# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 5 MQTT-SN Attacks and Performance Evaluation
### Trash-Inject Attacks  
The first attack described aims to introduce unexpected elements into the legitimate MQTT-SN application. Before performing this attack, it is necessary to introduce a malicious device into the network. In order to do so, it is either necessary not to have an authentication mechanism or to gain access to the broker by guessing or having access to the credentials. In our implementation, we assumed that we had access to the network due to a lack of authentication mechanisms, which is something very common in MQTT and MQTT-SN servers [34], so a realistic scenario is proposed. Figure 3: MQTT-SN baseline scenario. Once that access to the broker has been gained, the attack consists of introducing malformed information in a specific topic or in a set of topics. The range of possibilities in this attack is very wide since, if the attackers know the logic of the application on which they are going to inject information, they may be able to modify its behavior arbitrarily. However, even without knowing the operation of the application into which malformed information is introduced, this attack can have a very negative impact. This attack requires prior knowledge of the system's topics, but by default, it is possible to subscribe to all topics using the # character, so knowing all the topics in the system is not a difficult task. Another possible way is to take advantage of the short topic name format of MQTT-SN as it is easy to scan topics when they are encoded with two characters. Figure 4 shows the format of the _Publish_-type packets. As can be seen, the packet fields that are key to carrying out the attack are marked in red. In this case, the _topic Id_ field indicates the topic where the malicious information is to be inserted, and the _data_ field contains the information to be entered. The content of these two fields may vary depending on the attacker's target. As mentioned above, if the attacker knows the logic of the system, he/she can inject specific data to cause a specific system failure. However, he/she can also introduce pseudo-random data (trash) to cause a system malfunction. Figure 5 shows how the attack works, with the attacker having the ability to inject messages into a used topic. The device on the right, which has a red background color, represents the attacking device. As can be observed, in this case, the attacker injects trash into topic 1 and the broker distributes that trash to all clients subscribed to that topic. It should be noted that this attack can be carried out by contaminating several topics simultaneously in a similar way. In our implementation, we only focused on one topic, because it is easier to quantify the impact in this way. Evaluation of the Trash Injection Attack  
Before diving into the evaluation, it is necessary to clarify that the baseline system works by publishing random numbers to simulate a sensor. Thus, our application expects a numerical value, and if it receives a different kind of data, it will not work properly. Figure 4: Publish packet format. Figure 5: MQTT-SN trash injection scheme. Figure 6a shows the expected topics (numbers) versus the unexpected values (character strings). This type of graph is recurrent throughout the paper, each point representing a packet, so that we can easily observe the behavior of the system. As we can see, the malicious device easily sends many malicious packets. This ability to inject traffic can lead to a malfunctioning of the MQTT-SN application. In this experiment, the client application receives text when it expects numeric data, what causes the application to stop working. However, in other applications, the consequences can be more negative, since an attacker is capable of injecting inject information into an application. Figure 6b shows the amount of accumulated bytes received by the broker over time, proving that this attack can be performed without significantly increasing the traffic. This kind of attack can be partially stopped if we enable the user/password request in our MQTT-SN network.