312-50 Question 412
Select 2▪ IoT AttacksDuring an authorized assessment of a smart manufacturing environment, you discover several IoT IP cameras and environmental sensors on a flat internal network. Packet captures show that many devices regularly contact a local service over MQTT on TCP/1883. You want to determine whether an attacker could take control of device behavior or inject false telemetry without relying on stolen credentials. Which TWO findings would most strongly indicate a practical risk of an IoT message-manipulation attack in this environment?
- A
The MQTT broker allows anonymous client connections and accepts publish operations to control topics such as factory/line1/camera/cmd.
- B
The devices use WPA3-Enterprise for Wi-Fi access to the corporate SSID.
- C
The MQTT traffic is unencrypted plaintext, allowing you to observe topic names and message formats on the network.
- D
The cameras expose RTSP for video streaming on TCP/554.
- E
The broker requires mutual TLS client certificates for both publishers and subscribers.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are the anonymous publish access on the MQTT broker and the use of unencrypted MQTT traffic. In real IoT environments, MQTT is widely used because it is lightweight and efficient for constrained devices, but insecure deployments are common. From a CEH perspective, the practical attack path is to identify whether the broker permits unauthorized publishing to control topics and whether packet captures reveal enough information to replay or craft device commands. Anonymous access or weak ACLs on an MQTT broker are high-risk findings because they can enable direct command injection. Plaintext MQTT over TCP/1883 further helps an attacker enumerate topics and understand payload formats.
By contrast, WPA3-Enterprise concerns network access protection, not application-layer authorization once an assessor is already on the internal segment. RTSP exposure may matter for camera confidentiality, but it does not specifically demonstrate a control-message manipulation path. Mutual TLS is a recommended best practice because it provides transport security and stronger client authentication. Relevant guidance can be found in MQTT security best practices from the OASIS MQTT specification and general IoT security recommendations such as minimizing anonymous access, enforcing authorization per topic, and using TLS to protect broker communications.
- A. Correct.
Correct. If the MQTT broker permits anonymous connections and allows publishing to command or control topics, an attacker on the network may be able to send unauthorized commands directly to IoT devices. This is a classic IoT weakness: insecure message broker configuration. In practice, many IoT deployments use MQTT for telemetry and control, and weak broker authorization can allow message injection, device manipulation, or false state changes without needing valid user credentials.
- B. Incorrect.
Incorrect. WPA3-Enterprise strengthens wireless access control and protects network admission, but it does not by itself prove that the MQTT-based IoT application layer is vulnerable to message manipulation. A candidate might choose this because wireless security is important in IoT environments, but the scenario asks specifically about evidence of a practical message-injection risk after network access is already available during an internal assessment.
- C. Correct.
Correct. Plaintext MQTT on TCP/1883 exposes topic names, broker behavior, and message structure to anyone with network visibility. While plaintext alone does not automatically guarantee publish rights, it significantly increases practical exploitation feasibility by enabling an attacker to understand how devices communicate and craft valid-looking messages. Combined with weak broker permissions, it strongly supports the risk of control-topic abuse or telemetry spoofing.
- D. Incorrect.
Incorrect. RTSP on TCP/554 is commonly used for streaming video from cameras. It may present its own security issues, such as weak authentication or exposed streams, but it does not directly indicate the ability to manipulate MQTT control messages or inject false telemetry. This distractor is plausible because it is a common IoT service, but it is not the strongest evidence for the specific attack described.
- E. Incorrect.
Incorrect. Requiring mutual TLS for publishers and subscribers is a strong security control, not evidence of practical risk. Mutual TLS helps ensure client authenticity and protects message transport. Someone might select it if they confuse 'uses certificates' with 'certificate weakness,' but as stated, it reduces the likelihood of unauthorized MQTT message injection.