# Security of IoT Application Layer Protocols: Challenges and Findings
## 4 Messaging Protocols
### Mqtt  
Message Queue Telemetry Transport (MQTT) is an open standard messaging protocol that has been around for more than 20 years (OASIS Standard). The protocol--widely used presently in the IoT context--is simple, lightweight and ideal for IoT scenarios where saving computing power and network bandwidth is the priority. As already discussed, MQTT supports various authentication mechanisms as well as encryption based on TLS [20]. Nevertheless, these services are not sufficient to protect MQTT-enabled devices and in particular the broker component. It is worth mentioning that-- as reported in the MQTT standard and as demonstrated at DEFCON 24--many security risks are originated by broker misconfiguration and software vulnerabilities. These threats could be easily exploited for many malicious purposes. From the analysis of the possible security threats of MQTT-enabled devices, we identified the potentially vulnerable processes and we produced the following classification:  
* _Authentication_: the MQTT broker does not properly check the publisher/subscriber identity and does not block repeated authentication attempts. These vulnerabilities could grant an attacker the access to MQTT devices or could overload the broker and eventually make it crash;
* _Authorization_: the MQTT broker does not properly set the publishing/subscribing permissions. This vulnerability could grant an attacker the control over data or functions of MQTT devices;
* _Message delivery_: a publisher sends messages that cannot be delivered because of the lack of subscribers. This vulnerability could lead to significant degradation of broker performance;
* _Message validation_: a publisher sends messages containing disallowed characters that are not properly interpreted by brokers and subscribers. This vulnerability could be exploited to perform many different malicious attacks;
* _Message encryption_: clients and servers exchange messages in plaintext, thus allowing an attacker to eavesdrop and spoof the messages in transit. This vulnerability could be exploited to perform Man-in-The-Middle (MiTM) attacks. The analysis of the CVEs affecting products and services based on MQTT offers an interesting overview of whether/how security threats have materialized and of their actual impact. More precisely, the NVD database includes 57 CVEs. Many of these vulnerabilities refer to the improper message validation category. In particular, crafted MQTT messages could easily make brokers unresponsive. For example, a malicious MQTT client could cause a stack overflow by simply sending a SUBSCRIBE packet containing at least 65,400 \"/\" characters (CVE-2019-11779). Similarly, a CONNECT packet combined with a malformed UNSUBSCRIBE request packet can be used to cause a Denial of Service (DoS) attack against the broker (CVE-2019-6241). Other security issues refer to the authentication and authorization categories, as in the case of clients that set their username to \"#\", thus bypassing the access control mechanisms and subscribing to all MQTT topics (CVE-2017-7650). Figure 1 depicts the effects of this vulnerability where an attacker can access all information coming from all publishers, including sensitive data with serious consequences on confidentiality. In the literature, MQTT security threats have been investigated by [PERSON] et al. (2018) who propose a model to identify the abilities of threat agents in carrying out attacks. Moreover, the paper discusses the possible exploitations of these attacks using realistic scenarios. For example, it shows that a Denial of Service attack--aimed at making a broker unresponsive or even crash--can be carried out by sending big messages or messages with high QoS levels. In addition, unauthorized publishing--aimed at physically damaging or disabling IoT devices-- can be performed by means of privileged messages that grant an attacker remote control of these devices.