One SUBSCRIBE Can Print Your Whole Plant

MQTT is not an industrial protocol.

It runs more plants every year anyway.

It arrives through telemetry gateways, edge devices and IIoT platforms, and it behaves nothing like the polling protocols OT people are used to reading.

How It Actually Works

MQTT sits on TCP 1883. Port 8883 if somebody turned TLS on.

The handshake is short. A client sends CONNECT, the broker answers CONNACK, and after that PUBLISH and SUBSCRIBE do all the work.

There is no master and no polling. A device publishes to a topic, and whoever subscribed to that topic receives it. That inversion is the thing to hold onto: in Modbus you ask, in MQTT you are told.

Wildcards Are A Recon Tool

Topic filters accept two wildcards:

• + matches exactly one level
• # matches everything below

# must be the last character in the filter. sensor/# is valid. sensor/#/temp is not.

So the reach of a single subscription is a configuration decision, not a protocol limit.

Retained Messages Are Why It Is Instant

The broker keeps one retained message per topic, and hands it to you the moment you subscribe.

You do not wait for the plant to publish. On connect you receive the last known value of every retained topic your subscription matches.

The $SYS tree is separate — # does not reach it. Subscribing to $SYS/# gives you broker statistics instead.

Now The Security Part

The specification makes authentication optional.

Username and password travel inside the CONNECT packet. Without TLS they are visible to anyone who can observe the traffic — the same exposure as any other cleartext credential, on a port that often sits outside the OT team's mental model of the estate.

Defaults depend on the broker, not on the protocol. Mosquitto 2.0 disables anonymous access by default. Other brokers may accept anonymous clients until somebody configures authentication.

Put the three together — anonymous access enabled, no ACLs, retained messages present — and:

can immediately return the last known value of every application topic that client is permitted to read.

Not an exploit. Configuration, used exactly as designed.

Try It Yourself

• Find your brokers before you assess them: look for TCP 1883 and 8883 in your own traffic, not in the asset register.
• For each broker, check two things — whether anonymous access is enabled, and whether ACLs restrict what a subscriber can match.
• Test the difference on a system you are allowed to break: Labshock is a platform for learning and testing OT cybersecurity through hands-on labs and realistic industrial environments.
• Start free: github.com/zakharb/labshock · Do you run MQTT in your plant, or still only polling protocols? discord.gg/bpmaQFfW76