Sam Sprague

Insecure MQTT IoT Pipeline – Security Demonstration

This project explores real-world IoT security risks by intentionally building and analyzing an insecure MQTT pipeline. The goal was to understand how default or misconfigured MQTT deployments expose operational data and enable both passive and active attacks.

I implemented a full end-to-end pipeline consisting of a Python-based sensor publisher, a Mosquitto MQTT broker, and a dashboard subscriber that displays live telemetry. The… Show more

Insecure MQTT IoT Pipeline – Security Demonstration

This project explores real-world IoT security risks by intentionally building and analyzing an insecure MQTT pipeline. The goal was to understand how default or misconfigured MQTT deployments expose operational data and enable both passive and active attacks.

I implemented a full end-to-end pipeline consisting of a Python-based sensor publisher, a Mosquitto MQTT broker, and a dashboard subscriber that displays live telemetry. The sensor simulates water system data (pressure, flow rate, timestamps, and counters) and publishes JSON messages every two seconds over MQTT on port 1883.

After validating normal operation, I performed an attacker-style assessment by connecting to the broker without credentials and subscribing to all topics using a wildcard (#). With no encryption, authentication, or authorization in place, I was able to intercept live sensor data in plaintext using standard MQTT tools. The exposed data included device identifiers, physical locations, timestamps, sequential counters, and operational telemetry — demonstrating how easily an attacker could perform reconnaissance and learn system behavior patterns.

I documented the findings in a formal vulnerability assessment, identifying four critical issues: lack of encryption, lack of authentication, unrestricted topic access, and no message integrity verification. I mapped realistic attack scenarios such as passive monitoring, unauthorized access, replay attacks, spoofed telemetry, and incident masking.

The project concludes with prioritized remediation recommendations aligned with industry best practices, including TLS (MQTT over 8883), client authentication, topic-based ACLs, and message validation. This work reflects how security engineers evaluate systems by building, breaking, and documenting risk — not just configuring tools. Show less

Built and documented a full threat model for a simulated IoT water management system modeled after real-world commercial deployments (sensors → MQTT broker → cloud API → web dashboard → remote actuators).

Applied structured security frameworks instead of guessing:
• Conducted CIA Triad asset prioritization across devices, dashboard, cloud, and alerting systems
• Used STRIDE to systematically identify Spoofing, Tampering, Repudiation, Information Disclosure, DoS, and Privilege… Show more

Built and documented a full threat model for a simulated IoT water management system modeled after real-world commercial deployments (sensors → MQTT broker → cloud API → web dashboard → remote actuators).

Applied structured security frameworks instead of guessing:
• Conducted CIA Triad asset prioritization across devices, dashboard, cloud, and alerting systems
• Used STRIDE to systematically identify Spoofing, Tampering, Repudiation, Information Disclosure, DoS, and Privilege Escalation risks
• Mapped realistic attack paths (guest WiFi → broker exposure → spoofed commands / replay attacks / dashboard compromise)
• Rated threats using likelihood × impact methodology to produce a prioritized risk matrix
• Proposed concrete mitigations including MFA, mutual TLS, device authentication, rate limiting, network segmentation, logging & audit controls

This project focused on thinking like an attacker first, then designing layered defenses (defense-in-depth) to make exploitation impractical rather than assuming “secure by default.”

Deliverable included:
• System description
• Data flow analysis
• Asset inventory
• Full STRIDE threat inventory
• Risk summary and mitigation roadmap

Built as part of an IoT Cyber Defense externship focused on applying real-world security methodology to connected systems. Show less

Built a Python-based mock IoT water sensor to simulate realistic telemetry from Hydroficient HYDROLOGIC devices. The project generates structured JSON sensor data with UTC timestamps, sequential counters, and controlled anomalies to mirror real-world IoT behavior used in monitoring and security analysis.

Designed the system to reflect how real devices behave in production — including randomness, ordering guarantees, and failure conditions — rather than idealized test data.

What I… Show more

Built a Python-based mock IoT water sensor to simulate realistic telemetry from Hydroficient HYDROLOGIC devices. The project generates structured JSON sensor data with UTC timestamps, sequential counters, and controlled anomalies to mirror real-world IoT behavior used in monitoring and security analysis.

Designed the system to reflect how real devices behave in production — including randomness, ordering guarantees, and failure conditions — rather than idealized test data.

