Which security risk is specific to Internet of Things (IoT) devices?

Which security risk is specific to Internet of Things (IoT) devices?

• A. Outdated antivirus software on IoT devices.
• B. Insecure default credentials leading to botnets or remote hijacking.
• C. IoT devices cannot be hacked.
• D. IoT devices only use local networks.

Answer: (B)

Insecurity due to default credentials is a major risk for IoT devices. Many IoT products ship with factory usernames and passwords that users don’t change, and some even have hard-coded credentials. This makes them easy targets for automated attackers who scan the internet for devices with those weak logins. Once compromised, these devices can be enlisted into botnets or taken over remotely, enabling further attacks or data access. The sheer number and variety of IoT devices, combined with limited user interfaces for changing settings and often minimal update mechanisms, mean these default credentials can persist and be exploited at scale. The other options don’t fit as well. Outdated antivirus isn’t the defining IoT risk because many IoT devices don’t run traditional antivirus solutions and the core issue is weak authentication rather than antivirus status. Saying IoT devices cannot be hacked is simply false. And claiming they only use local networks ignores the reality that many IoT devices connect to cloud services and the internet, expanding the attack surface.

Insecurity due to default credentials is a major risk for IoT devices. Many IoT products ship with factory usernames and passwords that users don’t change, and some even have hard-coded credentials. This makes them easy targets for automated attackers who scan the internet for devices with those weak logins. Once compromised, these devices can be enlisted into botnets or taken over remotely, enabling further attacks or data access. The sheer number and variety of IoT devices, combined with limited user interfaces for changing settings and often minimal update mechanisms, mean these default credentials can persist and be exploited at scale.

The other options don’t fit as well. Outdated antivirus isn’t the defining IoT risk because many IoT devices don’t run traditional antivirus solutions and the core issue is weak authentication rather than antivirus status. Saying IoT devices cannot be hacked is simply false. And claiming they only use local networks ignores the reality that many IoT devices connect to cloud services and the internet, expanding the attack surface.