Millions of people still run smart home and IoT companion apps, the apps used to control devices like smart plugs, cameras, and thermostats, that stopped receiving updates years ago.
Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT apps and found that nearly three in four contained software dependencies associated with documented vulnerabilities.
The team built its dataset from AndroZoo, a large archive of Android apps, then filtered for companion apps tied to IoT devices. They defined an app as abandoned if it had gone two years without an update or had disappeared from the Google Play Store by March 2025. Most of the apps that met that bar had been pulled from the store entirely, with a smaller group still listed but untouched by developers for years, the researchers wrote.
Dataset collection methodology (Source: Research paper)
Abandonment did not mean small audiences, they noted. Most of the apps in both groups had racked up thousands of installs, and a dozen had passed 100 million downloads before development went quiet.
“On the Google Play Store alone, 5% of the top 1,000 mobile applications are updated less than once per year, and a recent study found that 869,000 apps on Google Play Store had not received any update in over two years,” researchers noted.
“This degree of abandonment is particularly alarming given that users expect that IoT devices remain in active use for roughly a decade on average, a lifespan that far outlasts the maintenance commitments from vendors for companion applications.”
“Consequently, many users are left relying on unmaintained or delisted applications to manage sensitive IoT data, significantly broadening their security exposure,” they added.
Old code, old servers
Most of the abandoned apps bundle software libraries associated with known vulnerabilities logged in the National Vulnerability Database, the study found, and most of those flagged issues fall into the higher severity tiers.
The app code also holds thousands of hard-coded web addresses, they reported. About a quarter of the unique domains they extracted no longer resolve at all, and every app contained at least one FQDN, a complete web address like a server name, that failed the DNS reachability test, although some of those results may reflect internal endpoints, nameservers or extraction errors rather than genuinely abandoned infrastructure.
Abandoned applications represent persistent attack vectors, the researchers wrote, since a maintained app can respond when an endpoint breaks and an abandoned one cannot. A sample check of domain registration history found that a modest share of still-active domains had changed hands since the app’s last update, affecting over 2,000 apps.
A separate scan matched roughly one in nine extracted web addresses against threat intelligence blocklists and found hundreds of exact matches for phishing, scam, spyware, and malware links. More than two-thirds of the apps in the dataset contained at least one blocklisted domain.
Sensitive data with nowhere safe to go
The apps ask for permissions that go beyond basic connectivity. External storage access, precise location, and camera access each showed up in tens of thousands of the apps, according to the researchers. Data collected under these permissions travels almost entirely over Wi-Fi, they wrote.
The sharpest abandonment-specific gap in the study: 38.4% of unique data-flow sources and sinks were associated with domains classified as unreachable, blocklisted or under changed ownership. Running the same pipeline against 500 of the most-installed IoT apps that had received an update since March 2025, they found this problem in less than 1% of that active group.
A modest share of the abandoned apps use non-recommended algorithms such as DES, MD5, or RC4, the researchers found, lower than the rate they measured among the active comparison apps. They interpreted this finding as a sign that outdated cryptography is a habit throughout the IoT app ecosystem generally, not something specific to abandonment.
Disclosure prompts fixes and app removals
Researchers identified thousands of apps in the dataset with a developer contact address and emailed a large batch of them starting in mid-June.
Close to one in five messages bounced as undeliverable, they reported. Of the replies received, a small number of vendors pulled their app from Google Play, a similar number said the flagged vulnerability did not apply to their product, and a slightly larger group acknowledged the issue and said they were working on a fix.
A vendor confirmed two Tuya SDK vulnerabilities in an app still listed on Google Play and said the flaw had been fixed on Tuya’s cloud platform, since the client-side code could not be patched directly.
The gap between old and new
CVE-associated dependencies appeared at broadly similar rates in both groups: 73.6% of abandoned apps and 69.8% of the active comparison set. Deprecated cryptography was more common in the active group, appearing in 17% of those apps compared with 8.4% of abandoned apps.
Broken destinations for sensitive data showed a much larger difference. The study found that 40.8% of unique data sinks in abandoned apps were associated with vulnerable or unreachable endpoints, compared with just 0.4% in the active comparison group.