orless secure practices. Second, we only analyzed data from installations on Windows machines due to differences between
Mac and Windows versions of the software. This may skew
the households we study to different socioeconomic groups
or introduce other biases. Third, WiFi Inspector actively notifies users about problems it finds. As a result, users may
have patched vulnerable hosts, changed default passwords, or
returned devices to their place of purchase. This may skew
our results to indicate that homes included in this study are
more secure than in practice.

Table 3:
Regional Distribution of Homes—The
15.5M homes and 83M devices in our dataset are fromgeographically diverse regions. Because this breakdown
is representative of Avast market share rather than organic
density of homes and devices, we limit our analysis to within
individual regions.

and labeled large clusters, winnowing and re-clustering until
all devices were labeled. The remaining 300K devices werelabeled using the expert rules. To tune model parameters,
we performed five-fold cross-validation across the original
training set. However, because the initial clustering was used
to help identify devices in the clustering/labeling step, thedataset is not used for validation. Instead, Avast curated avalidation set of 1,000 manually labeled devices, whose labels were never used for training. The final classifier achieves
96% accuracy and 92% coverage with a 0.80 macro average
F1 score (Table 2). We mark devices we cannot classify as“unknown”.

2.3

2.4

Network Telescope

While WiFi Inspector scans can identify the types of devices
present in home networks, the data does not provide any
insight into whether devices have been compromised. To
understand whether devices are infected and scanning to compromise other devices (e.g., as was seen for Mirai [4]), we
consider the IP addresses scanning in a large network telescope composed of approximately 4.7 million IP addresses.
We specifically analyze the traffic for a 24 hour period on
January 1, 2019 for scan activity using the methodology discussed by Durumeric et al. [17]: we consider an IP address tobe scanning if it contacts at least 25 unique addresses in ourtelescope on the same port within a 480 second window. In
total, we observe 1.7 M scans from a total of 529 K unique IP
addresses from 1.4 billion packets during our measurement

Avast Dataset

Avast collects aggregate data about devices, vulnerabilities,
and weak credentials from WiFi Inspector installations of consenting users for research and development purposes. Users
are informed about this data collection in simple English
when they install the product (Figure 1) and can opt out at any
4period. Of the 500,716 homes scanned by WiFi Inspector on
this day, 1,865 (0.37%) were found scanning on the network
telescope.

0.8
CDF Fraction Homes

2.5

1
0.9

Internet-Wide Scanning

0.7
Central and South America
Central Asia
Eastern and Southern Europe
Eastern Asia
North Africa and Middle East
Northern America
OceaniaSoutheastern Asia
Southern Asia
Sub-Saharan Africa
Western and Northern Europe

0.6
0.5
0.4
0.3
0.2

We further augment the WiFi Inspector data with data collected from Internet-wide scans performed by Censys [16] tounderstand whether the vulnerabilities present on gateways(i.e., home routers) could be remotely exploitable. Similarly
to our network telescope data, we investigate the intersection between Censys and Avast data for a 24-hour period on
January 30, 2019 to control for potential DHCP churn. We
also check whether devices that accept weak credentials forauthentication present login interfaces on public IP addresses.
We discuss the results in Section 4.

2.6

0.1
0
1

10
Number of Hosts in Home

100

Figure 2: Devices per Region—There is significant variancein device usage across regions. The largest presence is in
North America, where homes have a median seven hosts.
Conversely, homes in South Asia have a median two hosts.
The number of devices per home starts at two as all homes
require at least one computer and one router to be included.
collected when explicitly necessary for the security functionof the product.

Ethical Considerations

WiFi Inspector collects data from inside users’ homes. To
ensure that this data is collected in line with user expectations, we only collect statistics about homes where the user
explicitly agreed to share data for research purposes. Thisdata sharing agreement is not hidden in a EULA, but outlined in simple English. We show the dialogue where users
acknowledge this in Figure 1. We note that this is an explicit
opt-out process. The data sharing agreement is the last message shown to the user before the main menu, meaning users
do not need to wait and remember to turn off data collection
at a later time.
In order to keep up to date information on the devices
in a home, WiFi Inspector runs periodic, automated scansof the local network. Automated scans do not perform any
vulnerability testing or password weakness checks; they only
identify devices through banners and MAC addresses. We
limit our analysis to homes where a user explicitly manually
initiated a network scan.
To protect user privacy and minimize risk to users, Avast
only shared aggregate data with our team. This data wasaggregated by device manufacturer, region, and device type.
The smallest region contained over 100,000 homes. We never
had access to data about individual homes or users; no personally identifiable information was ever shared with us. Avast
did not collect any additional data for this work, nor did theychange the retention period of any raw data. No data beyond
the aggregates in this paper will be stored long term.
Internally, Avast adheres to a strict privacy policy: all data
is anonymized and no personally identifiable information isever shared with external researchers. All handling of WiFi
Inspector data satisfies personal data protection laws, such
as GDPR, and extends to data beyond its territorial scope(i.e., outside of the European Union). Specific identifiers likeIP addresses are deleted in accordance with GDPR and only

3

IoT in Homes

It is vital that the security community understands the typesof IoT devices that consumers install and their respective
regional distributions given their increasing security and privacy implications. In this section, we provide one of firstlarge-scale analyses of these devices based on scans from15.5 M homes.
The presence of IoT devices varies by region. For example,
while more than 65% of homes in North America have an
IoT device, fewer than 10% of homes in South Asia do (Figure 2). Media devices (i.e., smart TVs and streaming devices)
are the most common type of device in seven of the elevenregions, in terms of both presence in homes (2.5%–42.8%)
and total number of devices (16.6%–59.0%). Four regions
differ: surveillance devices are most common in South andSoutheast Asia, while work appliances are most common in
East Asia and Sub-Saharan Africa. We show the most populardevices in each region in Table 4.
Despite differences in IoT popularity across regions, there
are strong correlations between regions for the types of devices that are popular.2 In other words, the most popular typesof devices are similar across regions. Still, certain pairs ofregions differ. For example, homes in all Asian regions areleast similar to homes in North America. On the other hand,homes in geographically similar regions (e.g., South Asia andSoutheastern Asia) are highly correlated, even when they differ from the global distribution. The fact that distinct regions
2 To quantify the preference for difference types of devices across regions,
we leverage a Spearman’s rank correlation test across each pairwise region,
taking the rank ordered list of device types for each region as input (Table 5).
Per Cohen’s guidelines, we find all regions rank ordered distributions arestrongly correlated (>0.7 coefficient) with p-values < 0.05 [11], indicating
little change in the rank order of device type distributions across regions.

5

IoT

Media/TV

Work Appl

RegionHomes Homes Devices

North America
South America
Eastern Europe
Western Europe
East Asia
Central Asia
Southeast Asia
South Asia
N. Africa, M. East
Oceania
Sub-Saharan Africa

66.3%
31.7%
25.2%
53.5%
30.8%
17.3%
21.7%
8.7%
19.1%
49.2%
19.7%

42.8
20.5
16.8
40.2
12.2
13.5
9.0
2.5
9.4
30.7
6.9

GamingVoice Asst.

H

H

D

H

D

H

D

H

D

H

D

H

D

28.0 16.0 12.0 9.5
24.0 4.3 9.8 0.1
23.6 2.7 7.6 0.2
18.9 7.5 9.2 1.8
44.5 6.3 12.1 0.9
12.0 0.6 2.4 0.0
31.2 1.0 2.7 0.2
24.2 0.4 2.4 0.1
26.2 1.8 6.4 0.1
25.9 10.1 12.7 3.2
49.9 2.5 7.1 0.1

7.5
0.3
0.6
2.3
1.6
0.2
0.5
0.8
0.3
4.2
0.4

3.9
4.6
2.5
3.8
2.2
2.4
7.8
4.1
5.2
3.0
2.8

3.7
13.3
14.0
5.6
9.1
30.3
37.0
54.5
28.5
5.3
18.0

2.7
0.3
1.2
2.5
3.1
0.2
0.9
0.2
0.7
3.5
0.8

1.7
0.6
3.4
3.2
6.5
0.8
2.7
1.1
2.4
4.3
2.3

2.3
0.0
0.1
1.3
0.1
0.0
0.1
0.0
0.0
0.7
0.1

1.9
0.1
0.4
1.6
0.2
0.0
0.2
0.2
0.2
0.9
0.3

0.2
0.0
0.0
0.0
0.1
0.0
0.1
0.0
0.0
0.1
0.1

0.1
0.1
0.1
0.0
0.2
0.1
0.3
0.2
0.2
0.2
0.3

0.4
0.1
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0

0.2
0.2
0.0
0.0
0.1
0.0
0.0
0.0
0.1
0.0
0.1

H

44.9
51.7
50.2
59.0
25.8
54.2
25.4
16.6
35.7
46.6
21.7

D

32.7
7.5
6.0
14.0
14.9
1.6
7.5
2.7
5.1
19.8
10.9

D

Surveil.

