MQTT
Definition
Message Queuing Telemetry Transport. A publish/subscribe protocol on TCP port 1883 (plain) or 8883 (TLS) with a central broker. Designed for low-bandwidth IoT telemetry. Default deployments often ship with no authentication; Shodan lists 100,000+ exposed brokers globally.
- Full name
- Message Queuing Telemetry Transport
- Ports
- 1883 plain, 8883 TLS
- Architecture
- Publish/subscribe with central broker
- Common use
- Low-bandwidth IoT telemetry
- Exposure
- 100,000+ unauthenticated brokers found on Shodan
Common questions
Why is MQTT relevant to IoT incident forensics?+
Because many deployments run without authentication, exposed MQTT brokers can be enumerated and their message topics read by an attacker or investigator alike, making broker logs and retained topic messages a useful, and sometimes an evidentiary, source of device state and command history.
How does MQTT differ from HTTP-based device communication?+
MQTT keeps a persistent lightweight connection and pushes messages to subscribed devices as events occur, whereas HTTP is request-response and stateless per call, which is why MQTT is favoured for battery-constrained sensors that need low-overhead, near-real-time telemetry.
What should an examiner check first on a suspected compromised MQTT broker?+
Broker access logs for unauthenticated connections, the list of active topic subscriptions, and any retained messages, since a retained message persists on the broker and can reveal the last known state or command sent to a device even after the original publisher disconnects.
Related terms
- Binwalk
- An open-source firmware analysis tool that scans a binary blob for known file signatures (squashfs, JFFS2, gzip, LZMA, certificates) and extracts the...
- CoAP
- Constrained Application Protocol (RFC 7252). A RESTful protocol over UDP on port 5683 (or 5684 with DTLS), designed for constrained devices that...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- eMMC Dump
- Embedded Multi-Media Card flash chip extraction. The chip is desoldered (chip-off) or read in-circuit with an ISP adapter; the raw NAND or...
- JTAG
- Joint Test Action Group standard (IEEE 1149.1) for chip-level debugging. The test access port left on a phone's PCB lets a forensic...
- UART
- Universal Asynchronous Receiver/Transmitter. A two-wire serial interface (TX, RX, GND, optional VCC) exposed on most IoT device boards as debug pads or...