Choo Choo, Network Train - The One to Rule Your Perimeter
summary
Concrete results and demos: scans find ~80% Mosquitto installations and a rise to 85,000 open servers in 2020 from ~32,000 in 2018, many allowing anonymous access. Exposed brokers leak retained configs like Tasmota group topics (Tasmota supports ~2,500 devices) enabling Tasmota OTA abuse to push a rogue firmware with three added commands (TCP connect/send/close). That firmware creates an MQTT-to-TCP tunnel used to run a Winbox TCP proxy/exploit and extract router credentials — the exploit and router takeover work in the demo.
AI-written summary · about
chapters (8)
- 0:00MQTT train welcome
- 1:26MQTT security journey
- 8:29MQTT protocol deep dive
- 14:37Misconfigurations and security mishaps
- 19:59MQTT bridging
- 27:54Breaking perimeter
- 36:31Mitigations and thoughts
- 37:56Q&A
related talks
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
45mWhen Machines Can't Talk
13mThe dark side of IoT
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
46mD1T2 - Pwning KNX & ZigBee Networks
29mHow Protocol Gateways May Introduce More Problems than They Solve
54mWhere did you find that?
40mUncovering Covert Channels in Your IoT Networks