# Security of IoT Application Layer Protocols: Challenges and Findings
## 4 Messaging Protocols
### CoAP  
Constrained Application Protocol (CoAP) is an emerging open web transfer protocol whose latest specifications are defined in RFC 7252 published in 2014 [41]. Although CoAP shares many characteristics with the HTTP protocol, it has been specifically designed for constrained devices with limited energy, processing power, storage space and transmission capabilities.  
As already discussed, CoAP supports the usage of the Datagram Transport Layer Security (DTLS) protocol, a UDP implementation of the TLS protocol that provides equivalent security guarantees [42]. The DTLS binding for the CoAP protocol is defined in terms of four security modes that differ in authentication and key negotiation mechanisms and range from no security to certificate-based security.  
In this framework, it is up to developers to find the best tradeoff between performance/energy constraints and security requirements. Of course, the lack of appropriate security services could allow attackers to easily compromise CoAP environments.  
From the analysis of the possible security threats of CoAP-enabled devices, we identified the potentially vulnerable processes and we produced the following classification:  
* _Message parsing_: the processing logic of client and server parsers does not properly handle incoming messages. This vulnerability could affect CoAP node availability because of overload conditions and even open the ability to remotely execute arbitrary code on the node under attack;* _Proxying and caching_: the access control mechanisms of proxies and caches are not properly implemented. This vulnerability could compromise their content, thus breaking confidentiality and integrity of CoAP messages;
* _Bootstrapping_: the setup of new CoAP nodes is not properly implemented. This vulnerability could grant unauthorized nodes the access to a CoAP environment;
* _Key generation_: the generation of cryptographic keys is not sufficiently robust. The usage of these keys could compromise CoAP nodes;
* _IP address spoofing_: by forging the IP addresses of CoAP nodes, an attacker could perform a variety of side attacks including the generation of spoofed response messages and acknowledgments as well as reflection/amplification attacks;
* _Cross-protocol exchanges_: an attacker sends a CoAP node a message with a spoofed IP address and a fake source port number; the response of this node will reach the node under attack and force it to interpret the received message according to the rules of the target protocol.  
The analysis of the few CVEs affecting products and services based on CoAP suggests that these vulnerabilities materialize differently. In particular, according to our classification, the most common security issue refers to improper message parsing. For example, some CoAP libraries mishandle invalid options or certain exceptions when receiving specifically crafted messages (e.g., CVE-2018-12679, CVE-2018-12680). Other libraries are affected by overflow vulnerabilities while processing an incoming message (e.g., CVE-2019-17212). The exploitation of these vulnerabilities could have different impacts, such as memory leak, Denial of Service as well as remote code execution, thus leading to serious effects on the entire CoAP system.  
The UDP protocol is also a vector used to attack the CoAP-enabled nodes. For example, certain CoAP server interfaces can be exploited for a Distributed Denial of Service attack using source IP address spoofing and traffic amplification. This vulnerability is a consequence of a specific response message mishandling (e.g., CVE-2019-9750).