Attack scenarios and security analysis of MQTT communication protocol in IoT system

TLDR

IoT devices commonly use MQTT, a lightweight, ISO‑standardized protocol favored for its low bandwidth and memory demands, yet it lacks built‑in encryption, exposing confidential data to privacy, authentication, and integrity risks. The paper examines why many IoT deployments fail to adopt sufficient security measures. It demonstrates and analyzes multiple attack scenarios that exploit MQTT’s default lack of encryption to compromise data confidentiality and integrity. By highlighting these vulnerabilities, the study encourages enhanced security awareness and the implementation of protective mechanisms in MQTT systems to thwart such attacks.

Abstract

Various communication protocols are currently used in the Internet of Things (IoT) devices. One of the protocols that are already standardized by ISO is MQTT protocol (ISO / IEC 20922: 2016). Many IoT developers use this protocol because of its minimal bandwidth requirement and low memory consumption. Sometimes, IoT device sends confidential data that should only be accessed by authorized people or devices. Unfortunately, the MQTT protocol only provides authentication for the security mechanism which, by default, does not encrypt the data in transit thus data privacy, authentication, and data integrity become problems in MQTT implementation. This paper discusses several reasons on why there are many IoT system that does not implement adequate security mechanism. Next, it also demonstrates and analyzes how we can attack this protocol easily using several attack scenarios. Finally, after the vulnerabilities of this protocol have been examined, we can improve our security awareness especially in MQTT protocol and then implement security mechanism in our MQTT system to prevent such attack.