  Facilitated by messaging protocols (MP), many home devices are connected to
the Internet, bringing convenience and accessibility to customers. However,
most deployed MPs on IoT platforms are fragmented and are not implemented
carefully to support secure communication. To the best of our knowledge, there
is no systematic solution to perform automatic security checks on MP
implementations yet.
  To bridge the gap, we present MPInspector, the first automatic and systematic
solution for vetting the security of MP implementations. MPInspector combines
model learning with formal analysis and operates in three stages: (a) using
parameter semantics extraction and interaction logic extraction to
automatically infer the state machine of an MP implementation, (b) generating
security properties based on meta properties and the state machine, and (c)
applying automatic property based formal verification to identify property
violations. We evaluate MPInspector on three popular MPs, including MQTT, CoAP
and AMQP, implemented on nine leading IoT platforms. It identifies 252 property
violations, leveraging which we further identify eleven types of attacks under
two realistic attack scenarios. In addition, we demonstrate that MPInspector is
lightweight (the average overhead of end-to-end analysis is ~4.5 hours) and
effective with a precision of 100% in identifying property violations.
