MQTT Vulnerabilities, Attack Vectors and Solutions in the Internet of Things (IoT)

ABSTRACT

Internet of Things (IoT) paved the way for devices and machine communication using TCP/IP protocol. Lightweight and stateless communication is imperative especially in a situation requiring conservation of energy usage, e.g. wireless sensor network. Representational State Transfer (REST) API method is based on web communication protocol, Hyper-Text Transfer Protocol (HTTP), and is widely used in IoT messaging. Some of these protocols are DPWS, XMPP, MQTT, COaP, AMQP. Among these protocols, MQTT is the most preferred protocol and is expected to be the de facto messaging IoT standard. MQTT uses a publisher/subscriber model to facilitate messaging between devices making messaging lightweight. Nevertheless, there are a number of security issues due to the design of the protocol itself. Some of the issues are denial of service, identity spoofing, information disclosure, elevation of privileges and data tampering. These issues can be caused by both internal and external perpetrators. Researchers have proposed various security techniques and mechanisms to address these issues. Incorporation of security has added processing overhead to the devices and this will have a bearing on IoT devices that are powered by a battery. This issue has opened up new research challenges in making the protocols more lightweight and at the same time not compromising the level of security provided.

KEYWORDS:

• COaP
• Data communication protocols
• DPWS
• Internet of things
• MQTT
• MQTT threats
• Publish-subscribe
• Security
• XMPP

Additional information

Notes on contributors

Ahmed J. Hintaw

Ahmed J Hintaw was born in Karbala Province, Iraq, in 1986. He received the BS degree, Hefei, in 2009 and the MS degree from Jamia Hamdard University (JHU), New Delhi, India in 2012, both in computer science. He is currently pursuing the PhD degree with the National Advanced IPv6 Center (NAv6), Universiti Sains Malaysia (USM). His research interests include internet of things, cryptography, and network security. Email: [email protected]

Selvakumar Manickam

Selvakumar Manickam is the senior lecturer at National Advanced IPv6 Centre (NAv6), Universiti Sains Malaysia. He did his bachelors and masters in Computer Science in 1999 and 2002, respectively. He obtained his PhD from Universiti Sains Malaysia (USM) in 2013. His research interests are internet security, cloud computing, IoT, android and open source technology. He is an executive council member of Internet Society (ISOC), Malaysian Chapter and also the head of Internet Security Working Group under Malaysian Research and Education Network (MyREN).

Mohammed Faiz Aboalmaaly

Mohammed Abomaali is head of Computer Techniques Engineering Department at Alsafwa University College, Iraq. He received a bachelor’s degree in software engineering from Mansour University College and a master’s as well as a PhD degree in computer science from Universiti Sains Malaysia in Penang, Malaysia. His research interests include parallel computing, cloud computing and IoT. Email: [email protected]

Shankar Karuppayah

Shankar Karuppayah is currently a senior lecturer and researcher at National Advanced IPv6 Centre (NAv6), Universiti Sains Malaysia. He obtained his BSc in computer science (USM), Malaysia and the MSc in software systems engineering (KMUTNB), Thailand. He obtained his PhD in 2016 from Technische Universität Darmstadt in the field of cyber security. His main research interests are P2P botnets, distributed systems and cyber security in general. To date, he has authored and co-authored many articles in journals, workshops, and conference proceedings. He is also a reviewer in many esteemed network and security journals. Email: [email protected]