netidee Scholarships: The Internet of Insecure Things

In her dissertation, Carlotta Tagliaro analyzes security issues in IoT devices, apps, and backend systems. Among other things, she highlights the tracking practices of smart TV broadcasters.

The study combines system analyses, large-scale Internet measurements, and user-centered studies. IoTFlow, a static analysis technique, is introduced und used to examine nearly 10,000 Android companion apps for IoT devices and identify insecure practices such as hard-coded credentials or openly accessible test interfaces.

Building on this, IoT backends are analyzed using the MQTT, CoAP, and XMPP protocols. The results reveal widespread vulnerabilities, including data leaks, weak authentication methods, and denial-of-service risks. In coordination with the Dutch National Cyber Security Center, the discovered vulnerabilities are disclosed, and thousands of operators are notified.

In addition, this study examines data protection risks in the HbbTV ecosystem and highlights widespread tracking and violations of data protection guidelines. A user study involving 213 participants also reveals significant discrepancies between perceived risks and actual security behavior. The findings provide important insights for technical and regulatory security measures in the IoT.

June 2026

More information