43. IoT and OT Security – Cameras, Smart Devices, Plant Networks
43.3 Protocol Awareness – MQTT, CoAP, Modbus, DNP3
Concepts only – no weaponized write recipes.
| Protocol | Typical use | Blue note |
|---|---|---|
| MQTT | IoT pub/sub (sensors → broker → apps); ports often 1883 / 8883 | Require auth; prefer TLS (8883); ACL so one client cannot # subscribe everything |
| CoAP | Constrained devices, UDP-ish IoT | DTLS / careful exposure; rare on SME packing lines but exam modules mention it |
| Modbus TCP | Many PLCs; often port 502 | Historically little/no auth; treat as trusted-zone only; never map 502 to internet |
| DNP3 | Utilities / SCADA-style links | Secure authentication profiles exist – use them; still zone it |
Thodkyaat: MQTT broker = WhatsApp group admin for sensors. Open anonymous MQTT = anyone publishes fake "temperature OK". Modbus = often "speak and the PLC listens" inside the plant LAN – that is why segregation (next sections) matters more than a fancy IDS signature alone.
Aapan lab madhe Mosquitto (MQTT) shiku – own VM. Modbus write attacks, Stuxnet rebuilds, plant ladder downloads – nahi in this book.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Anonymous MQTT publish/subscribe on open broker | allow_anonymous false; password file; TLS; ACL |
| Speaks Modbus to internet-exposed 502 | Never publish 502; OT firewall deny from IT; monitor |
| Floods CoAP/MQTT to DoS a weak device | Rate limits; dedicated IoT VLAN; capacity tests in change window |
Ravindra Bagale's Tip
Students "Modbus exploit PDF" download kartat. CEH exam modules protocol awareness magtat – Blue job = zone + auth where possible. Interview: "I can explain MQTT auth and why Modbus must not face the WAN – I do not practise writes on live PLCs." Ghabru naka.
Lab
Read-only: man mosquitto.conf or docs – tick three: listener bind address, allow_anonymous, password_file. Write why binding 0.0.0.0 on a laptop with bridged adapter is dangerous. No Modbus tools.