A Study of the Resilience of the Mosquitto MQTT Broker Running on Raspberry Pi Against Fuzzy DDoS Attacks

The Message Queuing Telemetry Transport (MQTT) protocol is widely utilized for the Internet of Things (IoT) and other sectors. Due to its popularity, the vulnerabilities within MQTT implementations have attracted attention from malicious actors. This research delves into the application of fuzzing techniques to Distributed Denial-of-Service (DDoS) attacks to assess the resilience of the Mosquitto broker when running in two Raspberry Pi models. Fuzzing involves the introduction of erroneous or random data into a system to uncover potential flaws. In this paper, several experiments are carried out, where we vary the QoS level, the payload size of PUBLISH messages, the number of attackers, and the Raspberry Pi models, before reporting the throughput and transmission time of legitimate traffic. Moreover, to strengthen the malicious traffic, hybrid DDoS attacks are also contemplated, consisting of injecting malignant TCP SYN segments and fuzzy MQTT packets. The findings highlight how vulnerable the MQTT protocol is to fuzzy DDoS attacks and emphasize the significance of implementing robust security measures to safeguard IoT ecosystems.