Storage Automat. Wearable Other IoT

Oceania

S-S Africa

Su
a

st

Ea

ric
Af

id

M

n

d

ra

an

ha

a

ia

Sa

b-

an

ia

pe

ro

a

ic

er

Eu

ia

ric

Af

As

ce
O

N

S

ia

As

As

ia

pe

ro

N

As

+

Eu

SE

C

E

W

E

a

ic

Am

N. Africa, ME

0er

South Asia

20

S

SE Asia

North America
South America
E. Europe
W. Europe
East Asia
Central Asia
Southeast Asia
South Asia
N. Africa, Middle East
Oceania
Sub-Saharan Africa

40+

Central Asia

60

Am

East Asia

Fraction IoT Type

80

C

–
81
88
92
88
76
77
81
87
93
86

81
–
87
85
90
85
88
87
90
90
92

88
87
–
95
95
93
93
94
98
98
96

92
85
95
–
90
88
83
87
92
95
89

88
90
95
90
–
90
93
92
93
98
99

76
85
93
88
90
–
93
90
94
90
93

77
88
93
83
93
93
–
99
95
96
95

81
87
94
87
92
90
99
–
97
92
95

87
90
98
92
93
94
95
97
–
96
95

93
90
98
95
98
90
96
92
96
–
96

86
92
96
89
99
93
95
95
95
96
–

Wearable100

N

W. Europe

Work Appliance
Storage
Voice Assistant

E. Europe

Generic IoTMediaSurveillance

S. America

Game Console
Home ApplianceHome Automation

N. America

Table 4: IoT in Homes—We show the percent of households that have one or more of each type of IoT device and the percent ofdevices (in gray) in each region that are of a certain type. For example, 42.8% of homes in North America have at least one
media device and 44.9% of North American IoT devices are media devices. For the presence of any IoT device, we only report
the percent of homes with an IoT device.

Figure 3: IoT Device Distribution by Region—IoT device
type distributions vary between different geographic regions.
For example, Surveillance devices are most prevalent in Asia,
whereas Home Automation devices only appear in North
America and Europe.

Table 5: Regional Similarities—We calculate the similarity
regions by computing the Spearman’s rank correlation test
over each region’s rank order list of most popular types ofdevices. We show the most similar region (green) and least
similar region (red) by row. Correlation coefficients presented
are out of 100. In all cases, p-values were < 0.05.

3.1
have unique preferences for device types points to deeper
differences between regions, making it harder to reason about
IoT in aggregate and more challenging to generalize findings
from one region to others.

North America

North America has the highest density of IoT devices of any
region: 66.3% of homes have an IoT device compared to40.2% globally. Similar to other regions, media devices (e.g.,
TVs and streaming boxes) and work appliances account forthe most devices in North American homes. Nearly half ofhomes have one media device and one third have a work
appliance (Table 4). Media devices are also the most prolific,
accounting for 44.9% of IoT devices in North America. In
contrast, work appliances only account for 28% of devices(Table 4). There is a long tail of manufacturers that produce
media devices in the U.S., and the most popular vendor, Roku,
only accounts for 17.4% of media devices (Table 11). Second
most popular is Amazon (10.2%). In contrast, there are only

We also considered the relative popularity of types of devices within each region. Even in areas with similar rankorder popularity, the proportion of device types in those regions varies (Figure 3). We compute a pairwise proportion
test across each region to quantify the differences between
regions and find that nearly all regions have varying proportions of IoT device types, except when a device type accounts
for fewer than 1% of devices. We discuss each region below.
6

a handful of popular work appliance vendors—HP is the mostcommon and accounts for 38.7% of work appliances in North
America.
Though popular in every region, a considerably higher
number of homes in North America contain a game console.
This is one of the reasons that a smaller fraction of IoT devices are media-related than in Western and Northern Europe.
There are three major vendors of game consoles: Microsoft(39%), Sony (30%),3 and Nintendo (20%).
North America is the only region to see significant deployment of home voice assistants like Amazon Echo [3] andGoogle Home [25]. Nearly 10% of homes now have a voiceassistant and the device class accounts for 7.5% of IoT devices in the region. Two thirds of home assistants are Amazon
produced, the remaining one third are Google devices. North
America is also one of the only region to see automation devices, which are present in 2.5% of homes. There are four
major manufacturers in this space, Nest4 (44.2%), Belkin(15.1%), Philips (14.4%), and Ecobee (9.8%). These vendors
sell products such as the Nest Thermostat [42], Wemo smart
plug [5], Philips Hue Smart Lights [46], and the Ecobee Smart
Thermostat [19].
The relative ranking of IoT device type popularity generally
does not change as more IoT devices are added to North
American homes. To quantify this, we calculate the Spearman
rank correlation for each pairwise set of homes based on thenumber of devices and observe only slight deviations fromthe overall regional distribution. As more devices are added
to the network, the correlation coefficients for North America
hover between 0.98–1.0, indicating minimal change. Despite
minimal change in the relative ranking of IoT device types,
we note that the fraction of each device type does vary as more
IoT devices are added to the home. For example, for homes
with one IoT device, voice assistants make up only 3.9% of alldevices, down from 7.3% across all homes. Game consoles
are also more popular in homes with only one IoT device, up
from 13.9% to 16.5%.

3.2

which may offer one explanation. The only other device type
we commonly see are game consoles (9.8% of devices). No
other class appears in more than a fraction of a percent ofhomes.
The vendor distribution of media devices in Central andSouth America differs from the global distribution. Two vendors appear in the top 5 for this region that do not appear inany other region. First is Arcadyan, a Taiwanese company
that primarily manufactures cable boxes in this category, andis often found in LG Smart TVs. The second is Intelbras, aBrazilian company that manufactures DVRs and smart video
players. Intelbras accounts for 11% of the surveillance cameras in the region, though they are third to Hikvision andDahua.

3.3

EuropeEastern and Western Europe are both most similar to Oceania,
primarily due to the three regions sharing a similar fraction ofstorage devices (Table 4). Still, the regions vary in terms of
their IoT usage: 53.5% of Western European homes have atleast one IoT device, compared to 25.2% in Eastern European
homes.
Manufacturers in Western Europe are similar to the global
distribution with a handful of exceptions. Sagemcom andFree, two French companies that sell media boxes and IP
cameras, are the first and third largest media vendors in Western Europe, accounting for 15.7% and 9.3% of all devices
compared to 5.7% and 3.2% globally. The markets of bothcompanies are highly localized, as 99% of their devices inour dataset are located in Western and Northern Europe. In
other device categories, such as work appliances, game consoles, and home automation, there is limited variance fromthe global distribution. Outside of North America and Oceania, Western Europe is the only other region where more than
1% of homes have a home automation device.
There are significantly more surveillance devices in Eastern
Europe than Western Europe (14% versus 5.6% of devices).
Eastern Europe is also unlike most other regions in that its
rank ordered device type distribution changes as more IoT
devices are added over time. For homes with one IoT device,
surveillance devices only make up 5.3% of all IoT devices,
but this changes drastically for homes with 3 IoT devices,where the number of surveillance devices shoots up to 13.8%.
The fraction of surveillance devices continually increases as
more IoT devices are added to Eastern European homes. In
homes with 10 IoT devices, surveillance devices are the mostpopular device, accounting for 42.7% of all devices.

Central and South America

South American homes are the least similar to North America
of any region (Table 5). While the most common types of
IoT devices in both regions are media devices (51.7% vs44.9%) and work appliances (24% vs 28%), significantly
fewer South American homes have an IoT device (32% vs66%) and there are significantly more surveillance devices:
13.3% vs 3.7% of devices (Table 4). Prior research uncoveredthat there is an increased reliance on surveillance devices
in Brazil and surrounding regions to deter violence [27, 34],

3.4

3 Sony PlayStation devices are split across three vendors in this distribution primarily due to their network cards being manufactured by two third
party vendors, Azurewave (11.6%) and Foxconn (9%).
4 A classification error misclassifies Nest products as mobile devices. We
manually correct this in our analysis since Nest does not sell mobile devices.

Asia

We analyze the four regions (East, Central, South, and Southeast) of Asia separately as they have different IoT profiles.
For example, surveillance devices make up 54.5%, 37%, and
7

1
0.9

Cumulative Fraction of Devices

Cumulative Fraction of Devices

1
0.9
0.8
0.7
Central and South America
Central Asia
Eastern and Southern Europe
Eastern Asia
North Africa and Middle East
Northern America
OceaniaSoutheastern Asia
Southern Asia
Sub-Saharan Africa
Western and Northern Europe

0.6
0.5
0.4
0.3
0.2
0.1
0
1

10

100
Vendor by Rank

1000

0.8
0.7
0.6

0.4
0.3
0.2
0.1
0

10000

Media
Home ApplianceGame Console
Home Automation
Generic IoTSurveillance
Work Appliance
Storage
Voice Assistant
Wearable

0.51(a) Vendors per Region

10100
Vendor by Rank

1000

10000

(b) Vendors per Device Type

Figure 4: IoT Vendors per Region and Device Type—There is a long tail of IoT manufacturers worldwide. However, in all
regions, 100 vendors account for more than 90% of devices and 400 vendors account for 99%. In contrast, some device types arealmost entirely dominated by one or two vendors. For example, Amazon and Google produce 91.9% of voice assistants and
Hikvision produces 18.6% of surveillance devices.
30.3% of devices in South, Southeast, and Central Asia (Figure 3), whereas only 9.1% of devices are surveillance related
in East Asia. This is not due to a large number of homes
with cameras, but rather that other types of IoT devices aresparse. For example, only 9% of S.E. Asian Homes and2.5% of South Asian homes contain a media device whereas
more than 40% homes in North America and Western Europe
do. Similar to other regions, Hikvision is the most prevalentvendor of surveillance devices in S.E. Asia and South Asia,
making up 25.8% and 34.7% of surveillance devices in eachregion respectively. Unlike other regions, a private5 vendor
accounts for 15.5% of all surveillance devices in Southern
Asia.
East and Central Asia are more similar to Eastern Europe
and Africa than they are to South and Southeast Asia. East
Asia, for example, is most similar to Sub-Saharan Africa
because its largest device type is work appliances, whichmake up 44.5% of the devices in the region. Central Asia
more closely follows Eastern Europe with media devices
accounting for 54.2% of devices. All Asian regions do have
one thing in common: they are all the least similar to North
American homes, indicating fundamental differences in IoT
device usage between the Asian countries and North America.

that work appliances are most popular (50% of devices). 11%
homes in the region have at least one work appliance. The
most popular vendor is HP (33.6%), followed by a long tailof other manufacturers.

