# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 3 State-of-the-Art  
As far as the authors of this paper know, there are currently few published studies about the shortcomings of IoT protocols. One of the few is _A survey: Attacks on RPL and 6 LoWPAN in IoT_ by [PERSON] and [PERSON] [22], which is focused on attacks in the Routing Protocol for Low-Power and Lossy Network (RPL) [23; 24]. The RPL protocol enables device routing in Low-power and Lossy Networks (LLNs), which are characterized by the fact that routers usually operate under severe power, memory, and network constraints. This protocol supports point-to-point routing, but also multipoint-to-point and vice versa. It is also highly scalable and can be successfully used with thousands of devices within the LLN. The attacks presented in this paper against RPL typically serve two distinct purposes. On the one hand, we have the attacks that allow a complete or partial denial of service of the network, for example the sinkhole attack. On the other hand, there are also attacks that allow attacking a specific device, e.g., the selective forwarding attack. Finally, there are others that allow the identity of devices to be hijacked to compromise network confidentiality, e.g., the alteration and spoofing attack. The authors also collected certain patterns so that a rule-based Intrusion Detection System (IDS) can be deployed with these patterns. Another interesting work is [25]. In this paper, the authors conducted a brief study of the Constrained Application Protocol (CoAP), a web protocol designed specifically for devices and networks with limited capabilities. In this paper, the authors used BurpSuite to analyze CoAP request traffic and concluded that the it is not encrypted and also susceptible to attacks. In [26], the authors describe several security issues with MQTT, but there were no implementations or evaluations of the described attacks. The attacks in this paper, moreover, made an ordinary use of the protocol, not presenting any use of it, which varies from what it is described in the standard. They also contemplated MQTT as a means to create a botnet, although this is not an attack against MQTT; it is the use of it as a means to establish a botnet. There are several other pieces of research that focus on ZigBee, which is a protocol for low-data-rate and short-range wireless networking. One example is [27], which shows two example attacks: one tries to achieve an eavesdropping attack on a ZigBee network where AES-CCM is used. In order to achieve this, the authors tried to use the same key twice, for example by causing a reset of the nodes. The other attack consists of performing a denial of service, for which they suggested modifying the payload of ZigBee packets, even if there is encryption, to cause an error in the operation of the protocol. In _Exploiting MQTT-SN for Distributed Reflection Denial-of-Service Attacks_ by [PERSON] et al. [28], the authors suggested to make use of the topology used by MQTT-SN to perform a pro-reflective attack. In other words, they took advantage of the fact that the broker sends messages to all devices subscribed to a topic to perform denials of service against the MQTT-SN network. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Length** & **MsgType** & **ClientId (Optional)** \\ \hline Octet number & 0 & 1 & 2:n \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Pingreq message format. A particularly interesting work is _IoT Content Object Security with OSCORE and NDN: A First Experimental Comparison_ by [PERSON] et al. [29], which proposes the use of OSCORE, which is a protocol designed to protect end-to-end communications in resource-constrained systems. Its interest lies in them making a comparison with the use of DTLS, which is the encryption protocol usually implemented over UDP. Another interesting proposal that aims to adapt a lightweight encryption method to MQTT and MQTT-SN is the _Lightweight Security Scheme for MQTT/MQTT-SN Protocol_ by [PERSON] et al. [30].