What I built:
• A WaterSensor Python class that generates realistic pressure and flow readings
• ISO 8601 UTC timestamps for time normalization across devices
• Monotonically increasing counters to detect replay or out-of-order messages

Simulated anomalies:
• Water leaks (abnormally high flow)
• Pipe blockages (pressure imbalance)
• Stuck/malfunctioning sensors (static values)

Exported a 100-reading dataset to JSON for downstream analysis and pipeline testing

Why this matters:
• Mirrors how real IoT telemetry is structured and validated
• Demonstrates understanding of replay protection, data freshness, and anomaly modeling
• Produces test data suitable for analytics, monitoring, or security detection systems
• Foundation for publishing live data over MQTT and analyzing insecure pipelines (next phase)

Tech used:
• Python · JSON · datetime(UTC) · random · IoT telemetry modeling • Show less

Built a secure IoT MQTT pipeline implementing TLS encryption and mutual TLS (mTLS) device authentication using Mosquitto and Python.

The project simulates IoT sensor devices publishing telemetry data while enforcing certificate-based identity verification to prevent unauthorized devices from connecting.

Key work included:

• Implemented TLS encryption and mTLS authentication for MQTT device connections
• Built a private Certificate Authority and generated device… Show more

Built a secure IoT MQTT pipeline implementing TLS encryption and mutual TLS (mTLS) device authentication using Mosquitto and Python.

The project simulates IoT sensor devices publishing telemetry data while enforcing certificate-based identity verification to prevent unauthorized devices from connecting.

Key work included:

• Implemented TLS encryption and mTLS authentication for MQTT device connections
• Built a private Certificate Authority and generated device certificates
• Configured Mosquitto broker to enforce certificate validation and reject unauthorized clients
• Simulated identity attack scenarios (no certificate, wrong CA, expired certificate) to verify security controls
• Benchmarked TLS vs mTLS performance to measure connection and message latency overhead
• Designed a device provisioning policy covering certificate lifecycle, rotation, and revocation

Results showed mutual TLS added negligible overhead (~0.6 ms connection time) while providing strong device identity verification.

Technologies used: MQTT, Mosquitto, Python, TLS/mTLS, OpenSSL. Show less

Built and secured an MQTT-based IoT pipeline simulating a hotel water monitoring system.

I configured a Mosquitto broker with TLS encryption and certificate validation, then ran four real-world security tests:
• Verified plaintext eavesdropping on unsecured MQTT
• Enforced certificate validation to block impostor brokers
• Measured TLS performance impact (latency + overhead)
• Stress-tested the system under normal and emergency loads

Results showed TLS completely… Show more

Built and secured an MQTT-based IoT pipeline simulating a hotel water monitoring system.

I configured a Mosquitto broker with TLS encryption and certificate validation, then ran four real-world security tests:
• Verified plaintext eavesdropping on unsecured MQTT
• Enforced certificate validation to block impostor brokers
• Measured TLS performance impact (latency + overhead)
• Stress-tested the system under normal and emergency loads

Results showed TLS completely blocks eavesdropping and impersonation while adding negligible latency and handling burst traffic without errors.

This project focuses on practical security decisions—what to secure, why it matters, and how to prove it with data. Show less

OBJECTIVE
Vant Panels wanted to attract net-new customers and increase website conversions and overall, product sales.

STRATEGY
In creating videos to attract customers, Sprague Media tested over a dozen video options to better help understand purchase behavior and user engagement. With video ads, we could push free swatches to new prospects and use a sequence of videos to increase the customer experience (CX) and drive sales. Men & Women, both segments required different types of… Show more

OBJECTIVE
Vant Panels wanted to attract net-new customers and increase website conversions and overall, product sales.

STRATEGY
In creating videos to attract customers, Sprague Media tested over a dozen video options to better help understand purchase behavior and user engagement. With video ads, we could push free swatches to new prospects and use a sequence of videos to increase the customer experience (CX) and drive sales. Men & Women, both segments required different types of creatives and nurturing messaging.

RESULTS
• Tested creative types to maximize conversions (Static)
• Leveraged pixel data to retarget audience segments
• Implemented different campaign structures to maximize impressions
• Tested and optimized Look-alike and Interest groups
• Tested segmented DPA ads

TOP METRICS
• 857% Conversion Lift
• 8.1x ROAS at Scale
• +61% Follower Count
• 3x Video Results vs Static Creatives

We helped the New Jersey based eCommerce store utilize Facebook & Snapchat video ads to drive crazy sales, resulting in a 857% lift in Revenue. Later adding Influencers and consistently posting fresh, new, content to Vant Panels' social media channels helped double company sales in just the first-year alone Show less

OBJECTIVE
MKF Collection is a Fashion & Apparel brand out of New Jersey. They initially thought there may not be much we could accomplish with Social, but had a small budget to start, with the main focus being eCommerce Sales.