3.6

Oceania ranks third to North America and Western Europe interms of fraction of homes that contain an IoT device (49.2%
of homes). Similar to other regions, the most popular device
type in the region are media devices, which are found in
30.7% of homes. This is followed by work appliances (19.8%
of homes) and gaming consoles (10.1% of homes). Oceania
is one of the only regions that contains home automation
devices, appearing in 0.7% of homes in our dataset. Similar to
North America and Western Europe, Oceania has a moderate
number of voice assistant devices, which appear in 3.2% of
homes and account for 4.2% of all devices. Unlike North
America and Western Europe, homes in Oceania containmany networked storage devices. They account for 4.3% of
all devices, which is most similar to homes in Eastern Europe
and East Asia.

3.7
3.5

Oceania

Africa and Middle East

IoT Device Vendors

While we find devices from 14.3K unique vendors, 90% of
all devices globally are manufactured by 100 vendors (Figure 4a). Globally, there are 4,157 vendors (29%) that only
appear in one home. Unlike device type distributions, which
are consistent across region, vendor distributions vary heavily
across device type (Figure 4b). Some device types are dominated by a small handful of vendors. For example, Amazon
and Google account for over 90% of voice assistant devices
globally. Other device types like media devices and surveillance devices are split across many vendors. Media devices
are the most heterogeneous by vendor: the top 10 vendors
only account for 60% of devices.

The North Africa, Middle East (combined) region is mostsimilar to Eastern Europe. Media devices are the most prevalent, appearing in 9.4% of homes and accounting for 35.7%
of devices. Again, we observe a local media vendor witha large presence: Vestel, a Turkish TV manufacturer, is thethird largest media vendor after Samsung and LG. Surveillance devices make up 28.5% of their overall devices, andappear in 5.2% of homes. Sub-Saharan Africa is distinct in
5 Private vendors are ones that have paid an additional fee to IEEE to keep

their MAC address mapping off of the public OUI list.

8Device TypeGame Console
Voice AssistantHome Automation
Surveillance
Work Appliance
StorageMedia
RouterMobile Device

Mean Correlation

Top-10Mean Correlation

0.43
0.23
0.98
0.07
0.04
0.05
0.04
0.01
0.01

0.49
0.26
0.98
0.28
0.22
-0.03
0.09
0.02
0.03

Table 6: Vendor Correlation by Device Type—We show
the mean correlation in rank ordered vendor distributions per
device type across every pair of regions across all vendors aswell as the top 10 vendors in each category. The correlations
in bold are statistically significant, and indicate consistency
in vendors for these device types across all regions in ourdataset.

Service

DevicesPort

Service

Devices

1900
80
5353
8080
443
9100
515
631
554
8008

UPnP
HTTP
mDNS
HTTP Alt.
HTTPS
JetDirect
LPR
IPP
RTSP
HTTP Alt.

46.2%
45.7%
39.2%
26.9%
21.1%
19.5%
16.5%
11.8%
11.8%
11.1%

139
SMB
8443 HTTPS Alt.
8009 HTTP Alt.
445
SMB
7676
Custom
49152
–
21
FTP
5000
UPnP
23
Telnet

10.6%
9.5%
9.3%
8.7%
8.2%
7.9%
7.8%
7.8%
7.1%

Table 7: Popular IoT Services—We show the common open
ports in IoT devices in our dataset. The most popular protocols are related to device discovery (UPnP, mDNS) anddevice administration (HTTP, HTTPS).
Credential
admin/admin
admin/
Administrator/
sysadm/sysadm
root/
root/rootuser/
meo/meoadmin/password
admin/ttnet
otherRegional differences in vendor preferences may cause theobserved variance in vendor distributions across device types.
To measure this, we compute the pairwise Spearman’s correlation for each vendor distribution across every pair of regions(e.g. vendor distribution for voice assistants in North America
vs. East Asia). We then aggregate6 over device type by taking
the average correlation across each pair of regions (Table 6).
We observe that device types dominated by a handful ofvendors globally (Figure 4b) show moderate to strong correlations across all regions, indicating stability in popular
vendors across geographic areas. For example, game consoles are dominated by three major players (Microsoft, Sony,
Nintendo) in almost every region across the world. In contrast, there are a number of device types, such as media andstorage devices, for which there are no correlations acrossregion, even when looking only at the top 10 vendors. This
indicates that for these device types, regions have differingvendor preferences. This result aligns with our investigationof individual regions, where we observed many regions prefer local media vendors that are less prevalent in the global
distribution.

4

Port

%
88.3%
5.9%
1.4%
0.9%
0.7%
0.4%
0.4%
0.3%
0.3%
0.3%
1.0%

(a) Weak FTP Credentials

Credential
admin/adminroot/xc3511
vodafone/vodafone
guest/guest
admin/1234
root/hslwificam
root/vizxv
root/oelinux123
admin/4321
other

%
35.6%
16.0%
10.4%
7.8%
7.5%
3.9%
3.7%
2.2%
1.8%
1.6%
9.5%

(b) Weak Telnet Credentials

Table 8: Most Popular Weak FTP and Telnet Credentials—admin/admin accounts for the 88.3% and 35.6% of
the weak FTP and Telnet credentials.
home routers, and the presence of homes that exhibit scanningbehavior on a large darknet.
Many IoT devices act as embedded servers: 67.5% of devices provide at least one TCP- or UDP-based service. Manyof these services are not surprising—network printers necessarily run services like IPP. However, we also note thatdevices commonly support older protocols like Telnet (7.1%of IoT devices) and FTP (7.8%). The most common protocol is Universal Plug and Play (UPnP), which is prevalenton 46.2% of devices. We also observe HTTP and mDNS on
nearly half of devices. We show the top protocols in Table 7.

Home Security

Beyond understanding the landscape of IoT devices, we investigate the security profile of devices in homes, including
devices that allow weak authentication, the security profile of

4.1

Weak Device Credentials

6 We note that correlation coefficients are not additive, so to aggregate

WiFi Inspector identifies devices that allow authentication
with weak default credentials by attempting to log in to FTP
and Telnet services with a small dictionary of common default
credentials (Section 2). We find that 7.1% of IoT devices and14.6% of home routers support one of these two protocols.

we convert the respective correlation r-values to z-values using a Fisher’s
Z transform [13], take the average of the Z values, and convert back to an
r-value. In addition, we could only compare rank order for vendors who
appeared in all 11 regions in the dataset. There were three device categories(wearables, home appliances, generic IoT) for which no vendors appeared in
all regions; we could not compute correlations in these cases.

9

FTP
RegionAll IoT

RouterStorageAll IoT

Surveillance

HTTP

Work Appl.

Surveillance

Sup

Vuln

Sup

Vuln

Sup

Vuln

Sup

Vuln

Sup

Vuln

Sup

Vuln

Sup

Vuln

Sup

Vuln

20.8
5.4
39.0
7.4
31.6
9.9
14.7
6.5
36.0 17.3
29.5
3.0
50.4
7.4
33.7 13.4
14.7
9.2
44.6
9.8
55.3 15.4

23.4
42.0
40.7
23.6
41.5
64.2
59.5
38.6
16.2
53.4
61.5

16.7
27.8
30.9
19.9
32.0
10.2
25.4
36.6
29.9
30.4
27.2

6.4
13.1
9.8
7.2
6.9
9.9
7.4
5.4
5.0
7.5
10.8

4.6
2.9
5.8
5.1
5.5
2.7
1.4
2.4
4.2
2.6
5.1

5.0
11.9
16.2
4.4
4.4
53.9
21.0
6.8
28.2
33.7
23.6

4.6
9.3
12.6
7.4
7.5
15.7
14.8
11.1
13.4
23.9
12.5

3.2
4.8
6.6
5.5
12.2
3.8
5.8
4.2
6.7
8.2
10.1

27.0
25.9
31.2
26.4
36.7
35.1
37.7
35.4
25.0
25.9
35.4

0.5
4.9
3.0
1.0
0.4
4.9
3.6
2.9
0.7
4.8
1.1

4.8
8.6
8.9
4.2
13.8
6.7
12.1
14.6
7.8
11.1
12.0

5.8
18.9
9.3
8.1
4.7
6.4
6.3
7.6
5.7
10.5
5.2

9.9
16.6
19.4
7.5
13.0
16.1
12.4
13.7
14.8
17.3
14.1

1.3
1.6
2.3
2.1
0.9
7.3
2.0
0.9
0.9
1.7
1.6

5.3
13.2
20.9
3.3
19.9
37.6
18.1
19.3
17.1
26.6
20.9

16.8
42.3
48.9
23.6
23.8
47.3
43.7
21.4
19.9
24.0
25.4

Vuln
North America
South America
Eastern Europe
Western Europe
East Asia
Central Asia
Southeast Asia
South Asia
Oceania
N. Africa, M. East
Sub-Saharan Africa

