Security Holes in the Integration and Management of Messaging Protocols on Commercial IoT Clouds
summary
Examines how major commercial IoT cloud platforms (AWS IoT Core, IBM Watson IoT, Azure IoT, Google Cloud IoT, Alibaba IoT, Tuya Smart) integrate the MQTT messaging protocol and evaluates their added security mechanisms—authentication, authorization, and session management. Presents systematic testing results showing vulnerabilities that enable device takeover, large-scale DoS, data exfiltration, and spoofed device status.
AI-written summary · about
chapters (7)
- 0:00black hat EUROPE 2019
- 11:09Unauthorized MOTT Messages
- 17:54Faults in Managing MOTT Sessions
- 26:14Unauthenticated MOTT Identity
- 26:27Establish SSL Connection Server Certificate Certificate MOTT CONNECT
- 30:48Authorization Mystery of MQTT Topics
- 35:00Lessons Learnt
related talks
31mNext-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms- 31mNext-Gen IoT Botnets 3: Bad Implementations of Good Cloud Platforms
54mSecurity in IoT: Challenges, Vulnerabilities and Countermeasures
11mSecuring IoT Integrations with Third-Party Services
25mTrust in the edge, trouble in the cloud
32mDesign Flaws and Deployment Chaos in Cloud-based IoT Access Control Policies
28mIoT Security - it's not just the devices
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions