# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 5 MQTT-SN Attacks and Performance Evaluation
### Information Leaks  
Another security weakness of MQTT-SN is that (by default) it might be possible to subscribe to all the topics, which, in many cases, can have serious consequences. The intrinsic problem is that the topics in MQTT-SN are defined as a structured hierarchy. For example, we could subscribe to or publish on the topic referred to as _house/bedroom2/sensor1_. This structure is perfectly valid for a house with several bedrooms and a few sensors inside each room. In this example, we can subscribe to all the topics from all the bedrooms by simply subscribing to _house/#_. The # operator will obtain a subscription to all the rooms in the house. Furthermore, if we subscribe to the /# topic, we will subscribe to all the topics in the broker. It is useful to understand that when the # character is used, it is not mapped to a numeric _Id_. In addition, when a client subscribes to a topic, you can use the name, the _ld_ of the topic, or the short name of the topic, which can lead to obtaining sensitive information by using the # character. It could be possible to prevent subscription to /#, as this receives a simple solution in MQTT in which there are no short topics, with each topic being linked to a number. However, if the attack is against an MQTT-SN network, the attackers could use the short name format to iterate over possible topics easily. They could also use the topic _ld_, since, as it is encoded with two octets, its iteration is feasible. Once the attacker manages to subscribe to all the topics, they obtain access to all the messages in the network, even if we have sensitive information in them. This implementation is not a classic eavesdropping attack in which a Man in the Middle (MitM) scheme is sought as a general rule. In this case, it is necessary to subscribe to the topics, with the vulnerability consisting of the possibility of subscribing to unknown topics.  
Figure 6: Trash injection attack evaluation diagrams. (**a**) Expected against unexpected packets. (**b**) Cumulative traffic of baseline scenario vs. trash injection attack scenario.  
As we can see in Figure 7, packets of type _Subscribe_ are used, and the attackers only need to manipulate the _topic Id_ field to subscribe to the topic of their choice.  
Figure 8 shows the scheme of the attack. As we can see, the attacking device tries to subscribe to all topics by iterating the numeric _Id_. In this way, the malicious device is able to extract information from all the topics in the system.  
Evaluation of Information Leak Attack  
This attack can be dangerous if the system is misconfigured. In this case, an attacker can subscribe to any topic in the system and retrieve all the information generated in the IoT network. Figure 9 shows how easily an attacker can access confidential information. This protocol is highly vulnerable to this type of attack because the publish/subscribe scheme means that the attacker does not need a previous man in the middle attack to carry it out.  
Although this attack does not modify the behavior or performance of the network, it greatly impacts the confidentiality of the system. This can be avoided by making use of MQTT-SN's built-in authentication.  
Figure 8: MQTT-SN information leak scheme.  
Figure 7: Subscribe packet format.