CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
During an IoT assessment, a tester examines a smart thermostat that uses the MQTT protocol. The tester finds that the device connects to a broker without any authentication. Which of the following attacks is MOST likely to succeed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Publishing arbitrary messages to control the device and subscribing to data topics
Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Publishing arbitrary messages to control the device and subscribing to data topics
Why this is correct
If the smart thermostat utilizes an unauthenticated MQTT broker, an attacker can directly publish arbitrary control commands (e.g., set temperature, change mode) to the device's designated topic. Concurrently, subscribing to the device's telemetry topics allows the attacker to intercept sensitive data like temperature readings, occupancy status, or operational logs. This demonstrates both device control compromise and data exfiltration without requiring any prior authentication or credentials, making it a primary and immediate vulnerability in many IoT deployments.
- ✗
Firmware extraction via UART
Why it's wrong here
Firmware extraction via Universal Asynchronous Receiver-Transmitter (UART) requires direct physical access to the smart thermostat's circuit board to connect a serial debugger. While a valid and powerful technique for deeper device analysis, this method is not a network-based vulnerability and does not directly exploit an unauthenticated MQTT broker. The question implies a more immediate, potentially remote, assessment vector, making physical access techniques less relevant as the initial or primary finding for this specific scenario.
- ✗
Reversing the firmware to find hardcoded credentials
Why it's wrong here
Reversing the firmware typically involves disassembling or decompiling the device's software to identify vulnerabilities, backdoors, or hardcoded credentials for various services like APIs or network protocols. However, if the MQTT broker itself lacks authentication, there are no credentials to find or bypass for that specific messaging service. Exploiting the unauthenticated MQTT directly provides immediate access and control, rendering the more time-consuming and complex firmware analysis unnecessary for this particular vulnerability.
- ✗
Performing a dictionary attack on the Wi-Fi PSK
Why it's wrong here
Performing a dictionary attack on the Wi-Fi Pre-Shared Key (PSK) aims to gain unauthorized access to the local network by cracking the wireless network password. While network access is often a prerequisite for many IoT attacks, this specific action does not directly exploit an unauthenticated MQTT broker. If the tester already has network access or the MQTT broker is publicly exposed, cracking the Wi-Fi PSK is an entirely separate and unnecessary step for exploiting the MQTT vulnerability itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.