How Do Smart Home Devices Get Hacked? A Protection Plan That Starts at Your Router

TL;DR: Smart home devices are mostly taken over in four ways: factory passwords nobody changed, software nobody updated, cheap devices that arrive already infected, and ports left open to the internet. A hijacked device almost always has to talk to a server outside the home to do its job, and that conversation usually starts with a DNS lookup. A DNS filter on your router cuts those lookups to known malicious addresses for every device in the house at one point. It does not end hacking on its own; together with passwords, updates and network separation, it is the widest-reaching layer you have.

Most of us learned to protect the computer at home. The TV, the robot vacuum, the camera, the smart plug and the streaming box in a child's bedroom have not built the same habit. Most of them have no screen, no antivirus and no notification telling you an update is waiting.

This guide shows how these devices are taken over, using real cases. Then it spells out which link in that chain a DNS filter on the router cuts and which one it cannot. It ends with a plan you can finish in one evening.

Why smart devices are easy targets

What sets a smart device apart from a computer is that nobody looks at it.

• It stays on for years. The router, camera and TV box are online day and night and nobody restarts them.
• Updates are left to you, or never come. Many devices stop getting updates after a few years but keep working.
• The same software runs on thousands of devices. When a flaw is found, every copy of that model is exposed at once.
• You see no symptoms. A device without a screen won't tell you it has slowed down or started talking to someone else.

Together these make smart devices a cheap, quiet target.

Four ways devices get hacked

1. Factory passwords nobody changed

The oldest route, and still one of the most effective. In late 2016 the Mirai malware scanned the internet for cameras and video recorders and tried a short list of factory passwords on each. According to the research published at USENIX Security in 2017, Mirai infected 64,500 devices in its first 20 hours and reached roughly 600,000 at its peak. Together those devices launched some of the largest denial-of-service attacks seen up to that time.

What made Mirai possible was not a sophisticated technique. It was a password nobody had changed.

2. Software nobody updated

Changing the password may not be enough: if the device's software has a known flaw, an attacker can get in without being asked for a password at all. In September 2024 the FBI and partner agencies announced a court-authorised operation against a network of more than 260,000 devices that US authorities linked to a state-sponsored group. The devices were home and small-office routers, IP cameras, video recorders and network storage devices. The agencies advised owners to install updates.

3. Devices that arrive infected

This route is the least known, because the owner has done nothing wrong. In a warning issued on 5 June 2025, the FBI described a network spanning millions of devices: TV streaming boxes, digital projectors, aftermarket car infotainment systems and digital picture frames. The devices were either loaded with malware before purchase or infected during setup through apps carrying a backdoor. In July 2025 Google sued the groups behind the same network and said it affected more than 10 million uncertified devices.

The warning signs the FBI listed are worth knowing before buying any streaming box:

• A brand you don't recognise
• Sold as "all channels free" or "unlocked"
• Asks you to turn off the device's security protection during setup
• Apps downloaded from an unofficial app store
• Internet traffic you can't explain

4. Ports left open to the internet

A port opened on the router to watch a camera from outside, or UPnP letting the router open ports by itself, makes the device directly visible from the internet. The device then puts itself in front of scanners like Mirai. A related risk: a manufacturer cloud account protected by a password you also use elsewhere. When that password leaks, the attacker comes in through the app, not the router.

What a hijacked device does in your home

What interests the attacker is usually not the device itself but your internet connection:

• It joins attacks. Thousands of devices send traffic to one target at the same time.
• It rents your connection to others. The network in the FBI's 2025 warning sold hijacked home networks as a relay for criminal activity. That traffic looks to the outside world as if it came from your home.
• It commits ad fraud in the background. It clicks ads you never see and uses up your bandwidth and data.
• It gains access to a camera or microphone. That depends on what the device can do.
• It becomes a stepping stone. Phones and computers on the same network can be the next target.

The weak link in the chain: the device has to talk to the outside

The four routes above have one thing in common. A hijacked device is useless on its own. It has to receive commands, download more software and report back. For that it connects to a server outside, and that server's address is usually a domain name. Before connecting, the device asks DNS for that name's number.

The Mirai researchers measured the botnet's size from exactly these questions: at a large US internet provider they counted the DNS lookups for the domain names of Mirai's command servers. In other words, the hijacked devices were asking for those addresses regularly, without showing their owners anything.

This is where a DNS filter comes in:

Hijacked device
   |  "where is server.example?"
   v
DNS filter on the router
   |
Known bad address?
   |
   +-- YES -> empty answer,
   |          no connection
   |
   +-- NO  -> real address,
              connection made

If the filter recognises the address, the device cannot reach the server: no commands arrive, no extra software downloads, and your connection cannot be rented out. Doing this on the router does it for every device in the home at once, without installing anything on any of them.

There are two conditions. The address has to be on a blocklist; a brand-new domain can slip through until it is listed. And the malware has to reach its server by name; software that connects straight to an IP address never asks DNS at all.

What Guardino on the router cuts, and what it doesn't

I want to draw this line clearly, because "I put a DNS filter on the router, the house is safe" leads to trusting protection that isn't there.

What Guardino cuts:

• Lookups for known malware and phishing domains, for every device in the home.
• Ad and tracker domains, so devices talk to those servers less in the background.
• The names of known public resolvers and VPN and proxy services used to get around the filter. This protection is on for every customer; the guide to stopping VPN bypass explains what it covers.
• Every new device that joins the home, with no setup.

What Guardino doesn't cut:

• It doesn't change factory passwords or update a device's software.
• It doesn't close a port you left open on the router; it doesn't see connections coming in from outside to a device.
• It doesn't see attacks from one device to another inside the home network.
• It can't stop software that connects to its server by IP address, or a device with a DNS address hard-coded into its software.
• It doesn't recognise a new malicious address that isn't on the lists yet.

