# Security of IoT Application Layer Protocols: Challenges and Findings
## 6 Discussion  
Our analysis has highlighted that ensuring security of IoT products and services that leverage application layer protocols is not straightforward. In fact, the IoT threat landscape is extremely diverse and complex. The open nature of application layer protocols makes them exposed to a wide range of malicious attacks that exploit their peculiarities as well the characteristics of networked environments. Moreover, despite their potential vulnerabilities, IoT devices and services are often being developed and deployed without specific security consideration. Since IoT devices are being an integral part of our everyday life, it is compelling to protect these devices by properly identifying potential security risks and by devising adequate mitigation measures. As reported in Table 2, application layer protocols provide some common built-in security servicesalthough the constrained capabilities of these devices make their deployment quite challenging or even impossible. In addition, security services are often optional and must be explicitly enabled and configured by developers, thus leading to security risks related to their incorrect configuration. As shown in Table 3, another serious risk is associated with the lack of security services. In general, as main findings of this investigation, we discovered that frequent sources of risks refer to the lack of appropriate security services or to their incorrect configuration. In particular, mDNS and SSDP are very weak because they do not offer any built-in security service. On the contrary, although messaging protocols offer various security services, they suffer from the incorrect configuration of these services. In addition, the lack of built-in authentication/authorization mechanisms or the use of weak mechanisms make IoT devices vulnerable to unauthorized accesses. Similarly, the incorrect configuration of TLS or the use of weak cipher suites make devices vulnerable to the disclosure of sensitive data. These findings have been confirmed by the analysis of the CVEs of products and services based on the protocols considered in this paper. More precisely, many vulnerabilities refer to improper message validation/parsing (e.g., buffer overflow, option/exception validation) and to weak authentication/authorization mechanisms (e.g., username/hostname validation, certificate verification). Our investigation has also shown that vulnerabilities are appearing with an increased frequency, although with differences from protocol to protocol (see Figure 3). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Protocol** & \begin{tabular}{c} **Authentication** \\ **Service** \\ \end{tabular} & \
\begin{tabular}{c} **Authorization** \\ **Service** \\ \end{tabular} &
\begin{tabular}{c} **Encryption** \\ **Service** \\ \end{tabular} \\ \hline MQTT & \(\triangle\) & \(\triangle\) & \(\triangle\) \\ \hline CoAP & \(\square\) & \(\triangle\) & \(\triangle\) \\ \hline AMQP & \(\triangle\) & \(\triangle\) & \(\triangle\) \\ \hline DDS & \(\triangle\) & \(\triangle\) & \(\triangle\) \\ \hline XMPP & \(\triangle\) & \(\triangle\) & \(\triangle\) \\ \hline mDNS & \(\square\) & \(\square\) & \(\square\) \\ \hline SSDP & \(\square\) & \(\square\) & \(\square\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Summary of the major security risks affecting the services of the application layer protocols analyzed in this paper. The squares refer to the lack of the security service, while the triangles to its incorrect configuration. Figure 3: Breakdown of the CVEs per year and protocol. Moreover, these CVEs are characterized by different severity ratings (see Table 4). The Common Vulnerability Scoring System (CVSS), at the basis of these ratings, provides a numerical score and the corresponding qualitative representation, i.e., Low, Medium and High, reflecting the CVE severity. For each protocol, Table 4 reports the breakdown of the number of CVEs according to their severity as well as the overall CVSS score.