<div dir="ltr">It looks like generic z-wave products are now entering the market. Monoprice has begun carrying a home automation line:<br><br><a href="http://www.electronichouse.com/article/monoprice_debuts_slew_of_home_automation_and_theater_options_at_cedia">http://www.electronichouse.com/article/monoprice_debuts_slew_of_home_automation_and_theater_options_at_cedia</a><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 28, 2014 at 4:04 PM, Tom Metro <span dir="ltr"><<a href="mailto:tmetro+hhacking@gmail.com" target="_blank">tmetro+hhacking@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">In the latest Hak5 episode:<br>
<a href="http://hak5.org/episodes/hak5-1702" target="_blank">http://hak5.org/episodes/hak5-1702</a><br>
<br>
they interview a guy at DefCon who gave a talk on security<br>
vulnerabilities in home automation gear. One he mentioned in passing was<br>
that Z-Wave door locks were vulnerable to a replay attack. Unfortunately<br>
he didn't give any specifics as to the models impacted. I'd speculate it<br>
was a Schlage lock, as they seem to be the most popular, but could be<br>
Kwikset or both.<br>
<br>
This is rather disappointing, as this is a rookie mistake, and suggests<br>
these companies didn't really take security all that seriously.<br>
<br>
When Z-Wave security products (like door/window and motion sensors)<br>
first started appearing, I made some attempt to look into what sort of<br>
security was provided by the protocol, but couldn't find any easy<br>
answers. Is the signal encrypted? How are the keys created/distributed?<br>
Who knows. Maybe since then someone with more time and motivation has<br>
investigated more deeply and written up an executive summary on the<br>
state of Z-Wave security.<br>
<br>
Ah, here we go...<br>
Security Evaluation of the Z-Wave Wireless Protocol<br>
<a href="http://research.sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf" target="_blank">http://research.sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf</a><br>
<br>
"...no public vulnerability research on Z-Wave could be found prior to<br>
this work. In this paper, we analyze the Z-Wave protocol stack layers<br>
and design a radio packet capture device and related software named<br>
Z-Force to intercept Z-Wave communications. This device enables us to<br>
decode different layers of the Z-Wave protocol and study the<br>
implementation of encryption and data origin authentication in the<br>
application layer. We then present the details of a vulnerability<br>
discovered using Z-Force tool in AES encrypted Z-Wave door locks that<br>
can be remotely exploited to unlock doors without the knowledge of the<br>
encryption keys."<br>
<br>
Should be an interesting read. I don't know the date of this paper, but<br>
it seems to be the origin of the info used in subsequent articles and<br>
talks. Some articles:<br>
<br>
Potential attack vectors against Z-Wave<br>
<a href="http://blog.opensecurityresearch.com/2013/07/potential-attack-vectors-against-z-wave.html" target="_blank">http://blog.opensecurityresearch.com/2013/07/potential-attack-vectors-against-z-wave.html</a><br>
<br>
Can Hackers Unlock My Z-Wave Door Lock?<br>
<a href="http://suretycam.com/can-hackers-unlock-my-z-wave-door-lock/" target="_blank">http://suretycam.com/can-hackers-unlock-my-z-wave-door-lock/</a><br>
<br>
...researchers discovered that a single, unnamed Z-Wave door lock<br>
manufacturer has a bug in their implementation of the Z-Wave secure<br>
node association protocol that could allow a hacker within Z-Wave<br>
range of the network to reset the lock's user codes and unlock the<br>
door from outside. They did not find a vulnerability in the Z-Wave AES<br>
security protocol, just a bug in one manufacturer's code.<br>
...the manufacturer has already taken steps to fix the issue and that<br>
additional test cases have already been added to the Z-Wave<br>
certification test suite to prevent this from happening in the future.<br>
<br>
<br>
Hacking and attacking automated homes<br>
<a href="http://www.networkworld.com/article/2224849/microsoft-subnet/hacking-and-attacking-automated-homes.html" target="_blank">http://www.networkworld.com/article/2224849/microsoft-subnet/hacking-and-attacking-automated-homes.html</a><br>
<br>
<br>
I guess this is old news, as some of these refer to last year's Black<br>
Hat and Def Con conferences. The middle article doesn't seem to be<br>
describing a replay attack, so that could be something new, just<br>
presented at conferences this year.<br>
<br>
Given what researches found when they investigated wireless alarm<br>
systems (see my prior post[1]), using proprietary protocols made<br>
expressly for security, I guess Z-Wave isn't any worse off. There is at<br>
least a suggestion Z-Wave uses AES encryption, which is probably better<br>
than what the alarm systems using decades old designs are doing.<br>
<br>
1. <a href="http://www.mail-archive.com/hardwarehacking@blu.org/msg01263.html" target="_blank">http://www.mail-archive.com/hardwarehacking@blu.org/msg01263.html</a><br>
<br>
-Tom<br>
_______________________________________________<br>
Hardwarehacking mailing list<br>
<a href="mailto:Hardwarehacking@blu.org">Hardwarehacking@blu.org</a><br>
<a href="http://lists.blu.org/mailman/listinfo/hardwarehacking" target="_blank">http://lists.blu.org/mailman/listinfo/hardwarehacking</a><br>
</blockquote></div><br></div>