Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
ZigBee IEEE 802.15.4
 What it is:
a high-level communication protocol for WSNs and WPANs
a M2M Area Network Technology fo...
 Security Architecture:
Access Control Frame address validation MAC Layer Frame Integrity, Trust Center Architecture for ...
Golden Rules for Security in the Residential Mode
• Building blocks of ZigBee security: Key establishment, key
transport, ...
A real world assessment environment:
Testing a smart device model for lighting and temperature
control based on ZigBee Hom...
ZigBee Logical Device Types and Functions
ZigBee Coordinator (FFD, parent)
• starts the network, maintains neighbor and ro...
ZigBee deployment flaws
in Residential Mode
Attack Vector Analysis
Assessing insecure implementation risks
1. EAVESDROPPING FOR NETWORK DISCOVERY & DEVICE IDENTIFICATION
Legitimate Beacon Request Frame (0x07)
Unencrypted Beacon
R...
Replay of the captured LED
ON/OFF packets excluding
ACK frame on the channel.
Delay of 1/10th of a second
between each fra...
Injecting a spoofed beacon
request frame on a loop
with a 1-sec delay
3. DENIAL OF SERVICE
(A). PACKET INJECTION IN REAL-T...
EXPLOIT DEVICE
3. ASSOCIATION FLOOD IN REAL-TIME
Injecting a forged
combination of association
request and data request
on...
Nodes struggle to keep up with rapid PAN ID
rotation process which is triggered repetitively.
After a few seconds, communi...
OTA key provisioning vs. Pre-configured Keys
Network key is delivered in plaintext to end device
- higher susceptibility t...
Nonce Reuse
• Sequential message numbers (nonces) can help detect and prevent replay attacks.
• Nonces must always be dist...
Upcoming SlideShare
Loading in …5
×

Resilience in the ZigBee Residential Mode

483 views

Published on

Compatible with both Wi-Fi and IP, ZigBee is clearly becoming the technology of choice for smart home technology innovators. ZigBee networks use trust center architecture for authentication and validation of devices that request to communicate. In the Residential mode, ZigBee nodes are susceptible to not only to attacks with intent to intercept, tamper or destroy data but also to physical attacks since they are increasingly used in building control systems for critical infrastructure and home security systems.

