Standard
Lightweight publish-subscribe messaging protocol designed for IoT and low-bandwidth devices, also used by attackers as a C2 or update-delivery channel.
Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishersReality
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
Perspective Coverage
3 publishersReality
The Rust reimplementation of eKuiper now hydrates streams, rules and auth keys from SQLite at startup and serves them from a lock-guarded HashMap, after profiling blamed flash I/O on eMMC gateways for the engine's burst-load packet loss.
Reality
The ESP32-S3 example generates the device key on the chip and sends only a CSR to AWS IoT Core. The credential that gets it there is a claim certificate and private key copied into the SPIFFS image every unit shares.
Reality
CISA's advisory for the Android and iOS app describes read access to real-time data for every active device on a shared broker. The fix is an app store update, and a credential already extracted still works until Bransys changes it.
Reality
Gleb Tcivie's open source monitoring tool outgrew Prometheus once node identity in metric labels blew past the 10-second scrape budget. It now runs on one Postgres database with TimescaleDB.
Reality
I-Dacs Labs rebuilt LF Edge eKuiper in Rust around a windowed path that stores no rows, and it reports 5 to 10 MB of memory on the workloads where the Go engines it tested climbed toward the 1 GB limit of the box.
Reality
A publication ban lifted this week on the case Profero opened in April, when its responders pulled a 101MB RAT that had reportedly reached dozens of Israeli companies through a security vendor's own endpoint component.
Reality
Kaspersky says the factory updater on DoFun Android car head units installed whatever an MQTT broker told it to. No CVE was involved in turning shipped cars into proxy nodes.
Reality