So a DNS filter is part of the plan, not all of it. But it is the widest-reaching part: no other measure covers every device in the home with one setting and without touching any of them.

Setting it up on the router: check this first

I need to be straightforward here too. Guardino tells profiles apart through encrypted DNS: every profile has its own DoH address and its own DoT hostname. We don't offer unencrypted classic DNS. So to set Guardino up on a router, the router has to support encrypted DNS.

Many routers supplied by internet providers have no such setting. In practice there are three routes:

1. If your router has an encrypted DNS setting: look for a field named "DNS over TLS", "DNS over HTTPS" or "Secure DNS". Enter the address shown for your profile on the setup page. If the field asks for a web address, use the DoH address; if it asks only for a name, use the DoT hostname.
2. Put your own router behind the provider's router: buy a router that supports encrypted DNS, connect it to the provider's router and move your smart devices onto its network. Guardino then goes on the new router. This is usually the cleanest way to cover the whole home. Setting up encrypted DNS on your router walks through the options.
3. Run a small forwarding resolver on your network: a small always-on device forwards the home's lookups to Guardino over encrypted DNS, and the router hands out that device as the DNS server. It takes some technical know-how, but works without replacing the router.

Whichever you choose, I recommend also setting up a profile on phones and computers: a configuration profile on iPhone, the profile's own Private DNS hostname on Android. That way the protection carries on when they leave the house.

Two consequences of a router setup are worth knowing. First, the dashboard sees every lookup that arrives through the router as a single client; to tell which device asked, set the profile up on that device too. Second, because the router ties all of the home's DNS to one resolver, devices at home cannot resolve names if that resolver can't be reached. Some routers fall back to a second address in that case and some don't; check your router's settings.

A one-evening smart home security plan

Work through this list from top to bottom. Each step closes a gap the one before leaves open.

1. Change the router's admin password. Turn off remote management if it has it.
2. Change every device's factory password. Turn on two-step verification for the manufacturer's cloud account and don't use that password anywhere else.
3. Turn on automatic updates. If an old camera or box no longer gets updates, consider retiring it.
4. Turn off UPnP on the router and remove any ports you opened for cameras. Watch cameras remotely through the manufacturer's own app. If a device such as a games console really needs a port, open it for that device only.
5. Move smart devices to the guest network. Keep phones and computers on the main network. Check that the isolation that stops guest devices seeing each other is switched on.
6. Set Guardino up on the router or your own router, and add profiles to phones. Pick whichever of the three routes above suits you.
7. Look at the brand when buying a TV box or camera. Avoid anything without an official app store, anything promising "everything free", and anything that asks you to turn off security protection during setup.
8. Take devices you don't use off the network. The old camera in the drawer may still remember your Wi-Fi password.
9. Once a month, look at the router's list of connected devices. If you see one you don't recognise, change the Wi-Fi password.

After setup you can check with the leak test whether Guardino is really active on a device and whether tracker endpoints are still reachable. The test runs in the browser, so open it on a phone or computer behind the router.

What is changing around the world

Factory passwords are now a matter for the law too. In the UK, since 29 April 2024, connected devices sold to consumers may not ship with universal or easily guessed default passwords, and manufacturers must say before sale how long the device will get security updates.

In the European Union, the Cyber Resilience Act's duty for manufacturers to report actively exploited vulnerabilities started on 11 September 2026; the main security obligations apply from 11 December 2027. In the United States, the voluntary U.S. Cyber Trust Mark launched in January 2025: a label for devices such as home cameras, smart appliances and baby monitors that meet a set of baseline security standards.

These rules will make new devices safer out of the box. They won't change the devices already running in your home; those still depend on the plan above.

What sets Guardino apart here

• One door, the whole house. A single setting on the router covers the smart TV, the camera, the console and a guest's phone at once. A new device joins already protected.
• It carries on outside the home. A profile on a phone extends protection to mobile data and other Wi-Fi networks.
• The security baseline is on in every plan. Malware and phishing lists work on the free plan too. Details are on the pricing page.
• It sees domain names, not content. Query logging is off until you turn it on, and your data is not sold to advertisers. What we can and cannot see is spelled out on the transparency page.
• It says what it can't do. That is what the "doesn't cut" list above is for.

If you want the basics of DNS first, how DNS filtering works explains it in plain English.

Where to go from here

Smart home security isn't solved by buying one product. But it isn't heavy work either. Set aside an evening: change passwords, turn on updates, close ports you don't need, move smart devices to the guest network and put a filter on your router's door to the outside. After that, the chance that the devices in your home are quietly working for someone else drops noticeably.

You don't need a card to try Guardino. Set it up on your phone from the setup page first to see how it works, then move it to your router.

Sources

• Antonakakis et al., Understanding the Mirai Botnet, USENIX Security Symposium, 2017
• FBI, Home Internet Connected Devices Facilitate Criminal Activity, public service announcement, 5 June 2025
• U.S. Department of Justice, Court-authorized operation disrupts worldwide botnet, 18 September 2024; joint advisory: FBI, NSA and partners
• SecurityWeek, Google Sues Operators of 10-Million-Device Badbox 2.0 Botnet, July 2025
• The Hacker News, New U.K. Law Bans Default Passwords on Smart Devices Starting April 2024
• European Commission, Cyber Resilience Act: reporting obligations and summary of the Act
• The Hacker News, FCC Launches 'Cyber Trust Mark' for IoT Devices to Certify Security Compliance, January 2025