TelnetRouter

TP-Link

Table 9: Weak Default Credentials by Region and Device Type—We show the weak FTP and Telnet device population byregion and device type, highlighting both the fraction of devices that support (Sup) each protocol as well as the fraction that arevulnerable with weak default credentials (Vuln). Some regions have a higher fraction of devices with weak credentials—in thelargest case, 50% of FTP devices in Southeast Asia and 4.9% of all Telnet devices in Central Asia are weak. We further observethat the likelihood of having weak FTP credentials is correlated to weak Telnet credentials, indicating that the presence of weakcredentials may be linked to weaker security posture in the region overall.
Of those, 17.4% exhibit weak FTP passwords and 2.1% haveweak Telnet passwords. In both cases, admin/admin is mostcommon and accounts for 88% of weak FTP and 36% of
weak Telnet credentials (Table 8). The credential is used by
FTP devices from 571 vendors and from 160 Telnet vendors.
Regions vary in terms of vulnerable IoT device populations.
In the smallest case, 14.7% of FTP devices in Western Europe
support weak default credentials while more than 55% of
FTP devices in Sub-Saharan Africa that are weak. A similar,
though not as drastic range exists for Telnet. North America has the smallest vulnerable population of Telnet devices(0.5%), Central Asia and South America share the largest
vulnerable Telnet population (4.9% of all IoT Telnet devices),primarily because of their reliance on surveillance devices,which have the weakest Telnet profile of all IoT devices.
Nearly all of the IoT devices that support FTP are work
appliances (76%), storage (9.1%), media (7.6%), and surveillance devices (5.1%). Media and surveillance devices appear
in the list due to their global popularity—unlike storage andwork appliances where 29% and 23% of devices support FTP
respectively, only 1% of media devices and 4% of surveillance devices support FTP. This aligns with the business need
for work and storage devices to facilitate user file transfer,and also explains why there is little variance in the types ofdevices that support FTP across regions.
Storage devices are the device type most likely to support
FTP, though only a small fraction of them use weak credentials. There are two regional exceptions—East Asia and SubSaharan Africa (Table 9), which exhibit 12.2% and 10.1%of storage devices with weak credentials respectively. We
observe this is primarily due to one vendor, ICP Electronics,
which has a large market presence in the two regions: 12.1%
and 10.1% of storage devices in East Asia and Sub-SaharanAfrica respectively. 74% of ICP storage devices exhibit weak
default credentials.
A surprising number of home routers also support FTP(10.2%). TP-Link is responsible for the most routers withweak FTP credentials (Table 10)—regions that rely on TPLink routers thus have a higher rate of devices with weak
FTP credentials. Of all TP-Link devices across all regions,
9.3% offer an open FTP port, and 62.8% of those devices areprotected by weak credentials.
Unlike FTP, there is little reason for any IoT devices tosupport Telnet in 2019. Yet, we find both that surveillance
devices and routers consistently support the protocol. Surveillance devices have the weakest Telnet profile, with 10.7%
of surveillance devices that support Telnet exhibiting weakcredentials. This aligns with anecdotal evidence that suggeststhat these kinds of devices are easy to hack [4].

4.2Home Routers

Nearly every home in our dataset has a home router. Similar
to most types of IoT devices, there are regional differences
and a long tail of vendors globally (Table 9). In total,
we see home routers from 4.8 K vendors. TP-Link is
the most popular manufacturer globally (15% of routers)
and is the top provider in five regions: South America,
Central Asia, Eastern Europe, South Asia, and Southeast
Asia. Arris is the most popular router vendor in North
America (16.4%)—likely because popular ISPs like Comcast
supply Arris routers to customers. Huawei is the mostpopular vendor in Sub-Saharan and North Africa, accountingfor 19.8% and 25.6% of all routers respectively.

10

Vendor% Open% Weak% of Weak

Ricoh
Kyocera
HP
Sharp
Canon

92.1%
91.7%
7.3%
89.4%
2.7%

71.2%
97.1%
92.4%
94.2%
79.3%

29.8%
26%
24.5%
6.4%
2.1%

(a) Work Appliance (FTP)

Vendor% Open% Weak% of Weak

Vendor% Open% Weak% of Weak

TP-Link
Technicolor
ZTE
MicroTik
D-Link

9.3%
22.9%
9.9%
46.9%
16.2%

62.8%
20.4%
37.5%
13.0%
10.9%

55.9%
9.6%
9.5%
5.3%
3.9%

D-LinkHuawei
TP-Link
ZyxelIntelbras

38.9%
13.6%
15.0%
53.5%
12.7%

6.1%
4.8%
1.4%
2.9%
26.4%

33.0%
18.7%
12.6%
12.1%
7.1%

(b) Router (FTP)(c) Router (Telnet)

Table 10: Weak Vendors by Device Type—We show the vendors that exhibit weak default credentials across each device typein our dataset sorted by the fraction of weak devices they contribute to their respective device types. For example, 71.2% of
Ricoh printers that support FTP also support weak default credentials, and these make up 29.8% of all weak work appliances.
Weak FTP/Telnet Credentials More than 93% of routers
have HTTP administration interfaces on port 80. We also findthat many routers support DNS over UDP (66.5%), UPnP
(63.4%), DNS over TCP (42.1%), HTTPS (42.2%), SSH(19.7%), FTP (10.8%), and Telnet (14.6%). Of the devices
that support FTP and/or Telnet, 12% have weak FTP and 1.6%
have weak Telnet credentials. 1.2% of all routers exhibit aweak FTP credential and 0.2% exhibit of all routers have aweak Telnet credential. For FTP, TP-Link routers had theweakest profile: 55.3% of their routers with an open FTP port
exhibited a weak credential. For Telnet, D-Link routers were
the weakest—6% of all open routers had a weak credential,and 35.3% of all D-Link routers had an open Telnet port. We
show a breakdown by region in Table 10.

exposed with a vulnerability—far higher than the fraction nonexternally available routers in our dataset with a weakness
or vulnerability (25.8%). The most popular router vendor inthese regions is TP-Link, which is also the vendor responsible
for the most externally exposed routers (19.7%). We note
this is not simply because TP-Link is the largest vendor—a
proportion test across regions shows that TP-Link routers
appear in the set of externally exposed routers at a higher rate
than that of non-externally exposed routers.

4.3

Scanning Homes

While scan data can provide insight into the vulnerabilityof hosts, it typically does not indicate whether hosts havebeen compromised. We analyzed the homes from WiFi Inspector that were seen performing vulnerability scans in alarge network telescope (Section 2) on January 1, 2019 tobetter understand infected devices. Of the 500.7 K homes that
WiFi Inspector collected data from that day, 1,865 (0.37%)
homes were found to be scanning for vulnerabilities. Scansmost frequently target TCP/445 (SMB, 26.7% homes) followed by TCP/23 (Telnet, 11.3%), TCP/80 (HTTP, 10.7%),
and TCP/8080 (HTTP, 9.4%). In addition to checking credentials, WiFi Inspector also checks devices for a handfulof recent, known vulnerabilities (CVEs, EDBs, and others). 1,156 (62%) of scanning homes contained at least one
known vulnerability—conversely, 7.2 M (46.8%) non scanning homes in our dataset contain at least one known vulnerability. To test the differences between these populations, weused a proportions t-test at a confidence interval of 95%. We
observe that the two sets are statistically significantly different(p-value: 2.31 ∗ 10−39 ), indicating that scanning homes havea higher vulnerability profile than homes globally. This trend
also holds for the number of vulnerable devices in scanninghomes (9.7%) compared to homes globally (5.7%). Unfortunately, we were unable to determine why homes without
known vulnerabilities were seen scanning. This is likely due
to devices being compromised through means outside of ourmeasurement vantage point, for example, vulnerabilities that
we do not test for.
Although the overall vulnerability profile of devices inscanning homes is higher, this is not true of all specific vul-

Weak HTTP Administration Credentials WiFi Inspector attempts to login to the HTTP interfaces for devices froma small number of common vendors, including TP-Link—
the most common router manufacturer. In our dataset, there
are 3.8 M TP-Link home routers, of which 82% have an
HTTP port open to the local network. WiFi Inspector wasable to check for weak default credentials on 2.5 M (66%)
of the devices with HTTP. Overall, 1.2 M (30%) of TP-Linkrouters exhibit weak HTTP credentials. Nearly all (99.6%)
use admin/admin. The number of TP-Link routers withguessable passwords varies greatly across regions (Table 9).
For example, only 6% of TP-Link routers in North America
have weak passwords while around 45% do in South andCentral Asia, and East and South Europe.
External Exposure To understand whether routers withweak default credentials are also exposed on the public Internet, we joined the WiFi Inspector dataset with Internet-wide
scan data from Censys [16] for devices on a single day—January 30, 2019.7 A small number of home routers hostpublicly accessible services: 3.4% expose HTTP, 0.8% FTP,
0.7% Telnet, and 0.8% SSH. Open gateways are primarily
located in three regions—Central America (29.3%), Eastern
Europe (20.6%), and Southeast Asia (17.2%). Of routersthat are externally exposed, we find that 51.2% of them are
7 We perform this analysis for January because of GDPR restrictions on

Avast data.

