Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes - - PowerPoint PPT Presentation

▶
zigator analyzing the security of zigbee enabled smart
SMART_READER_LITE
LIVE PREVIEW

Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes - - PowerPoint PPT Presentation

Oct 14, 2023 224 likes •868 views

Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes Dimitrios-Georgios Akestoridis, Madhumitha Harishankar, Michael Weber, and Patrick Tague Carnegie Mellon University ACM WiSec 2020 Motivation Smart home network security affects

slide-1
SLIDE 1

Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes

Dimitrios-Georgios Akestoridis, Madhumitha Harishankar, Michael Weber, and Patrick Tague

Carnegie Mellon University

ACM WiSec 2020

slide-2
SLIDE 2

Motivation

  • Smart home network security affects the physical security of residents

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 2

slide-3
SLIDE 3

Motivation

  • Smart home network security affects the physical security of residents
  • Zigbee supports two security models:
  • Distributed ⇒ recommended for ease of use
  • Centralized ⇒ recommended for higher security

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 2

slide-4
SLIDE 4

Motivation

  • Smart home network security affects the physical security of residents
  • Zigbee supports two security models:
  • Distributed ⇒ recommended for ease of use
  • Centralized ⇒ recommended for higher security
  • High-level view of a Zigbee packet without any security features:

SYNC Header PHY Header MAC Header NWK Header APS Header APS Payload MAC Footer Defined by the IEEE 802.15.4 standard Defined by the Zigbee Alliance Defined by the Zigbee Alliance and Manufacturers Defined by the IEEE 802.15.4 standard Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 2

slide-5
SLIDE 5

Motivation

  • Smart home network security affects the physical security of residents
  • Zigbee supports two security models:
  • Distributed ⇒ recommended for ease of use
  • Centralized ⇒ recommended for higher security
  • High-level view of a Zigbee packet without any security features:

SYNC Header PHY Header MAC Header NWK Header APS Header APS Payload MAC Footer Defined by the IEEE 802.15.4 standard Defined by the Zigbee Alliance Defined by the Zigbee Alliance and Manufacturers Defined by the IEEE 802.15.4 standard

We study the security consequences of the design choice to disable MAC-layer security in centralized Zigbee networks

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 2

slide-6
SLIDE 6

Threat Model and Assumptions

  • Security objectives:
  • Authenticity, Integrity, Confidentiality, and Availability

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 3

slide-7
SLIDE 7

Threat Model and Assumptions

  • Security objectives:
  • Authenticity, Integrity, Confidentiality, and Availability
  • Assumptions:
  • The end user and their devices are trusted

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 3

slide-8
SLIDE 8

Threat Model and Assumptions

  • Security objectives:
  • Authenticity, Integrity, Confidentiality, and Availability
  • Assumptions:
  • The end user and their devices are trusted
  • The attacker is an outsider with potentially more powerful hardware
  • The attacker has no prior knowledge of any network key
  • The attacker is aware of the default Trust Center link key
  • The attacker may have access to a subset of install codes

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 3

slide-9
SLIDE 9

Threat Model and Assumptions

  • Security objectives:
  • Authenticity, Integrity, Confidentiality, and Availability
  • Assumptions:
  • The end user and their devices are trusted
  • The attacker is an outsider with potentially more powerful hardware
  • The attacker has no prior knowledge of any network key
  • The attacker is aware of the default Trust Center link key
  • The attacker may have access to a subset of install codes
  • We do not consider uncommon device configurations like low-power routers

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 3

slide-10
SLIDE 10

Threat Model and Assumptions

  • Security objectives:
  • Authenticity, Integrity, Confidentiality, and Availability
  • Assumptions:
  • The end user and their devices are trusted
  • The attacker is an outsider with potentially more powerful hardware
  • The attacker has no prior knowledge of any network key
  • The attacker is aware of the default Trust Center link key
  • The attacker may have access to a subset of install codes
  • We do not consider uncommon device configurations like low-power routers
  • Attacker’s goal:
  • Obtaining the network key from an already formed Zigbee network