Published in: Technology
  • Be the first to comment

Resilience in the ZigBee Residential Mode

  1. 1. ZigBee IEEE 802.15.4  What it is: a high-level communication protocol for WSNs and WPANs a M2M Area Network Technology for WLANs.  Attributes: Low power consumption, low-cost, low bitrate mesh networking standard supports 10-1000 meter range – highly reliable stable against node failover global standards for interoperability  Applications: Home Automation, Building Automation, Smart Energy, Health and Fitness, 3D gaming, Telecommunications, Retail, Industrial Control.
  2. 2.  Security Architecture: Access Control Frame address validation MAC Layer Frame Integrity, Trust Center Architecture for Secure Network Admittance. Authentication and Data Confidentiality Symmetric Key Encryption for Frames Confidentiality :AES-CTR Authentication: AES-CBC-MAC with 32,-64,128bit MAC Confidentiality & Authentication: AES -CCM with 32-,64-,128 bit MAC Supports PKI. Frame Integrity Protection against tampering for data in transit MIC 32/64/128 bits based on AES-CBC-MAC Sequential Freshness Prevention of Replay Attacks 4-Byte Frame Counter  Common security concerns: Long battery life of at least 2 years is a must to pass ZigBee certification. So resource-intensive security measures are avoided to keep power consumption low and limited. Interoperability among ZigBee profiles might force security slackening. ZigBee-based devices are essentially low-cost, thus lacking protection from physical attacks using serial interfaces such as GoodFet and BusPirate.
  3. 3. Golden Rules for Security in the Residential Mode • Building blocks of ZigBee security: Key establishment, key transport, frame protection and device management. • Key management is all about secure initialization, installation, processing and storage of Network Keys and Link Keys. • End-to-end Data Security – Only a source and a destination device can decrypt a message using a combination of keys. • The APS and NWK layers can both independently process the secure MAC frames with either encryption (confidentiality) or authentication, or both. • The ZigBee Device Object (ZDO) manages security policies and security configuration for devices.
  4. 4. A real world assessment environment: Testing a smart device model for lighting and temperature control based on ZigBee Home Automation Profile Development Kits: Xbee and Texas Instruments ZigBee Coordinator (ZC/ZTC) – Xbee RF Module/CC2531 USB Dongle (0x0000) ZigBee End Device (ZED) – Xbee RF Module/CC2530 development board (0x6EC7) - set up as a monitoring node, fitted with: temperature sensor, LED and LDR for light sensing/emission and light intensity measurement. ZigBee Router (ZR) – Xbee RF Module/CC2530 development board (0xCEBC) In the lab…
  5. 5. ZigBee Logical Device Types and Functions ZigBee Coordinator (FFD, parent) • starts the network, maintains neighbor and router lists. • acts as Trust Center for secure node joining (authenticates new joiner). • PAN Coordinator functions for network and security management. • can update link key and network key periodically. • transfers application packets. ZigBee Router (FFD) • Allows devices to join the network • Multi-hop communication ZigBee End Devices (RFD or FFD, child) • battery-powered radios with short duty-cycles. • sensor nodes for data sampling. • can be routed using a ZigBee gateway. • transfers application packets. Node Types RFD – Reduced Function Device FFD – Full Function Device
  6. 6. ZigBee deployment flaws in Residential Mode Attack Vector Analysis Assessing insecure implementation risks
  7. 7. 1. EAVESDROPPING FOR NETWORK DISCOVERY & DEVICE IDENTIFICATION Legitimate Beacon Request Frame (0x07) Unencrypted Beacon Response Frame [PAN ID, source address, stack profile, stack version, and IEEE address] SNIFFED SENSOR NODE Spoofed Beacon Request Frame EXPLOIT DEVICE Network discovery: Sniffing of the Unencrypted MAC Header to identify configuration, node addresses, stack profile and PAN IDs from Beacon Responses sent to end devices by Coordinators and Routers. Packet Capture COORDINATOR
  8. 8. Replay of the captured LED ON/OFF packets excluding ACK frame on the channel. Delay of 1/10th of a second between each frame. 2. REPLAY ATTACK – OFFLINE MODE The Frame Counter in the NWK layer drops replayed packets. But the MAC layer is vulnerable to replay of MAC command frames as the layer cannot process an incoming frame counter. EXPLOIT DEVICE SENSOR NODE COORDINATOR CAPTURED
  9. 9. Injecting a spoofed beacon request frame on a loop with a 1-sec delay 3. DENIAL OF SERVICE (A). PACKET INJECTION IN REAL-TIME Effecting short-term unavailability of the coordinator’s services for a legitimate device by causing bandwidth consumption and node energy draining. EXPLOIT DEVICE Continuous packet injection to expend bandwidth. Node energy drain due to extended ‘wake’ state caused by its retransmission loop in anticipation of response. ZC does not respond to legitimate requests from network nodes. COORDINATOR
  10. 10. EXPLOIT DEVICE 3. ASSOCIATION FLOOD IN REAL-TIME Injecting a forged combination of association request and data request on a loop with a 1-sec delay Disengaging a legitimate device and preventing rejoin using a syn flood attack. Some vendors defend against this using device identity tables to detect suspicious behavior. Continuous stream of Association Responses Association table overflows, expending processing memory. Coordinator’s Communication with legitimate nodes is obstructed. COORDINATOR
  11. 11. Nodes struggle to keep up with rapid PAN ID rotation process which is triggered repetitively. After a few seconds, communication disintegrates. Coordinator senses PAN ID Conflict and realigns network to a new PAN ID for every conflicting PAN ID replayed. COORDINATOR Continuous broadcast replay of forged association responses on the channel; impersonating the PAN Coordinator. Continuous sniffing of the network to collect PAN IDs, extended PAN IDs and channel. EXPLOIT DEVICE 2 4. PAN ID CONFLICT ATTACK Sabotaging the PAN Coordinator’s network management by means of manipulation which is in essence, the initiation of a persistent conflict of PAN IDs. EXPLOIT DEVICE 1 0x94ac 0x8b43 0x6335 0x72bc
  12. 12. OTA key provisioning vs. Pre-configured Keys Network key is delivered in plaintext to end device - higher susceptibility to key sniffing. Keys are pre-installed by vendor in manufacture - unless keys are updated, knowledge of the default keys of the vendor can be used to make an illegitimate node (of the same vendor) join the network. - physical attacks often attempted. Key rotation process is supported. Key rotation / revocation is not possible. All data is initially encrypted with network key until link keys are derived. After device pairing, all data is encrypted with pre-installed link key. Widely preferred for large scale deployments for ease of set up since employees need not handle activation procedures. Small deployments in home automation are more likely to use this method of key provisioning. • Trust Center in the Residential Mode or Standard Security Mode maintains only the standard network keys. We deem it necessary for deployers to equip the TC host with enough resources to maintain a list of nodes and network policies to incorporate the resilience features of the High Security Mode to the extent possible while maintaining the low-cost factor. • The OTA key provisioning mechanism must be bolstered by other security measures to reduce key sniffing/reuse vulnerabilities. • Optimally leverage the AES-based security framework and Trust Center controls to harden the network ecosystem.
  13. 13. Nonce Reuse • Sequential message numbers (nonces) can help detect and prevent replay attacks. • Nonces must always be distinct although the security key is same for two messages. • Attackers can spoof messages by copying the same nonce used by a previous message. Save nonces in NVRAM so that status is preserved after a power failure. Security at the MAC Layer • MAC Layer only secures its own frames between neighboring nodes (no end-to-end protection as in APS layer) • ACL-based node admission and Unsecured Mode are unreliable. MIC must be used to validate frame check sum and message sequence. Preventing Physical Attacks • Debuggers and key sniffers are used to extract encryption keys from firmware on any node. • Existing key is usually not invalidated once a node is removed from the network – this eases rogue entry into network. Tamper-proofing nodes and Out-of-band key loading via serial ports helps eliminate exposure to sniffing. Best Practices Node Revival • Association/Syn Floods and PAN ID Conflict Attacks aim at disengaging nodes and disrupting coordinator responses. • Disconnected nodes are not immediately discernible. Set Node Join Time parameter to ’Always’.

×