  Internet of Things (IoT) is defined as the connection between places and
physical objects (i.e., things) over the internet/network via smart computing
devices. We observed that IoT software developers share solutions to
programming questions as code examples on three Stack Exchange Q&A sites: Stack
Overflow (SO), Arduino, and Raspberry Pi. Previous research studies found
vulnerabilities/weaknesses in C/C++ code examples shared in Stack Overflow.
However, the studies did not investigate C/C++ code examples related to IoT.
The studies investigated SO code examples only. In this paper, we conduct a
large-scale empirical study of all IoT C/C++ code examples shared in the three
Stack Exchange sites, i.e., SO, Arduino, and Raspberry Pi. From the 11,329
obtained code snippets from the three sites, we identify 29 distinct CWE
(Common Weakness Enumeration) types in 609 snippets. These CWE types can be
categorized into 8 general weakness categories, and we observe that evaluation,
memory, and initialization related weaknesses are the most common to be
introduced by users when posting programming solutions. Furthermore, we find
that 39.58% of the vulnerable code snippets contain instances of CWE types that
can be mapped to real-world occurrences of those CWE types (i.e. CVE
instances). The most number vulnerable IoT code examples was found in Arduino,
followed by SO, and Raspberry Pi. Memory type vulnerabilities are on the rise
in the sites. For example, from the 3595 mapped CVE instances, we find that
28.99% result in Denial of Service (DoS) errors, which is particularly harmful
for network reliant IoT devices such as smart cars. Our study results can guide
various IoT stakeholders to be aware of such vulnerable IoT code examples and
to inform IoT researchers during their development of tools that can help
prevent developers the sharing of such vulnerable code examples in the sites.
[Abridged].