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 3

slide-11
SLIDE 11

Security Analysis with Zigator

Zigbee Network Ethernet USB

Zigator

Packet Analysis Software-Defined Radio PHY Monitoring IEEE 802.15.4 USB Adapter Selective Jamming

1 2 3 4 5 6 7 8 9 * #

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 4

slide-12
SLIDE 12

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions Waiting for RX_START

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-13
SLIDE 13

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions

SHR

Waiting for RX_START

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-14
SLIDE 14

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions

SHR PHR

Waiting for RX_START

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-15
SLIDE 15

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions

SHR PHR

RX_START

MPDU

Waiting for RX_START Checking Jamming Condition

. . .

Read 1 byte and then wait 32 µs to read the next byte

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-16
SLIDE 16

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions

SHR PHR

RX_START

MPDU

Waiting for RX_START Checking Jamming Condition

. . .

Read 1 byte and then wait 32 µs to read the next byte FORCE_PLL_ON SLP_TR Transmitting Jamming Packet

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-17
SLIDE 17

Our implementation of a selective jammer

Frame on Air and Interrupts Jammer’s State and Actions

SHR PHR

RX_START

MPDU

Waiting for RX_START Checking Jamming Condition

. . .

Read 1 byte and then wait 32 µs to read the next byte FORCE_PLL_ON SLP_TR Transmitting Jamming Packet RX_ON Waiting for RX_START

Time Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 5

slide-18
SLIDE 18

Combining Core Functionalities

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 6

slide-19
SLIDE 19

Combining Core Functionalities

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 6

slide-20
SLIDE 20

Combining Core Functionalities

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 6

slide-21
SLIDE 21

Combining Core Functionalities

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 6

slide-22
SLIDE 22

Combining Core Functionalities

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 6

slide-23
SLIDE 23

Experimental Setup

  • We captured packets that were generated

from ten commercial Zigbee devices

  • We conducted eight experiments that

differed in the smart hub that was used and the physical topology of the devices

  • Our experiments lasted about 34.644

hours in total and resulted in a dataset of 571,509 valid packets

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 7

slide-24
SLIDE 24

Inferring the Topology of a Zigbee Network

  • Log distinct pairs of source and destination addresses
  • Trivial identification of the Zigbee Coordinator ⇒ always 0x0000

0x0000 0x7de1 0x68d7 0x2ffb 0x989f 0x957f 0x6231 0x14c9 0x822c

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 8

slide-25
SLIDE 25

Identifying Logical Device Types

ZC ZR ZED A

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-26
SLIDE 26

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-27
SLIDE 27

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request
  • 2. Beacon
  • 2. Beacon

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-28
SLIDE 28

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request
  • 2. Beacon
  • 2. Beacon

ZC ZR ZED A

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-29
SLIDE 29

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request
  • 2. Beacon
  • 2. Beacon

ZC ZR ZED A

  • 1. Orphan Notification
  • 1. Orphan Notification
  • 1. Orphan Notification

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-30
SLIDE 30

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request
  • 2. Beacon
  • 2. Beacon

ZC ZR ZED A

  • 1. Orphan Notification
  • 1. Orphan Notification
  • 1. Orphan Notification
  • 2. Coordinator Realignment

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-31
SLIDE 31

Identifying Logical Device Types

ZC ZR ZED A

  • 1. Beacon Request
  • 1. Beacon Request
  • 1. Beacon Request
  • 2. Beacon
  • 2. Beacon

ZC ZR ZED A

  • 1. Orphan Notification
  • 1. Orphan Notification
  • 1. Orphan Notification
  • 2. Coordinator Realignment

Passive identification based on Data Request and Link Status commands

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 9

slide-32
SLIDE 32

Examining Short and Extended Addresses

  • NWK commands contain both the

extended and the short address of their source

  • The extended address in the

auxiliary header of the NWK layer matches with the short address of the source in the MAC header

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 10

slide-33
SLIDE 33

Examining Short and Extended Addresses

  • NWK commands contain both the

extended and the short address of their source

  • The extended address in the

auxiliary header of the NWK layer matches with the short address of the source in the MAC header

  • 28:6d:97:00:01:09:4b:c8

⇒ 0x286d97 ⇒ SAMJIN Co., Ltd.

