Security Holes in the Integration and Management of Messaging Protocols on Commercial IoT Clouds

Explore the first systematic study on security vulnerabilities in leading commercial IoT cloud platforms' integration of MQTT for device-user communication. Discover how authentication, authorization, and session management additions to the protocol are vulnerable, potentially allowing adversaries to control devices, launch large-scale denial-of-service attacks, steal secret data, and fake device status. Learn about the security implications for major platforms like AWS IoT Core, IBM Watson IoT, Azure IoT, Google Cloud IoT, Alibaba IoT, and Tuya Smart in this 37-minute Black Hat conference presentation by Yan Jia, Luyi Xing, and Yuqing Zhang.