When Machines Can't Talk
summary
Security analysis of MQTT & CoAP finds specification flaws, implementation bugs and mass misconfiguration: message leaks from CNCs, laser cutters and industrial pumps, a baseline of ~87,000 exposed MQTT brokers and ~500,000 CoAP device endpoints discovered via Internet-wide scanning and Shodan searches. Proofs-of-concept include a regex DoS in Mosca and UTF‑8/length parsing crashes in Arduino libraries, plus measurements and a live demo of 32x CoAP amplification (matching reported ~320 Gbps attacks). Toolset: active scanning, pattern matching, Wireshark captures and exploit POCs that successfully crash or amplify traffic.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:47Network Stack
- 7:56Device Management
- 8:32Command Queuing
- 15:34Passing these Topic Filters
- 18:50Buffer Overflow
- 31:17Reflective Attack
- 33:13Block Wise Transfer
- 38:45Takeaways
related talks
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
40mUncovering Covert Channels in Your IoT Networks
40mExploiting OPC-UA in Every Possible Way: Practical Attacks Against Modern OPC-UA Architectures
29mHow Protocol Gateways May Introduce More Problems than They Solve
27mCommon Application Security Mistakes that Enable Automated Attacks
39mChoo Choo, Network Train - The One to Rule Your Perimeter
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
26mHacking buildings: Security flaws in embedded building control systems