Source: https://zigbeealliance.org/product_type/certified_product/ Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 10

slide-34
SLIDE 34

Examining Short and Extended Addresses

  • NWK commands contain both the

extended and the short address of their source

  • The extended address in the

auxiliary header of the NWK layer matches with the short address of the source in the MAC header

  • 28:6d:97:00:01:09:4b:c8

⇒ 0x286d97 ⇒ SAMJIN Co., Ltd.

Source: https://zigbeealliance.org/product_type/certified_product/ Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 10

slide-35
SLIDE 35

Identifying Encrypted NWK Commands

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 11

slide-36
SLIDE 36

Identifying Encrypted NWK Commands

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 11

slide-37
SLIDE 37

Identifying Encrypted NWK Commands

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 11

slide-38
SLIDE 38

Identifying Encrypted NWK Commands

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 11

slide-39
SLIDE 39

Identifying Encrypted NWK Commands

The decision tree that we developed is included in our paper

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 11

slide-40
SLIDE 40

Commissioning of Zigbee Devices

  • Legacy Zigbee devices use the default Trust

Center link key to join a network

  • A Zigbee 3.0 device can join a Zigbee 3.0

network using an install code

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 12

slide-41
SLIDE 41

Commissioning of Zigbee Devices

  • Legacy Zigbee devices use the default Trust

Center link key to join a network

  • A Zigbee 3.0 device can join a Zigbee 3.0

network using an install code

  • The attacker’s main strategy is to launch a

denial-of-service attack that would force the end user to factory reset a device that uses a known Trust Center link key

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 12

slide-42
SLIDE 42

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-43
SLIDE 43

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon
  • 1. Beacon
  • 1. Beacon

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-44
SLIDE 44

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon
  • 1. Beacon
  • 1. Beacon
  • 2. Network Report

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-45
SLIDE 45

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon
  • 1. Beacon
  • 1. Beacon
  • 2. Network Report
  • 3. MAC Acknowledgment

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-46
SLIDE 46

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon
  • 1. Beacon
  • 1. Beacon
  • 2. Network Report
  • 3. MAC Acknowledgment
  • 4. Network Update
  • 4. Network Update

4 . J a m m i n g S i g n a l 4 . J a m m i n g S i g n a l

✖ ✖

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-47
SLIDE 47

Disconnecting Zigbee Devices

ZC ZR ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon
  • 1. Beacon
  • 1. Beacon
  • 2. Network Report
  • 3. MAC Acknowledgment
  • 4. Network Update
  • 4. Network Update

4 . J a m m i n g S i g n a l 4 . J a m m i n g S i g n a l

✖ ✖

  • 5. PAN ID Change

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 13

slide-48
SLIDE 48

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-49
SLIDE 49

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-50
SLIDE 50

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-51
SLIDE 51

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-52
SLIDE 52

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-53
SLIDE 53

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request
  • 2. MAC Acknowledgment

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-54
SLIDE 54

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request
  • 2. MAC Acknowledgment
  • 3. Data Request

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-55
SLIDE 55

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request
  • 2. MAC Acknowledgment
  • 3. Data Request
  • 4. MAC Acknowledgment

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-56
SLIDE 56

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request
  • 2. MAC Acknowledgment
  • 3. Data Request
  • 4. MAC Acknowledgment
  • 5. Rejoin Response
  • 5. Jamming Signal

✖

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-57
SLIDE 57

Keeping Zigbee Devices Disconnected (pt. 1)

