Ravindra BagaleCourses & study guides

43. IoT and OT Security – Cameras, Smart Devices, Plant Networks

43.8 Detection – Outbound IoT, Failed Logins, Protocol Oddities

By Last updated:

IDS chapter (42) tools apply. IoT/OT-specific crumbs:

  • Camera / sensor VLAN suddenly speaks to random WAN IPs (C2 / scan)
  • MQTT PUBLISH storms or anonymous connect spikes
  • Burst of failed logins on camera HTTP / RTSP
  • IT host opens 502/Modbus toward OT (policy violation)
  • New MAC on OT switch port
# Amazon Linux / Ubuntu lab – watch MQTT and firewall crumbs (OWN broker)
sudo yum install tcpdump   # Ubuntu: sudo apt install tcpdump
sudo tcpdump -ni eth1 host 192.168.56.50 and port 1883
# On broker host after hardening lab:
sudo tail -f /var/log/mosquitto/mosquitto.log
sudo firewall-cmd --set-log-denied=all
sudo tail -f /var/log/messages
Red team (attacker) does Blue team (defender) detects / stops
Infected cam scans LAN + phones home Egress deny/allow-list; Suricata on IoT span; SIEM rare-dest
Brute camera UI from Kali (lab) Log + lockout; alert on .10 → .50:80 bursts in lab
Idle Modbus recon from IT laptop Firewall deny + alert; ticketing for any OT allow

Ravindra Bagale's Tip

Students keep only inbound IDS rules. The Mirai lesson = outbound. Interview: "I alert when the IoT VLAN talks to destinations that are not NTP or the vendor update CDN." Got it?

Lab

Pseudo-rule on paper: IoT_VLAN → WAN && dest not in {ntp, vendor_cdn} → ticket. Pair: Amir generates allowed MQTT; Zoya watches tcpdump – confirm noise vs signal.