11

nerabilities. Of the 25 vulnerabilities observed in scanninghomes, 17 appeared at a ratio that was not statistically significantly different than devices globally. The remaining eight
vulnerabilities were statistically significantly different, though
six appear at a smaller rate in scanning homes than globally.
The two vulnerabilities that appeared at a higher rate in scanning homes were both related to EternalBlue—a leaked NSA
exploit targeting SMB on Windows that was primarily responsible for the WannaCry outbreak that impacted millions ofWindows devices in 2017 [44]. Specifically, we identify 5.2%of devices within scanning homes that are vulnerable to EternalBlue, and further, 1.3% of devices in scanning homes are
already compromised, and communicating through a backdoor. This additionally explains some fraction of the SMB
scanning we observed on the darknet, as machines compromised via EternalBlue often scan for other hosts runningvulnerable SMB servers. We note that although these homes
contain vulnerable devices, we cannot claim that they arescanning as a result of these devices—for one, we do nothave full vulnerability coverage, and two, it is an outstanding
challenge to attribute device behavior from our vantage point.
Still, the presence of any scanning homes in general indicates a threat landscape larger than simply publicly accessible
devices, and one that should be considered by the security
community.

5

A larger question remains on how to address the long tail ofvendors. As described in Section 3, regions often have vastlydifferent preferences for vendors across device types. As aresult, working to improve the security of devices based solely
on the global distribution may inadvertently leave smaller
regions with divergent preferences less secure.
Finally, it is not immediately clear how to measure theimpact of compromise on home security. In our work, wemeasured the prevalence of scanning, though this is just one
indication of compromise. Furthermore, we only observed
0.37% of homes scanning; amounting to only 1.8 K homes
on a single day. In spite of all the data collected within
homes in this paper, we could not effectively identify why
certain homes were compromised. Researchers have proposedsystems to enable auditing of home IoT setups [55, 58], butthere is still more work to be done.

6

Related Work

Our work build on research from a number of areas, primarily
in home network measurement and IoT security.
Home Network Measurement Early research in home
network measurement primarily focused on debugging
networks—projects like Netalyzer [35] were conceived to enable users to debug their home Internet connectivity [9,15,49].
A number of follow on papers leveraged Netalyzer-like scans
to investigate the state of devices in homes [1, 9, 14], as wellto try and understand the implications of a connected homeon user behavior [10].
Most similar to our work is presented by Grover et al. who
installed home routers with custom firmware in 100 homes
across 21 countries to measure the availability, infrastructure,and usage of home networks [26, 53]. Their work focuseson the network properties of home networks on aggregate,
and also is able to measure networks continuously based on
their position in the network. Our work instead focuses on thedevices behind the NAT in their ubiquity and their security
properties, with particular attention spent on IoT devices.
Recent work has built off of network scanning to enablerich device identification. Feng et al. built a system that leverages application layer responses to perform device identification without machine learning, similar to our hand curated
expert rules [21]. This work has built off a number of papers
that leverage banners and other host information to characterize hosts [6, 20, 39, 50, 51]. Other rule based engines havebeen used in other work on active, public scan data based on
probing for application banners [4, 16].

Discussion

Recent security research has focused on new home IoT devices, such as smart locks and home automation. Our results
suggest that while these devices are growing in importancein western regions, they are far from the most common IoT
devices around the world. Instead, home IoT is better characterized by smart TVs, printers, game consoles, and surveillance devices—devices that have been connected to our home
networks for more than a decade. Furthermore, these are thekinds of devices that still support weak credentials for old protocols: work appliances are the device type with the highest
fraction of weak FTP credentials; surveillance devices are theworst for telnet credentials. Improving the security postureof these devices remains just as important as ensuring thatnew technologies are secure—our home networks are only as
secure as their weakest link.
There are some immediate next steps. As outlined in Section 4, much of the devices that support weak credentials
are manufactured by a handful of popular vendors across all
regions (Table 10). The security community can start addressing these challenges by encouraging the largest offending
vendors to adopt better security practices. On the policy end,law enforcement and legal entities have started to provide
legal disincentives for weak security practices. In light of
the Mirai attacks, the U.S. Federal Trade Commission has
prompted legal action against D-Link [12] for putting U.S.
consumers at risk.

Home IoT Security Home IoT security has been of recent
interest to researchers in light of its growing security andprivacy implications, from the systems level up through theapplication layer. Ma et al. investigated the rise of the Mirai botnet [4], which was largely composed of IoT devices
compromised due to weak credentials and used to launch
12massive DDoS attacks. This is not isolated to only attackers—
researchers have been breaking the home IoT devices since
their conception [8, 31, 38, 47, 59]. Notably, Fernandes et al.
outlined a number of challenges in Samsung SmartThings
devices, from their access control policy to their third-party
developer integration [22]. In response, researchers have built
systems to enable security properties in home IoT, such as
information flow tracking and sandboxing [23,33], improving
device authentication [54], and enabling auditing information [55, 58]. Most recently, Alrawi et al. synthesized the
security of home IoT devices into a SoK, where they presenta systematization of attacks and defense on home IoT andoutline how to reason about home IoT risk [2].

[4] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein,
J. Cochran, Z. Durumeric, J. A. Halderman, L. Invernizzi, M. Kallitsis, et al. Understanding the Mirai botnet. In 26th USENIX Security
Symposium, 2017.

Internet-Wide IoT Scanning There has been a wealth ofrecent work that has used Internet-wide scanning for security
analysis, including analyzing embedded systems on the public
Internet (e.g., [4, 7, 18, 24, 28, 30, 36, 37, 40, 48, 52, 60]). In
contrast to these works, we focus on devices inside of homesthat are not visible through Internet-wide scanning.

[9] M. Chetty, D. Haslem, A. Baird, U. Ofoha, B. Sumner, and R. Grinter.
Why is my internet slow?: making network speeds visible. In 29th
SIGCHI Conference on human factors in computing systems, 2011.

7[5] Belkin. WeMo smart plug. https://www.belkin.com/us/p/P-F7C063/.
[6] B. Bezawada, M. Bachani, J. Peterson, H. Shirazi, I. Ray, and I. Ray.
Behavioral fingerprinting of iot devices. In 2nd ACM Workshop on
Attacks and Solutions in Hardware Security, 2018.
[7] A. Bonkoski, R. Bielawski, and J. A. Halderman. Illuminating thesecurity issues surrounding lights-out server management. In 7th
USENIX Workshop on Offensive Technologies, 2013.
[8] J. Chen, W. Diao, Q. Zhao, C. Zuo, Z. Lin, X. Wang, W. C. Lau, M. Sun,
R. Yang, and K. Zhang. Iotfuzzer: Discovering memory corruptions
in iot through app-based fuzzing. In 25th Networking and Distributed
Systems Security Symposium, 2018.

[10] M. Chetty, J.-Y. Sung, and R. E. Grinter. How smart homes learn: The
evolution of the networked home and household. In 9th International
Conference on Ubiquitous Computing, 2007.
[11] J. Cohen. Statistical power analysis for the behavioral sciences, 1998.
[12] F. T. Commission. FTC charges D-Link put consumers’ privacy
at risk due to the inadequate security of its computer routers andcameras. https://www.ftc.gov/news-events/press-releases/2017/01/
ftc-charges-d-link-put-consumers-privacy-risk-due-inadequate.

Conclusion

In this paper, we conducted the first large-scale empirical analysis of IoT devices on real-world home networks. Leveraging
internal network scans of 83M IoT devices in 16M homes
worldwide, we find that IoT devices are widespread. In several regions, the majority of homes now have at least one
networked IoT device. We analyzed the types and vendors
of commonly purchased devices and provided a landscapeof the global IoT ecosystem. We further analyzed the security profile of these devices and networks and showed that asignificant fraction of devices use weak passwords on FTP
and Telnet, are vulnerable to known attacks, and use default
HTTP administration passwords that are left unchanged byusers. We hope our analysis will help the security community
develop solutions that are applicable to IoT devices alreadyin today’s homes.

[15] L. DiCioccio, R. Teixeira, and C. Rosenberg. Measuring home networks with homenet profiler. In 14th International Conference on
Passive and Active Network Measurement, 2013.

8[19] Ecobee. Ecobee 4. https://www.ecobee.com/ecobee4/.

[13] D. M. Corey, W. P. Dunlap, and M. J. Burke. Averaging correlations:
Expected values and bias in combined pearson rs and fisher’s z transformations. The Journal of general psychology, 125(3), 1998.
[14] L. DiCioccio, R. Teixeira, M. May, and C. Kreibich. Probe and pray:
Using UPnP for home network measurements. In 13th International
Conference on Passive and Active Network Measurement, 2012.