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Data Request

2 . M A C A c k n

  • w

l e d g m e n t

ZC ZED

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0xbbcc EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Rejoin Request
  • 2. MAC Acknowledgment
  • 3. Data Request
  • 4. MAC Acknowledgment
  • 5. Rejoin Response
  • 5. Jamming Signal

✖

6 . M A C A c k n

  • w

l e d g m e n t Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 14

slide-58
SLIDE 58

Keeping Zigbee Devices Disconnected (pt. 2)

  • Some of our Zigbee devices were

able to rejoin the network even if we jammed all Rejoin Responses

  • By jamming the beacons with the

updated PAN ID we could keep any Zigbee device disconnected

ZC ZR

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 15

slide-59
SLIDE 59

Keeping Zigbee Devices Disconnected (pt. 2)

  • Some of our Zigbee devices were

able to rejoin the network even if we jammed all Rejoin Responses

  • By jamming the beacons with the

updated PAN ID we could keep any Zigbee device disconnected

ZC ZR

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon Request

1 . B e a c

  • n

R e q u e s t Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 15

slide-60
SLIDE 60

Keeping Zigbee Devices Disconnected (pt. 2)

  • Some of our Zigbee devices were

able to rejoin the network even if we jammed all Rejoin Responses

  • By jamming the beacons with the

updated PAN ID we could keep any Zigbee device disconnected

ZC ZR

PAN ID: 0xbbcc EPID: 0x1122334455667788 PAN ID: 0x99aa EPID: 0x1122334455667788

A

PAN ID: 0x99aa EPID: 0xfacefeedbeefcafe

  • 1. Beacon Request

1 . B e a c

  • n

R e q u e s t

  • 2. Beacon

2 . J a m m i n g S i g n a l

✖

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 15

slide-61
SLIDE 61

Responsible Disclosure

  • Zigbee Routers may not initiate or significantly delay the rejoin process

when they fail to receive the Network Update command:

  • Our SmartThings Smart Bulb did not initiate the rejoin process within 38 hours

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 16

slide-62
SLIDE 62

Responsible Disclosure

  • Zigbee Routers may not initiate or significantly delay the rejoin process

when they fail to receive the Network Update command:

  • Our SmartThings Smart Bulb did not initiate the rejoin process within 38 hours
  • We received the following comments from the Zigbee Alliance:
  • Specification changes will prevent malicious PAN ID changes
  • A more aggressive algorithm will be required to avoid missing PAN ID changes
  • It is difficult for the network key to be leaked from Zigbee 3.0 devices

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 16

slide-63
SLIDE 63

Responsible Disclosure

  • Zigbee Routers may not initiate or significantly delay the rejoin process

when they fail to receive the Network Update command:

  • Our SmartThings Smart Bulb did not initiate the rejoin process within 38 hours
  • We received the following comments from the Zigbee Alliance:
  • Specification changes will prevent malicious PAN ID changes
  • A more aggressive algorithm will be required to avoid missing PAN ID changes
  • It is difficult for the network key to be leaked from Zigbee 3.0 devices
  • We recommend the following security enhancements:
  • The Trust Center link key should be reconfigurable over an out-of-band

communication channel

  • The end users should be made aware of the security risks that the use of a

legacy Zigbee device would introduce to their networks

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 16

slide-64
SLIDE 64

Conclusion

  • The lack of MAC-layer security exposes Zigbee networks to several passive

and active attacks

  • Developed software:
  • https://github.com/akestoridis/zigator
  • https://github.com/akestoridis/atusb-attacks
  • https://github.com/akestoridis/grc-ieee802154
  • https://github.com/akestoridis/wireshark-zigbee-profile
  • CRAWDAD dataset cmu/zigbee-smarthome:
  • https://doi.org/10.15783/c7-nvc6-4q28
  • Additional resources:
  • http://mews.sv.cmu.edu/research/zigator/

Akestoridis et al. Zigator: Analyzing the Security of Zigbee-Enabled Smart Homes ACM WiSec 2020 17