Don't Let The Cuteness Fool You - Exploiting IoT's MQTT Protocol presented at deepsec 2017

by Dalmoz ,

Summary : "Connect all the things!" - for some time now, this is the main theme when talking about IoT devices, solutions and products. Our eagerness to find new, and at times innovative, ways to make anything suitable to the anthem of the internet is a great promise for malicious activity.
As these devices are supposed to be lightweight they mostly rely on a small fingerprint stack of protocols - one of those protocols is the message protocol - MQTT.
We will go deep into protocol details, observe how common it is to find such devices (and how), and several novel ways to abuse any one of tens of thousands easily spotted publicly facing MQTT brokers on the internet for "fun and profit".