She tested 210 smart devices. Here's what they're hiding | IoT with Anna Maria Mandalari
Many smart devices, from speakers to TVs, constantly collect and transmit user data to third parties, often without explicit consent or
The vibe: data-heavy · research-focused · alarming · solution-oriented · slides referenced
The idea
- Smart speakers frequently misactivate and record conversations, sending audio data to cloud services outside privacy jurisdictions.
- Smart TVs use automated content recognition to snapshot screens and audio, profiling user viewing habits even when used as dumb displays.
- Medical IoT devices, like glucose sensors, are vulnerable to simple hacking methods that can manipulate data or disable functionality.
“Your data today may influence the behavior of your children or grandchildren tomorrow.”
Mind shifts
- You'll see your smart devices as potential data collection points, not just convenient gadgets.
- You'll question the privacy settings and data transmission practices of every internet-connected device you own.
- You'll start asking for more transparency and control over how your personal data is used by technology companies.
The number
Samsung is taking screenshots of what you're watching every 500 milliseconds while LG is only capturing audio every 10 milliseconds.
The full picture
Anna Maria Mandalari's research reveals that many internet-connected devices, from smart speakers to medical devices, routinely compromise user privacy and security. Her team tested over 210 different IoT devices in labs across the UK and US, finding that data from UK devices often travels to countries like China, where privacy regulations are less stringent. Smart speakers, for instance, frequently misactivate and record conversations, sending these recordings to cloud services, often without the user's knowledge. Similarly, smart televisions employ automated content recognition (ACR) to take snapshots of screens or capture audio every few milliseconds, even when users opt out or use the TV as a "dumb" display, sending this data to third-party services like Google Analytics.
The research also exposed significant vulnerabilities in smart medical devices. Using a simple £15 dongle, Mandalari's team demonstrated how easily they could sniff traffic, manipulate data, or perform denial-of-service attacks on devices like glucose sensors. This manipulation could potentially lead to life-threatening situations if connected to insulin pumps. The study found that for all tested medical devices, at least one type of attack was possible, highlighting critical security flaws.
Furthermore, commercial IoT safeguards designed to protect home networks often fall short. Mandalari's team tested every available safeguard on the market and found that most failed to detect common threats like port scanning or denial-of-service attacks. Many safeguards also contacted third-party tracking services themselves and could slow down network traffic. The study revealed that these safeguards frequently send user metadata to their own servers for processing, creating another privacy concern.
To address these issues, Mandalari advocates for technology that enhances privacy and security by default, particularly solutions operating at the network edge. Her team developed an AI-driven system that identifies and blocks non-essential traffic from IoT devices, including third-party destinations, without affecting device functionality. They also explored using power consumption patterns to detect attacks, demonstrating that technology can help enforce regulations and empower users with control over their data. New EU regulations, mandatory from December 2027, will require IoT devices sold in Europe to be certified against cybersecurity requirements, offering a step towards a more secure IoT ecosystem.