Abstract:

Message Queue Telemetry Transmission Protocol (MQTT) is a lightweight protocol widely used in the Internet of Things. Through the measurement of the deployment of MQTT protocol nationwide, 27949 MQTTs are found exposed on the public network, more than 80% of the servers transmit data in plain text, and 57% of the MQTT servers do not perform client authentication at all. Even if some MQTT servers use TLS protocol which supports authentication and encryption, certificate deployment is vulnerable. Only 20.94% of the certificates can pass the verification process of trusted certificate. This paper analyzes the security threats of MQTT server, such as privacy theft, man-in the-middle attack, remote tampering of equipment, and puts forward the defense scheme and the next step work of MQTT server.

Key words: IoT, MQTT, man-in-the-middle attack