How MQTT Works: IoT Publish/Subscribe, Open Brokers & Securing IoT (Animated)

MQTT is the lightweight messaging protocol behind millions of IoT devices: sensors, smart meters, cars and factory equipment. Devices publish messages to topics on a central broker, and apps subscribe to them. A broker left open to the internet without a password lets anyone read every message, and send fake ones.

1. Connect & subscribe: clients connect to the broker

Both the sensor and the dashboard connect to the broker. The dashboard subscribes to the topics it wants.

1. CONNECT (Dashboard → MQTT broker): The broker accepts clients without any login.
2. SUBSCRIBE (Dashboard → MQTT broker): The dashboard subscribes to line 1.

Wireshark filter:

mqtt.msgtype == 1 || mqtt.msgtype == 8

2. Publish: the sensor sends a reading

The sensor publishes a reading to a topic. The broker forwards it to every subscriber of that topic.

1. PUBLISH (Temperature sensor → MQTT broker): A temperature reading.
2. PUBLISH (MQTT broker → Dashboard): The dashboard updates.

Wireshark filter:

mqtt.msgtype == 3

3. Open broker: attack: anonymous access from the internet

The broker is reachable from the internet and allows anonymous clients. An attacker subscribes to “#” and receives every message from every device; they can also publish fake readings or commands that devices and dashboards trust.

1. SUBSCRIBE (Attacker → MQTT broker): The attacker subscribes to everything.
2. PUBLISH (MQTT broker → Attacker): Every message is copied to the attacker.
3. PUBLISH (Attacker → MQTT broker): A fake reading is injected…
4. PUBLISH (MQTT broker → Dashboard): …and the dashboard believes it.

Wireshark filter:

mqtt.topic == "#"

4. Secure the broker: defence: login, tls, topic acls, no internet exposure

Disable anonymous access, give each device its own credentials or certificate, use TLS on 8883, restrict which topics each client may publish or subscribe to, and keep the broker off the public internet or behind a VPN.

1. CONNECT (Attacker → MQTT broker): Anonymous connections are refused.

Mosquitto.conf:

allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl
listener 8883 + certfile/keyfile

FAQ