[16] Z. Durumeric, D. Adrian, A. Mirian, M. Bailey, and J. A. Halderman.
A search engine backed by Internet-wide scanning. In 22nd ACM
Conference on Computer and Communications Security, 2015.
[17] Z. Durumeric, M. Bailey, and J. A. Halderman. An Internet-wide viewof Internet-wide scanning. In 23rd USENIX Security Symposium, 2014.
[18] Z. Durumeric, E. Wustrow, and J. A. Halderman. ZMap: Fast Internetwide scanning and its security applications. In 22nd USENIX Security
Symposium, 2013.

Acknowledgements[20] X. Feng, Q. Li, Q. Han, H. Zhu, Y. Liu, J. Cui, and L. Sun. Active
profiling of physical devices at internet scale. In 25th International
Conference on Computer Communication and Networks, 2016.

The authors thank Avast’s WiFi Inspector team and the backend data team for their support and insight. The authors also
thank Renata Teixeira and David Adrian.

[21] X. Feng, Q. Li, H. Wang, and L. Sun. Acquisitional rule-based engine
for discovering internet-of-things devices. In 27th USENIX Security
Symposium, 2018.

References[22] E. Fernandes, J. Jung, and A. Prakash. Security analysis of emerging
smart home applications. In 37th IEEE Symposium on Security andPrivacy, 2016.

[1] B. Agarwal, R. Bhagwan, T. Das, S. Eswaran, V. N. Padmanabhan, andG. M. Voelker. Netprints: Diagnosing home network misconfigurations
using shared knowledge. In 9th USENIX Networked Systems Design
and Implementation Conference, 2009.
[2] O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose. SoK: security
evaluation of home-based iot deployments. In 40th IEEE Symposium
on Security and Privacy, 2019.
[3] Amazon. All things alexa. https://www.amazon.com/Amazon-EchoAnd-Alexa-Devices.

[23] E. Fernandes, J. Paupore, A. Rahmati, D. Simionato, M. Conti, and
A. Prakash. Flowfence: Practical data protection for emerging iot
application frameworks. In 25th USENIX Security Symposium, 2016.
[24] B. Ghena, W. Beyer, A. Hillaker, J. Pevarnek, and J. A. Halderman.
Green lights forever: Analyzing the security of traffic infrastructure. In
8th USENIX Workshop on Offensive Technologies, 2014.

13

[25] Google. Google home. https://store.google.com/au/product/google_home.

[43] L. H. Newman. An elaborate hack shows how much damage iot bugs
can do. https://www.wired.com/story/elaborate-hack-shows-damageiot-bugs-can-do/.

[26] S. Grover, M. S. Park, S. Sundaresan, S. Burnett, H. Kim, B. Ravi, and
N. Feamster. Peeking behind the NAT: an empirical study of home
networks. In 13th ACM Internet Measurement Conference, 2013.

[44] L. H. Newman. The ransomware meltdown experts warned about ishere. https://www.wired.com/2017/05/ransomware-meltdown-expertswarned/.

[27] F. HALAIS.
Spectacle and surveillance in brazil.
https://
www.opendemocracy.net/opensecurity/flavie-halais/spectacle-andsurveillance-in-brazil.

[45] OPSWAT. Windows anti-malware market share report. https://
metadefender.opswat.com/reports/anti-malware-market-share.

[28] M. Hastings, J. Fried, and N. Heninger. Weak keys remain widespreadin network devices. In ACM Internet Measurement Conference, 2016.

[46] Philips. Philips hue. https://www2.meethue.com/en-us.
[47] E. Ronen, A. Shamir, A.-O. Weingarten, and C. O’Flynn. IoT goes
nuclear: Creating a ZigBee chain reaction. In 38th IEEE Symposium
on Security and Privacy (SP), 2017.

[29] W. He, M. Golla, R. Padhi, J. Ofek, M. Dürmuth, E. Fernandes, and
B. Ur. Rethinking access control and authentication for the homeinternet of things. In 27th USENIX Security Symposium, 2018.

[48] N. Samarasinghe and M. Mannan. Tls ecosystems in networked devices
vs. web servers. In International Conference on Financial Cryptography and Data Security, 2017.

[30] N. Heninger, Z. Durumeric, E. Wustrow, and J. A. Halderman. Mining
your Ps and Qs: Detection of widespread weak keys in network devices.
In 21st USENIX Security Symposium, 2012.

[49] M. A. Sánchez, J. S. Otto, Z. S. Bischof, and F. E. Bustamante. Trying
broadband characterization at home. In 14th International Conference
on Passive and Active Network Measurement, 2013.

[31] G. Hernandez, O. Arias, D. Buentello, and Y. Jin. Smart nest thermostat:
A smart spy in your home. Black Hat USA, 2014.

[50] A. Sarabi and M. Liu. Characterizing the internet host population using
deep learning: A universal and lightweight numerical embedding. In
18th ACM Internet Measurement Conference, 2018.

[32] IEEE. Registration authority. https://standards.ieee.org/productsservices/regauth/oui/index.html.
[33] Y. J. Jia, Q. A. Chen, S. Wang, A. Rahmati, E. Fernandes, Z. M.
Mao, A. Prakash, and S. J. Unviersity. Contexlot: Towards providing
contextual integrity to appified iot platforms. In 24th Network andDistributed Systems Security Symposium, 2017.

[51] Z. Shamsi, A. Nandwani, D. Leonard, and D. Loguinov. Hershel:
single-packet os fingerprinting. In 6th ACM SIGMETRICS Conference,
2014.

[34] M. M. Kanashiro. Surveillance cameras in brazil: exclusion, mobility
regulation, and the new meanings of security. Surveillance & Society,2008.

[52] D. Springall, Z. Durumeric, and J. A. Halderman. FTP: The forgotten cloud. In 46th Annual IEEE/IFIP International Conference on
Dependable Systems and Networks, 2016.

[35] C. Kreibich, N. Weaver, B. Nechaev, and V. Paxson. Netalyzr: illuminating the edge network. In 10th Internet Measurement Conference,
2010.

[53] S. Sundaresan, S. Burnett, N. Feamster, and W. De Donato. Bismark:A testbed for deploying measurements and applications in broadband
access networks. In 19th USENIX Annual Technical Conference, 2014.

[36] M. Kührer, T. Hupperich, J. Bushart, C. Rossow, and T. Holz. Goingwild: Large-scale classification of open DNS resolvers. In 15th ACM
Internet Measurement Conference, 2015.

[54] Y. Tian, N. Zhang, Y.-H. Lin, X. Wang, B. Ur, X. Guo, and P. Tague.
Smartauth: User-centered authorization for the Internet of things. In
26th USENIX Security Symposium, 2017.

[37] M. Kührer, T. Hupperich, C. Rossow, and T. Holz. Exit from hell?
reducing the impact of amplification ddos attacks. In 23rd USENIX
Security Symposium, 2014.

[55] Q. Wang, W. U. Hassan, A. Bates, and C. Gunter. Fear and logging
in the internet of things. In 25th Networking and Distributed Systems
Symposium, 2018.

[38] D. Kumar, R. Paccagnella, P. Murley, E. Hennenfent, J. Mason,
A. Bates, and M. Bailey. Skill squatting attacks on Amazon Alexa. In
27th USENIX Security Symposium, 2018.

[56] Wikipedia. ISO-3166-2. https://en.wikipedia.org/wiki/ISO_3166-2.
[57] O. Williams-Grut. Hackers stole a casino’s database through athermometer in the lobby fish tank. https://www.businessinsider.com/
hackers-stole-a-casinos-database-through-a-thermometer-in-thelobby-fish-tank-2018-4.

[39] M. Miettinen, S. Marchal, I. Hafeez, N. Asokan, A.-R. Sadeghi, and
S. Tarkoma. Iot sentinel: Automated device-type identification for security enforcement in iot. In 37th International Conference on Distributed
Computing Systems (ICDCS), 2017.

[58] J. Wilson, R. S. Wahby, H. Corrigan-Gibbs, D. Boneh, P. Levis, and
K. Winstein. Trust but verify: Auditing the secure Internet of things. In
15th Annual International Conference on Mobile Systems, Applications,and Services, 2017.

[40] A. Mirian, Z. Ma, D. Adrian, M. Tischer, T. Chuenchujit, T. Yardley,
R. Berthier, J. Mason, Z. Durumeric, J. A. Halderman, et al. An
internet-wide view of ics devices. In 14th Annual Conference on
Privacy, Security and Trust (PST). IEEE, 2016.

[59] G. Zhang, C. Yan, X. Ji, T. Zhang, T. Zhang, and W. Xu. Dolphinattack:Inaudible voice commands. In 24th ACM Conference on Computerand Communications Security, 2017.

[41] A. Muravitsky, V. Dashchenko, and R. Sako. Iot hack: how to breaka smart home again. https://securelist.com/iot-hack-how-to-break-asmart-home-again/84092/.

[60] J. Zhang, Z. Durumeric, M. Bailey, M. Liu, and M. Karir. On themismanagement and maliciousness of networks. In Network and Distributed System Security Symposium, 2014.

[42] Nest Labs. Nest thermostat. https://nest.com/thermostats/.

