Am I Infected? - Lessons from Operating a Large-Scale IoT Security Diagnostic Service

Aug 21, 2026

Home IoT security is often treated as a user responsibility, yet many owners lack clear guidance on what actions to take. In February 2022, a web service was launched to scan Japanese users’ IoT devices and assess security posture and malware infection risk. Results from 114,747 engaged users (Feb 2022–May 2024), a large-scale evaluation survey (n=4,103), and a remediation-focused investigation (n=90) show notifications for vulnerable devices and malware infections. The service reported no issues for 99% of users and delivered positive evaluations for reassurance, free access, and short diagnosis time.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages19

Reading Time48 min

AccessFree to download

Abstract

Introduction

Motivation and background

Service overview and research questions

Study design and evaluation approach

Am I Infected? Lessons from Operating a Large-Scale IoT Security Diagnostic Service Takayuki Sasaki, Tomoya Inazawa, and Youhei Yamaguchi, Yokohama National University; Simon Parkin and Michel van Eeten, Delft University of Technology/ Yokohama National University; Katsunari Yoshioka and Tsutomu Matsumoto, Yokohama National University [https://www.usenix.org/conference/usenixsecurity25/presentation/sasaki](https://www.usenix.org/conference/usenixsecurity25/presentation/sasaki) This paper is included in the Proceedings of the 34th USENIX Security Symposium . August 13–15, 2025 • Seattle, WA, USA 978-1-939133-52-6 Open access to the Proceedings of the 34th USENIX Security Symposium is sponsored by USENIX. Am I Infected? Lessons from Operating a Large-Scale IoT Security Diagnostic Service Takayuki Sasaki 1§ , Tomoya Inazawa1§ , Youhei Yamaguchi1 , Simon Parkin2 , 1 , Michel van Eeten2 , 1 , Katsunari Yoshioka 1 , and Tsutomu Matsumoto 1 1 Yokohama National University, 2Delft University of Technology Abstract There is an expectation that users of home IoT devices will be able to secure those devices, but they may lack information about what they need to do. In February 2022, we launched a web service that scans users’ IoT devices to determine how secure they are. The service aims to diagnose and remediate vulnerabilities and malware infections ofIoT devices of Japanese users. This paper reports on findings from operating this service drawn from three studies: (1) the engagement of 114,747 users between February, 2022—May, 2024; (2) a large-scale evaluation survey among service users (n = 4 , 103), and; (3) an investigation and targeted survey (n = 90) around the remediation actions of users of non-secure devices. During the operation, we notified 417 (0.36%) users that one or more of their devices were detected as vulnerable, and 171 (0.15%) users that one of their devices was infected with malware. The service found no issues for 99% of users. Still, 96% of all users evaluated the service positively, most often for it providing reassurance, being free of charge, and short diagnosis time. Of the 171 users with malware infections, 67 returned to the service later for a new check, with 59 showing improvement. Of the 417 users with vulnerable devices, 151 users revisited and re-diagnosed, where 75 showed improvement. We report on lessons learned, including a consideration of the capabilities that non-expert users will assume of a security scan. 1 Introduction Users are exposed to a lot of generic security advice. It is hard to prioritize which of these actions they need to focus on – leading some experts to observe a “crisis of advice prioritization” [47] . One mechanism to help this prioritizationis to tailor the advice to evidence of the actual risks that the specific user faces. Web services have emerged to serve that purpose. Think of web services which allow users to check whether their personal credentials have been breached, such as § Two authors contributed equally to this work. [haveibeenpwned.com](haveibeenpwned.com) [4]; IP reputation services that inform users whether their IP addresses are involved in malicious activities such as scanning or spam [19, 35]; and services that check exposed TCP services on routers or hosts [32, 45, 53] . An alternative approach is to scan via browser extensions (e.g., [54]), but they require users to find and install software on their machine, so it is less accessible and requires higher levels of trust than a web service. In February 2022, we launched am I infected?, a web service supporting Japanese users to diagnose and remediate vulnerabilities and malware infections for their IoT devices. Many IoT devices are exposed to the Internet [1, 6, 22] and regularly get infected by malware such as Mirai [11, 13] . To mitigate these issues, notification campaigns have been launched to inform owners of vulnerable or compromised devices, either by ISPs [18] or b

FAQs

What does the IoT security diagnostic service do for users?

It scans users’ IoT devices to assess security vulnerabilities and detect malware infections. It also supports users in remediating the issues identified by the scan.

How many users engaged with the service, and what outcomes were observed?

The service engaged 114,747 users from February 2022 to May 2024. During operation it notified 417 users of vulnerable devices and 171 users of malware infections, while 99% of users had no issues found.

What did users most value in their evaluation of the service?

Among evaluated users, 96% responded positively. The most common reasons were reassurance, being free of charge, and short diagnosis time.

Aug 21, 2026

Upload by Olivia Brown