Infected IoT Devices

Since its deployment in 2019, the monitor has captured more than 30,000 infected IoT devices within Dutch networks. However, these infections are not all static; that is, some devices get remediated while new devices get infected. Even though the total number of infected devices in the last 13 months is of the order of tens of thousands, the average number of infected IoT devices is about 123 per day. This number of infections in the Netherlands is quite low compared to other European countries, and only around 1 ‰ Internet users is infected.

The monitor has identified multiple types of devices getting infected, being Network Attached Storage units and IP cameras the most commonly infected device types. Since the end of December 2019, a single manufacturer is responsible for more than 80% of the infections in the Netherlands (see Manufacturer 10 in the figure). Other device manufacturers, that drive IoT infections worldwide, represent less than 10% of the total number of infections the Netherlands.

So far the data captured by the monitor demonstrates that the number of infected devices in the Netherlands is not as critical as media reports have claimed. Nevertheless, the monitor has already shown that the landscape of infections is really volatile and the appearance of a new exploits can dramatically increase the number of infections suddenly. The pervasive presence of vulnerabilities in IoT products give attackers a myriad of possibilities to infect devices ad libitum.