14

A

Data Sharing Policy

The first panel in Figure 1 presents users with a text blurb about WiFi Inspector’s data sharing policy. For ease of reading, wehave copied that text below here:
Nearly every software product you use collects information about you. Search engines, games, everything. We do thesame. This allows us to provide better products and services for you. But we promise to respect your privacy. We also
promise that we will never publish or share any of your personal information outside Avast, nor allow anyone else touse it to contact you for marketing purposes without your consent.
We do use the information that we collect to help us understand new and interesting trends. We may share thisinformation with third parties outside Avast. However, before we do that, we will remove anything that identifies you
personally. For more information, read our Privacy Policy.
If after installing this product, you’d prefer not to participate in data sharing with Avast and third parties, you can
opt-out at any time by unchecking the “participate in data-sharing” box in the settings.

15

B

Device LandscapeN. America

16.4
8.1
5.2
4.6
4.3

Arris
Cisco
Sagemcom
Actiontec
TP-Link

Microsoft 44.2 Nest
Nintendo
15.1 Belkin
Azurewave 14.4 Phillips
Sony
9.8 ecobee
FoxConn
2.7 Enphase

24.9
14.1
5.9
3.9
3.0

W Digital
Synology
Seagate
ICP
WD

12.1
7.3
6.3
5.8
5.3

Hikvision
Dahua
D-Link
Suga
Flir

38.8
10.3
8.4
8.0
7.5

HP
FoxConnAmazon
Epson
Canon

63.2
32.0
1.7
0.8
0.4

Amazon17.4 Roku
Google10.2 Amazon
Unknown
9.9 Samsung
StreamUnlimited 5.9 AppleApple
5.8 Google

S. America

22.2
7.7
7.0
6.5
4.6

TP-Link43.7 Microsoft 33.5 Philips
Arris
13.6 Sony13.0 Belkin
Technicolor 10.7 Azurewave 12.1 –Huawei9.6 FoxConn
5.9 SMA
Mitrastar
6.6 Nintendo
4.7 Enphase

25.0
14.7
13.1
9.7
8.5

W Digital
Sagemcom
Synology
D-LinkSeagate

20.8
16.3
8.4
8.2
4.0

Hikvision
Dahua–Intelbras
Cisco

29.2
18.0
9.0
7.1
5.7

HP
Epson
FoxConn
Brother
Samsung

39.1
27.5
6.2
3.7
3.2

GoogleAmazon
–
TI
Dell

26.0
13.6
7.5
6.3
5.0

Samsung
Arcadyan
GoogleLGIntelbras

East Asia

12.9
11.9
8.4
5.5
4.4

NEC
Buffalo
TP-Link
EFM
Huawei

45.9
21.9
8.9
8.0
4.9

Nintendo49.0 Philips
37.2 Synology
Sony
7.0 Belkin13.4 Buffalo
FoxConn
4.8 Belkin12.1 ICP
Azurewave 4.2 Gongjin Elec 8.8 I-OData
Microsoft
4.2 SMA
8.2 QNAP

28.5
10.5
8.6
5.0
2.4

Hikvision 13.4 Canon
56.2 Google
Dahua
11.1 Epson
32.6 Amazon
Dahua
10.6 Moimstone 2.1 Xiaomi
Panasonic 9.3 FoxConn
0.7 TCL
Bilian9.2 HP
0.7 Onkyo

8.6
7.5
6.9
6.3
5.9

Panasonic
AmazonFoxConn
GoogleSony

Central Asia

Media

49.5
16.6
6.4
5.3
3.0

TP-Link
HuaweiCambridge
D-Link
ZTE

22.8
20.9
17.7
12.5
10.0

Microsoft 11.1 Fn-Link
FoxConn
11.1 Cambridge
Azurewave 11.1 TP-LinkSony– –Liteon
– –

37.4
14.0
13.5
7.7
4.1

Synology
D-LinkW Digital
ICP
QNAP

43.2
16.2
11.0
6.2
3.2

Hikvision
Dahua
Cisco
Cisco
ICP

23.7
10.0
9.4
7.5
6.9

HP
Yealink
Canon
Epson
XEROX

21.3
17.0
6.4
4.3
4.3

AmazonAmazonD-LinkM-Cube
TI

37.2
28.6
6.9
–
–

Samsung
LG
FoxConn––

East Europe

Assistant

23.9
7.3
7.1
6.6
3.8

TP-Link
ZTE
Huawei
D-Link
Asus

37.3
14.7
13.2
11.0
9.5

Microsoft 40.3 Philips
Sony25.1 Philips
FoxConn
5.4 SMA
Azurewave 3.2 eQ-3
Nintendo
3.2 Murata

26.7
15.9
14.0
9.7
7.6

Synology
W Digital
Sagemcom
ICP
QNAP

20.6
18.7
12.0
4.3
3.4

Hikvision
Dahua
Cisco
Cisco
ICP

27.7
10.8
7.1
5.6
4.9

HP
FoxConn
Canon
Epson
Samsung

44.9
23.7
7.6
2.4
2.3

GoogleAmazonAmazonTI
Telemedia

30.8
17.0
5.4
4.7
3.3

Samsung
LG
FoxConn
GoogleNeweb

West Europe

Work

18.0
16.1
5.7
5.2
3.8

Sagemcom
Free
AVM
Huawei
TP-Link

30.6
22.5
14.9
11.5
8.3

Microsoft 33.1 Philips
38.7 Synology
37.1 Free
Nintendo
17.7 Alertme.com 17.7 W Digital
8.0 HikvisionSony
6.1 eQ-3
7.2 ICP7.0 Hikvision
FoxConn
5.7 Hager
5.7 Technicolor 6.3 Dahua
Azurewave 4.8 SMA
4.5 QNAP
5.1 D-Link

39.0
11.6
9.2
9.0
4.1

HP
Canon
FoxConn
Epson
Brother

48.6
37.2
6.4
0.7
0.6

AmazonGoogleApple
Apple
Telemedia

15.7
14.1
9.3
8.4
6.2

Sagemcom
SamsungFree
GoogleGoogleSouth Asia

Surveillance

24.2
7.4
7.4
7.3
2.7

TP-Link
Huawei
D-Link
Tenda
Haier

64.9
8.7
5.7
3.6
2.0

Microsoft 26.3 Philips
FoxConn
24.1 SMA
Azurewave 14.0 Matrix
Sony
1.3 Espressif
Nintendo
1.3 Xiaomi

20.1
14.5
14.5
10.6
10.3

W Digital
Synology
Synology
Seagate
WD

34.3
18.4
18.4
3.0
2.1

Hikvision
Dahua
Dahua
Cisco
ICP

33.1
16.6
8.1
6.0
3.6

HP
Canon
FoxConn
Epson
Ricoh

44.8
33.8
2.7
2.5
1.8

GoogleAmazon
HP
Dell
Intel

17.1
16.9
8.3
6.1
5.5

FoxConn
Samsung
LG
GoogleNeweb

S.E. Asia

Storage

18.9
14.3
12.0
5.3
4.3

TP-Link
Huawei
ZTE
Fiberhome
Mikrotic

44.6
11.6
11.5
10.2
6.5

Microsoft 34.7 Inspur
Nintendo
18.9 Philips
FoxConn
18.6 Rf-Link
Azurewave 8.2 SMA
Sony
2.0 Belkin

36.4
19.4
8.6
7.5
6.6

Synology
W Digital
ICP
QNAP
D-Link

24.7
17.2
4.8
4.0
3.8

Hikvision
Dahua
Cisco
ICP
PLUS

15.4
13.9
9.7
9.5
7.3

HP
FoxConn
Epson
Canon
Ricoh

49.1
21.7
2.7
2.6
2.3

GoogleAmazon
TI
HP
Dell

19.7
10.8
10.6
10.5
4.1

Samsung
FoxConn
ZTE
LG
Neweb

Oceania

39.2
19.7
11.6
9.4
9.0

Automation

19.3
15.4
12.1
7.6
4.7

Technicolor
HuaweiSagemcom
TP-Link
Netcomm

43.7
15.0
11.1
10.3
9.3

Microsoft
Nintendo
FoxConn
Azurewave
Sony

Philips
BelkinLifi
Enphase
SMA

21.0
15.9
13.1
9.5
6.5

Synology
HyBroadW Digital
ICP
Seagate

16.8
13.9
3.7
3.4
3.0

Hikvision
Dahua
D-LinkBaichuanYealink

23.5
19.3
14.1
10.2
6.5

HP
FoxConn
Epson
Canon
Brother

85.3
8.0
1.3
1.3
0.6

GoogleAmazonApple
Apple
Liteon

17.7
12.2
10.0
8.6
6.8

GoogleRoku
Apple
Samsung
Sonos

N. Africa, ME

Gaming

25.6
23.2
8.4
6.1
4.7

Huawei
TP-Link
ZTE
D-Link
Zyxel

26.0
18.7
16.6
12.2
7.7

Microsoft 27.3 Philips
FoxConn
10.6 SMA
Sony
8.1 Lifi
Azurewave 3.2 Sercomm
Liteon2.7 ZTE

