Insecure IoT Network Services

HighIoT SecurityOWASP IoT Top 10 - I2: Insecure Network Services

IoT devices expose insecure network services such as Telnet, unauthenticated MQTT, open SNMP, or unencrypted CoAP, enabling eavesdropping, unauthorized device control, and use as pivot points for network attacks.

Immediate Response

1Block all unnecessary network ports on IoT devices at the network firewall.
2Disable Telnet, SNMP v1/v2, and any unauthenticated services immediately.
3Segment IoT devices into isolated VLANs with strict egress controls.
4Rotate any credentials exposed in plaintext network traffic.

All playbooks

1Replace Telnet with SSH and enforce key-based authentication.
2Enable TLS and authentication on MQTT brokers; use MQTT 5.0 with enhanced security.
3Migrate from SNMP v1/v2 to SNMPv3 with authentication and encryption.
4Implement network access control (NAC) to restrict IoT device network access.

Long-term Prevention

1Establish IoT network security baselines and enforce them through NAC policies.
2Deploy IoT-aware network monitoring to detect anomalous device communication.
3Require mutual TLS for all device-to-cloud and device-to-device communication.
4Conduct regular network penetration tests targeting IoT service exposure.

Attack vectors

Telnet or SSH services with default or no authentication enabled
MQTT brokers without authentication or TLS allowing unauthorized pub/sub
Open SNMP communities with default community strings (public/private)
Unencrypted CoAP or UPnP services exposing device controls on the network

Indicators of compromise

Network scans revealing open Telnet (23), MQTT (1883), or SNMP (161) ports on IoT devices
Unauthenticated MQTT connections publishing or subscribing to device topics
Plaintext credentials captured in network traffic from IoT devices
Unexpected device commands originating from unauthorized network segments

Tooling

NmapWiresharkMQTT ExplorersnmpwalkZeek