Loading story…
Research by UCL and Inria using a large-scale IoT testbed reported widespread DNS security and privacy weaknesses across 30 consumer IoT devices (e.g., cameras, doorbells, lights, sensors, medical devices). Reported issues included lack of support for encrypted DNS (e.g., DoH/DoT/DoQ), device behaviors that can enable tracking/fingerprinting, and configurations such as hardcoded DNS resolvers that may bypass enterprise DNS controls—raising both privacy risk and operational/security monitoring challenges for network operators.
Separate consumer-oriented guidance emphasized using secure/“private” DNS services to reduce DNS traffic visibility to on-path observers (including ISPs) and recommended several public resolver options (e.g., Google Public DNS and others). A related ZDNET piece recommending alternative Android browsers over Chrome is primarily general privacy/security preference content and does not materially add to the DNS-focused findings beyond broad statements about browser targeting and privacy posture.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Infoblox published a blog post on IoT DNS security and privacy in collaboration with UCL and Inria. The reference indicates a research-focused publication but provides no further event details in the available content.
ZDNET published an overview arguing that encrypted DNS services such as DoH and DoT are important security and privacy controls, and recommended several public DNS providers with features like DNSSEC validation, anti-spoofing, and malicious-domain blocking. The article also summarized provider-specific privacy and logging practices for services including Google Public DNS, Cloudflare, Quad9, OpenDNS, NextDNS, and AdGuard DNS.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 9, 2026
Security experts and technology journalists have published a range of practical advice and strategies to help users protect their mobile devices and digital privacy. These resources emphasize the importance of operations security (opsec) for all users, including teenagers, and provide step-by-step recommendations for securing smartphones against theft, surveillance, and data compromise. Key measures include recording device identifiers like IMEI numbers, enabling tracking features such as 'Find My' on iOS and Android, using strong screen locks, and tightening lock screen access to prevent unauthorized use. The guidance also highlights the risks associated with default device configurations, the prevalence of tracking by major vendors, and the need for deliberate hardware and software choices to maximize privacy. In addition to technical setup advice, the content addresses broader privacy concerns, such as minimizing digital footprints on social media and streaming platforms, and making informed decisions about device brands and operating systems. Recommendations include opting for devices with long-term security support and unlockable bootloaders, avoiding brands with poor update policies or preinstalled telemetry, and considering privacy-focused alternatives like GrapheneOS or Linux-based phones for advanced users. The overall message is that while perfect privacy is challenging, users can significantly reduce their exposure to threats and surveillance through proactive configuration and awareness of evolving risks in the mobile ecosystem.
Jun 29, 2026