Korea's IoT Security Certifications Halve as Home Camera Hacks Rise

South Korea issued just 31 IoT security certifications this year through December 6 — a 47% drop from 59 a year earlier, and the second straight annual decline from 106 in 2024. The collapse comes as AI-powered hacking threats spread to Internet of Things (IoT) devices, with home IP cameras, IPTV set-top boxes and Wi-Fi routers emerging as prime channels for privacy leaks.

The numbers expose a framework still in its infancy, critics say. South Korea's IoT market was worth about 30 trillion won ($20.4 billion) last year, yet total certifications issued through this year number fewer than 600.

What did the camera inspection find?

The Korea Internet & Security Agency (KISA) and the Korea Consumer Agency jointly inspected the security of 10 IP camera models and urged manufacturers of vulnerable products to make prompt improvements, security industry sources said on the 15th.

The inspection found vulnerabilities in three products — Roboview, Vstarcam and Finevu. Inadequate user authentication procedures could expose private information in all three.

The flaws are concrete, not theoretical. Attackers could bypass authentication to download images and video stored on another person's camera without permission, or forcibly activate and manipulate the camera, the inspection confirmed.

Are routers and set-top boxes also at risk?

Yes. The problem extends well beyond home cameras. IPTV set-top boxes and Wi-Fi routers installed in homes can also become cyberattack targets, because hackers can exploit security flaws in the devices to install malicious applications or steal personal information.

A report released by Google Threat Intelligence Group on the 2nd found malware embedded at the manufacturing stage in more than 1.3 million Android TV set-top boxes worldwide. Google has since blocked servers and domains linked to the malware that infected those devices.

Domestically, KT is moving on its own. The carrier established security standards in July covering the purchase and deployment of service devices including set-top boxes, Wi-Fi equipment, modems and internet phones, and is strengthening its security framework.

Why are certifications falling?

Institutional support remains inadequate, and the structure of the system explains much of the shortfall. The domestic security certification system operates mainly on a voluntary basis. Certified products are therefore concentrated in a few categories such as wall pads and digital door locks.

What does this change for manufacturers and consumers? For now, very little — most products on shelves carry no certification at all, and buyers have no easy way to verify a device's security posture.

That has prompted calls for an overhaul. In a report published in July, the National Assembly Research Service proposed selectively mandating security certification for high-risk IoT devices that have a significant impact on public safety.

For low-risk devices, the research service recommended a different route: a simplified certification system that verifies manufacturers' own test results. The goal is easing the burden on small and mid-sized manufacturers, who face the heaviest compliance costs relative to their size.

How are overseas regulators responding?

Regulators abroad are tightening IoT security rules, and the contrast with Korea's voluntary approach is stark.

• United States: The Federal Communications Commission has effectively banned imports and sales of new models of consumer network routers manufactured abroad, citing national security concerns.
• European Union: Under the Cyber Resilience Act, manufacturers must report major vulnerabilities and security incidents since September this year. From December next year, the bloc will fully apply mandatory security requirements to products sold within it.
• United Kingdom: Britain has enforced the Product Security and Telecommunications Infrastructure Act since 2024. The law bans default passwords and requires manufacturers to disclose how long they will provide security updates.

What comes next?

Korea's certification slide — 106, then 59, now 31 — tracks in the opposite direction from every major Western regulator. The National Assembly Research Service's July proposal offers a middle path: mandatory certification where public safety is at stake, simplified self-verification elsewhere.

For a 30-trillion-won market with fewer than 600 certified products in total, the gap between deployment and assurance keeps widening. Until the system changes, the KISA and Consumer Agency finding stands as the practical reality: three of ten inspected cameras let an attacker bypass authentication and pull private footage. No certification system caught them first.