A Novel Approach to Resource Starvation Attacks on Message Queuing Telemetry Transport Brokers

Abstract

The Message Queuing Telemetry Transport (MQTT) protocol is an established bandwidth-efficient method of connection with remote locations using wireless sensor networks. It forms a backbone infrastructure for IoT collection and analytics. The collection and sharing of data by embedded devices and heterogeneous systems fuels an ever-increasing reliance on secure data. An important consideration is the resilience of MQTT brokers when subject to large subscriber loads. This research describes how the intelligence gathered by a simple physical reconnaissance attack can be used as part of a rapid kill-chain to facilitate resource starvation and water torture attacks in order to bring down three distinct MQTT broker implementations.