hal.archives-ouvertes.fr/hal-03374399/document

I am not sure what to think of this.

Using TEMPEST to detect and identify malware on IoT devices?

Honestly, if embedded devices have a specific purpose, the manufacturer should be able to enumerate all the standard operating states and the expected emissions for all the states.

You might be able to detect an irregularity in the device based on the sound of the CPU, even.

But as with anything malware based, it wouldn't be surprising if the malware authors just find new methods to write malware that more closely resemble normal operation

It would be hard to hide a cryptominer, though. If your IoT lightbulb isn't supposed to be performing cryptographic operations, there's no way you could hide that without making the operations so slow as to be useless.

Well, then I guess the big question is, can it the detector detect malware on itself? Because the detector would probably be sort of an IoT device itself, wouldn't it?

Obviously you need a detector to detect malware on the detector

And a detector to detect malware on the malware detector detector

Turtles all the way down