Dear researchers,

I am a German PhD student in business informatics. In my current paper I want to find out, how frequently user update/patch their IoT devices. Besides the fact that some manufacturers provide auto-updates or OTA-updates for their devices, I assume that there are still many devices (e.g. from smaller/unknown manufacturers) that need to be updated/patched manually by the user.

So far I found that it is not easy to identify the patch/update-status of these devices, if you don't have direct access to the device. Therefore, I came up with the following ideas. However, I still struggle to get a sufficient data base and would ask all the brilliant minds here. :) Once I have this information, I would consult each manufacturer's homepage and find the up-to-date version for comparison.

Question:

How can I get the firmware version of different IoT devices exposed to the internet (without logging in) even from non-reputable manufacturers and how can I identify the type of device?

Current approaches and ideas:

Search for keywords (firmware, version, date...) in the GET-results from the IoT search engines shodan.io and censys.io >> however, very few results, as a login on the admin-interface is needed in many cases (which is illegal)

Direct contacting manufacturers of IoT devices (Amazon, Google, Nest, Siemens, Bosch ...) >> (understandably) no company is willing to disclose information about the patch-status

Further ideas:

Receive data about patch status via MQTT (different approach for all devices needed)

Access via Telnet or SSH (however credentials are needed)

Identification of different open-source IoT OS (e.g Tasmota)

General traffic analysis (I would need to be connected to the network, which is impossible)

Challenge:

Different approaches needed for different devices and manufacturers

As I put a lot of brainpowers in my idea already, I would now like to ask the crowed for ideas that I did not come up with.

Thanks a lot for your ideas and help.

Frank