What are Attackers after on IoT Devices?

Installing a proxy, and then selling a “residential” proxy service can be quite lucrative. Residential IPs are generally treated with less suspicion in the risk systems of payment processors and merchants. Similar to the monetization models of “free” VPN providers on mobile phones.

Just a few thoughts on this. IoT is a very wide category of devices. The results will vary widely depending which sub-category a particular IoT attacker finds themselves with access to. As a generalization, attackers may be grouped into two categories, professional and amateur. A professional would be looking to monetize access whereas an amateur is seeking access for other reasons (voyeurism, technical challenge, etc). Of course, the categories can be made more or less granular - this is just to highlight that when discussing results, it is helpful to consider attacker motivations. Take the case of an IoT camera, for example. From an attacker perspective, an IoT camera offers two points of interest: broader access to the local network (ie: as a jumpbox), use as a bot in a botnet (which is directly monetizable), and voyeuristic access (that may be further leveraged for monetization). However, a consumer broadband router is a better suited target for both local access and botnet use due to both its position at the network gateway and its typically higher processing resources. But IoT is not limited to consumer devices - industrial control systems (automation, HVAC, etc), telecom (ie: cell towers), civic services (traffic lights, water treatment), payment processing (ATMs, PoS, etc), heavy equipment (mining, farming), etc, etc, all fall into the category of connected "things". The attack surface on any particular device will vary widely in each of these and the risks depend largely on the attacker motivations - an amateur who finds themselves with coincidental access to an electrical sub-station would arguably pose less risk than a nation-state attacker with targeted access.

Often they want to use them as a massive botnet for DDoS attacks.

If IoT devices means an old linux distro running on the wild, thats an always go for distributed network of devices ready to act.

In general, attackers can do anything. For example, they can find all the information about you through the Internet and take out what they need while you are not at home. In general, it's very sad. And I believe that this should not be. My husband and I talked and decided that we need to put an alarm system at home. And moreover, we decided to install Ajax because I read a lot of different articles and reviews and only good things were said about this company. I know that there is an application through which you can track everything and it is very convenient.

I was surprised to see Ireland pop up as one of the places with a significant number of connections to one of the honeypots. I’m not a security researcher, but hadn’t heard of Ireland as being a place with a lot of that sort of activity. Is this a well-known thing?

how are people performing intrusion detection on home iot devices?

I don't know if current IoT devices have the resources to mine cryptocurrencies, but it's been tried. Eventually someone will pull it off.

IP addreses.

Access, data, what have you.

IoT/Edge devices are also the "perfect tools" for phishing somebody for more valuable information than mere biometric/similar data.