29.1
19.2
9.7
9.1
7.7

Askey
W Digital
ICP
Synology
VTech

19.5
15.3
5.4
4.3
4.0

Hikvision
Dahua
Cisco
Topwell
ICP

29.4
9.7
7.2
4.3
3.9

HP
FoxConn
Canon
Samsung
Konika

27.6
21.3
1.9
1.9
1.8

GoogleAmazon
Dell
Apple
HP

20.9
17.2
5.4
3.8
2.7

Samsung
LG
VestelSagemcomApple

S-S Africa

Routers

19.7
12.0
8.1
6.7
6.5

Huawei
TP-Link
Ubiquiti
Mikrotic
D-Link

40.7
14.5
13.9
9.7
8.4

Microsoft 21.1 SMA
FoxConn
17.6 TI
Sony
10.8 Philips
Azurewave 3.9 HP
Nintendo
2.9 Hager

24.7
19.2
10.1
9.3
7.8

Synology
W Digital
ICP
QNAP
Seagate

39.0
16.3
2.8
2.2
1.7

Hikvision
Dahua
Cisco
ICP
PLUS

33.6
8.5
8.4
6.3
5.3

HP
Canon
Yealink
FoxConn
Ricoh

33.8
28.8
7.3
2.9
2.2

GoogleAmazon
HP
Dell
Apple

24.1
7.4
7.4
5.8
5.2

Samsung
LG
LG
Apple
Sagemcom

30.3
20.3
16.4
10.1
6.2

Table 11: Most Popular Vendor per Region per Device Type—We show the five most popular vendors per device type acrossthe eleven regions in our dataset. We excluded two device types, wearable and home appliances, as they were barely present inour dataset and splitting up their vendor distribution by region provided only a handful of devices in each region.

16

N. America

HP
Ricoh
FoxConn
Kyocera
Sharp

40.1
25.2
10.0
6.7
5.5

ICP
W Digital
QNAP
TP-Link
WD

49.8
13.4
7.9
4.6
2.9

Axis
Vivotek
Trendnet
D-linkCreston

63.8
9.6
8.0
4.3
2.0

TP-Link
ZTE
Mikrotic
–
T&W

42.9
22.7
9.3
4.8
3.7

Dahua
PLUS
Metrohm
–
Cisco

45.2
40.5
4.4
4.1
0.7

TP-Link
Zyxel–
BelkinIntelbras

S. America

39.6
25.3
22.8
3.3
1.2

Ricoh
HP
Kyocera
Sharp
Xerox

24.2
20.2
12.9
8.1
7.3

W Digital
ICP
QNAP
Cisco
La Cie

43.3
30.6
6.9
6.5
2.2

Vivotek
Axis
Level OneD-LinkTrendnet

40.3
28.5
11.1
7.4
4.7

Technicolor
TP-Link
D-LinkMikrotic
Cameo

51.4
10.3
9.8
8.8
3.3

PLUS
Cisco
Metrohm
Dahua
Ralink

44.5
21.6
12.0
5.9
5.7

Intelbras
Huawei
BluCastle
TP-Link
Loopcomm

East Asia

39.9
17.6
8.6
7.4
5.6

Ricoh
Sharp
HP
Kyocera
Xerox

49.0
25.4
7.9
7.7
1.7

I-O
ICP
QNAP
EFM
inXtron

44.3
27.8
8.7
4.3
3.5

Vivotek
Axis
Logitec
Imi
Buffalo

62.4
14.1
6.9
2.9
1.8

TP-Link
I-O
DrayTek
coregaMikrotic

43.8
11.9
10.8
9.2
4.3

PLUS
Metrohm
Dahua
ICP
Cisco

45.8
18.6
15.6
4.9
4.7

NEC
HitronHuawei
Buffalo
TP-Link

Central Asia

66.4
9.3
11.5
3.5
3.1

HP
FoxConn
Kyocera
Ricoh
Xerox

66.7
33.3
–
–
–

ICP
QNAP
–
–
–

39.1
17.4
13.0
13.0
8.7

Axis
Zhongxi
Ezvis
Vivotek
–

92.6
1.9
1.5
1.5
1.1

TP-Link
HuaweiZTE
Mikrotic
Asus

36.0
16.9
11.2
10.1
5.6

PLUS
Dahua
–
Metrohm
iStor

52.3
35.2
8.8
2.4
0.6

D-LinkHuaweiCambridge
TP-Link
Eltex

East Europe

42.4
25.9
23.6
3.7
2.4

Kyocera
Ricoh
HP
Sharp
FoxConn

53.1
18.2
12.5
3.0
1.7

ICP
QNAP
W DigitalWD
La Cie

31.6
20.3
12.5
9.0
4.3

Axis
Ezvis
Vivotek
Zhongxi
D-Link

45.8
14.6
11.6
8.3
7.5

TP-Link
ZTE
Technicolor
Mikrotic
Sagemcom

35.0
26.5
12.3
5.0
2.5

PLUS
Dahua
Metrohm
Cisco
iStor

60.5
18.9
8.6
2.8
1.8

D-LinkHuawei
TP-Link
Zyxel
ZTE

West Europe

27.9
22.2
18.8
9.5
3.5

Kyocera
HP
Ricoh
Sharp
FoxConn

49.2
17.1
8.5
4.1
3.8

ICP
W Digital
QNAP
WD
Synology

49.7
11.0
10.8
4.7
3.9

Axis
Vivotek
Advance Vision
D-LinkHikvision

40.8
20.6
12.4
6.9
4.7

TP-Link
ArcadyanTechnicolor
AVM
Mikrotic

35.5
20.9
14.0
5.8
5.0

PLUS
Dahua
Metrohm
iStor
–

65.6
15.1
13.2
0.9
0.8

Zyxel
TP-Link
ZTE–
WinstarsSouth Asia

51.4
19.6
10.5
5.6
4.2

HP
Ricoh
Canon
KyoceraFoxConn

32.4
17.6
14.7
14.7
8.8

W Digital
QNAP
WD
ICP
–

61.5
11.5
10.3
3.8
2.6

Matrix
Axis
D-Link3DSP
CardioMEMS

34.7
26.4
12.4
6.8
3.0

ZTE
TP-Link
D-LinkFiberhome
Binatone

42.1
18.4
11.3
8.8
4.6

PLUS
Dahua
Metrohm
–
Cisco

40.3
34.7
5.4
2.9
2.6

Smartlink
D-LinkHuaweiFida
Zyxel

S.E. Asia

46.6
19.5
6.3
6.3
4.4

Ricoh
HP
Sharp
Kyocera
Xerox

39.9
25.4
11.6
6.5
4.3

ICP
QNAP
W Digital
WD
I-O

45.1
39.6
3.0
2.4
1.2

Vivotek
Axis–
MatrixLevel One

62.3
16.6
7.6
3.3
1.8

TP-Link
Mikrotic
DrayTek
Sagemcom
D-Link

45.7
16.2
12.6
5.3
5.1

PLUS
Metrohm
Dahua
Cisco
–

36.6
24.6
12.3
7.5
5.0

Huawei
Zyxel
TP-Link
ZTE
RicherLink

21.1
18.3
17.9

Kyocera
HP
Ricoh

65.1
15.1
11.6

ICP
W Digital
QNAP

30.8
30.8
30.8

57.6
32.4
3.6

TP-Link
NetComm
D-Link

35.8
18.9
13.2

PLUS
Dahua
Metrohm

91.4
2.7
1.4

TP-Link
D-Link
ZTE

14.3

Xeros

2.3

–

7.7

1.8

Billion

9.4

–

0.9

NetComm

8.7

Sharp

2.3

Cisco

0.0

Axis
–
Ezvis
Adaptive
Recognition
UTC F&S

1.8

Billion

1.1

–

0.9

–

35.1
24.1
23.7
5.6
5.0

Kyocera
HP
Ricoh
Sharp
FoxConn

58.7
18.5
11.4
4.9
1.6

ICP
QNAP
W Digital
WD
Xerox

34.8
19.1
10.3
3.4
2.9

Axis
Vivotek
D-LinkLevel One
SMD

81.9
5.7
4.8
1.7
0.8

TP-Link
ZTE
Askey
Boca
Cameo

48.7
16.3
11.8
4.9
3.6

PLUS
Metrohm
Dahua
iStor
Cisco

38.9
34.2
19.0
2.6
1.1

TP-Link
Zyxel
Huawei
D-LinkAirTies

32.1
28.7
26
4.0
3.0

HP
KyoceraRicoh
FoxConn
Sharp

43.5
16.5
11.8
7.1
5.9

ICP
QNAP
W Digital
Xerox
Seagate

72.5
16.7
2.9
2.0
2.0

Axis
Vivotek
Hikvision
Netcore
Bosch

30.7
28.0
22.3
6.6
4.2

TP-Link
D-LinkMikrotic
ZTE
Billion

43.4
16.9
14.0
5.9
4.4

PLUS
Dahua
Metrohm
–
iStor

60.0
17.4
7.3
4.9
2.2

Zyxel
Huawei
TP-Link
Fida
ZTE

Oceania

35.3
13.9
9.3
8.4
7.9

N. Africa, ME

Storage

TelnetWork Appliance

S-S Africa

FTP
RegionSurveillanceHome Router

SurveillanceHome Router

Table 12: Vendors with Weak FTP and Telnet Credentials by Region—We show the top five vendors in each device type by
region that exhibit weak FTP or Telnet credentials. In most cases, a small handful of vendors are responsible for most of the
weak devices.

17