Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused Protocols
Carlotta Tagliaro, Martina Komsic, Andrea Continella, Kevin, Borgolte, Martina Lindorfer

TL;DR
This large-scale study analyzes the security of IoT backend protocols, revealing widespread vulnerabilities such as information leaks, weak authentication, and insecure transport use across millions of deployed systems.
Contribution
It provides the first extensive analysis of real-world IoT backend security, focusing on MQTT, CoAP, and XMPP protocols at scale.
Findings
9.44% backends expose information
30.38% CoAP backends vulnerable to DoS
99.84% use insecure transport protocols
Abstract
Internet-of-Things (IoT) devices, ranging from smart home assistants to health devices, are pervasive: Forecasts estimate their number to reach 29 billion by 2030. Understanding the security of their machine-to-machine communication is crucial. Prior work focused on identifying devices' vulnerabilities or proposed protocol-specific solutions. Instead, we investigate the security of backends speaking IoT protocols, that is, the backbone of the IoT ecosystem. We focus on three real-world protocols for our large-scale analysis: MQTT, CoAP, and XMPP. We gather a dataset of over 337,000 backends, augment it with geographical and provider data, and perform non-invasive active measurements to investigate three major security threats: information leakage, weak authentication, and denial of service. Our results provide quantitative evidence of a problematic immaturity in the IoT ecosystem.…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Advanced Malware Detection Techniques · IoT and Edge/Fog Computing