STRATEGY
Starting in June 2020, with a small budget, MKF needed help on all aspects of their Social Media. By spearheading content creation, elevating data analysis, and guiding their influencer marketing campaigns, we were able to maintain a high return… Show more

OBJECTIVE
MKF Collection is a Fashion & Apparel brand out of New Jersey. They initially thought there may not be much we could accomplish with Social, but had a small budget to start, with the main focus being eCommerce Sales.

STRATEGY
Starting in June 2020, with a small budget, MKF needed help on all aspects of their Social Media. By spearheading content creation, elevating data analysis, and guiding their influencer marketing campaigns, we were able to maintain a high return while continuing to scaling through the last few years.

RESULTS
• Tested creative types to maximize conversions (Static)
• Leveraged pixel data to retarget audience segments
• Implemented different campaign structures to maximize impressions
• Tested and optimized Look-alike and Interest groups
• Tested segmented DPA ads

TOP METRICS
• +285% Revenue Lift
• 5.11x+ ROAS at Scale
• +61% Follower Count
• 17% Avg Engagement Rate

From our numerous tests, we found that lifestyle images containing graphic messaging helped promote exclusive promotions and convert customers. We also implemented DPA ads to help cold conversion campaigns reduce CPA and increase ROAS. By implementing smart campaign structures, effective audiences, and clear, direct ads, we successfully increase ad spend by 51.6% while increasing ROAS by 21.8%. Show less

OBJECTIVE
Gaiam, a lifestyle brand offering yoga, fitness & wellness products, came to Sprague Media with a goal to increase marketing efficiency across its paid social media campaigns.

STRATEGY
The main objective with Gaiam was scaling spend in the account while maintaining a 3x return on ad spend. There is a lot of competition in the fitness & wellness space, so it was important to identify the campaign types, audiences, and ad types that produced the best CVR and CPA to combat… Show more

OBJECTIVE
Gaiam, a lifestyle brand offering yoga, fitness & wellness products, came to Sprague Media with a goal to increase marketing efficiency across its paid social media campaigns.

STRATEGY
The main objective with Gaiam was scaling spend in the account while maintaining a 3x return on ad spend. There is a lot of competition in the fitness & wellness space, so it was important to identify the campaign types, audiences, and ad types that produced the best CVR and CPA to combat the high CPM’s.

RESULTS
• Tested creative types to maximize conversions (Static)
• Leveraged pixel data to retarget audience segments
• Implemented different campaign structures to maximize impressions
• Tested and optimized Look-alike and Interest groups
• Tested segmented DPA ads

TOP METRICS
• Increased ROAS 21.8%
• Increased Ad Spend 51.6%
• Increased Purchases 23.1%
• Improved CVR 84.63%

From our numerous tests, we found that lifestyle images containing graphic messaging helped promote exclusive promotions and convert customers.

We also implemented DPA ads to help cold conversion campaigns reduce CPA and increase ROAS.

By implementing smart campaign structures, effective audiences, and clear, direct ads, we successfully increase ad spend by 51.6% while increasing ROAS by 21.8%. Show less

OBJECTIVE
Aosom needed to save their account from non-stop restrictions and scale their acquisition strategies.

STRATEGY
To address this challenge, we worked our internal connections at Facebook to get the account back up and running. Then quickly launched FB’s Dynamic Ads. This ad format allowed Aosom to quickly promote their entire product catalog to a broad audience without the need for manual ad creation.

RESULTS
• Tested creative types to maximize conversions… Show more

OBJECTIVE
Aosom needed to save their account from non-stop restrictions and scale their acquisition strategies.

STRATEGY
To address this challenge, we worked our internal connections at Facebook to get the account back up and running. Then quickly launched FB’s Dynamic Ads. This ad format allowed Aosom to quickly promote their entire product catalog to a broad audience without the need for manual ad creation.

RESULTS
• Tested creative types to maximize conversions (Static, Video, Catalog)
• Leveraged pixel data to retarget audience segments
• Implemented different campaign structures to maximize impressions
• Tested and optimized Look-alike and Interest groups
• Tested segmented Adv+ ads

TOP METRICS
• ∞ Conversion Lift
• 12.1x ROAS at Scale
• +43% Follower Count
• 19x DPA Results vs Static Creatives

We helped the Wilsonville, OR. based eCommerce store demonstrate the power of personalized, relevant content in driving sales and maximizing ROI.

By leveraging Facebook’s advanced targeting capabilities and machine learning, we were able to create highly effective ad campaigns that delivered impressive results. Show less