- Z-Wave is a little bit different
than other IOT communication protocols.
This is because Z-Wave is a connection oriented protocol.
Basically the notes on the network
acknowledged the receipt of messages
from a network controller.
Z-Wave uses the concept of mesh networking.
A Z-Wave mesh network node can forward commands
and receive responses from neighboring nodes.
Now the Z-Wave network is also capable of high availability
and this is actually done
by routing around the failed point.
And this is also because of overlapping radio zones.
Each node can route to a maximum of four devices.
Now this gives a Z-Wave network
a maximum range of 400 feet.
The Z-Wave controller maintains a routing table
of each node and the respective neighbors
the routing table is created when a device
is actually added to the Z-Wave network
and people call this the inclusion process.
When notes are included or removed from the network
the network administrator can actually trigger a request
for device identification to construct
an updated routing table.
Z-Wave devices operate at the 908.42 megahertz frequency
in the Us and 868.42 megahertz in Europe.
The US frequency falls within the FCC designated
industrial scientific medical ism band.
Z-Wave uses either frequency shift keying, FSK,
or the Gaussian frequency shift keying, or GSFK.
Data transmission is actually fairly slow.
The transmission rates are 9.6 kilos per second,
and 40 kilo per second for FSK,
and a hundred kilowats per second for GFSK.
Now to encode data within the modulated RF signal,
Z-Wave uses Manchester or non-return to zero encoding,
or NRZ encoding.
Now Z-Wave uses the AES-OFB or output feedback mode protocol
to provide data confidentiality on the network
while using the AES CBC-MAC protocol,
so the encryption protocol,
to provide data integrity protection.
These protocols are definitely well established
and you learned about these protocols actually
in the first course part of this series.
And you know that with the CBC-Mac protocol
it is actually used
in many other critical site for suite implementations
as well.
Now, the Z-Wave protocol
implements a class security command,
and to be specific,
a class underscore security command,
that is used to exchange security information
between devices.
Whenever a c-wave device joins the network
and supports the security class,
it completes a key exchange process
to derive keys for subsequent use in encryption
and data integrity protection.
These are the steps for the key exchange process.
The first two steps, so in steps one and two,
the controller and the secure device
prepare for the key exchange.
This is where the controller notices
if the device supports the class security command class,
then the controller request and the security device
return a nonce value.
Now with the nonce value
the controller encrypts the network key,
or what we refer to as KN, using the temporary key,
which we also refer to as KO.
The network key is actually randomly selected
by the controller when the network is actually established
and is therefore unique for each Z-Wave network.
The temporary keys is an array of 16 bytes of minus zeros.
When the secure device receives the encrypted network key,
or KN, and the Mac from the controller,
it validates the Mac,
and decrypts the message with the temporary key, or the KO.
So the security device then registers
the decrypted network key as the current key, right?
And then the secure device requests a nonce
from the controller and then using the nonce value
the secure device actually encrypts
a key set okay message
which is actually the hexidecimal value of zero seven.
Now then the controller validates that the packet
was encrypted by using the KN,
by validating the Mac.
Now, the problem is that the key exchange process
has been historically vulnerable to several attacks.
It has been vulnerable to man in the middle attacks
because the secure devices do not validate the identity
of the controller other than validating the Mac
of the encrypted network key using the temporary key.
This is also vulnerable to key recovery attacks
because there's no confidentiality protection
in the delivery of the network key,
over the, of course the network,
since the temporary key is actually well known.
Basically if you passively capture the inclusion
process using class security,
you can potentially recover the network key
and then use it to decrypt and forge Z-Wave packets
on the network.
The Z-Wave Alliance is the organization in charge
of the ENO probability and the compatibility
of Z-Wave devices.
So to address the vulnerabilities
that I actually just discussed,
and to also to minimize the cost of the overall system,
especially, you know,
these systems are low cost.
And I'm not saying that they are actually low budget
but in a lot of cases
actually they have to do minimize the cost
of addressing some of these vulnerabilities.
They actually,
the Z-Wave Alliance added a new feature
to the process called the low power inclusion mode.
Of course, eavesdropping attacks are also possible
since they are a common attack technique
against any wireless network.
Now Z-Force is a tool
that it was actually designed for Windows.
And it was also created by two security researchers
called Bernard (indistinct) and (indistinct).
And they actually had pretty good research
into different Z-Wave vulnerabilities actually.
They presented all the way back in 2013 or so.
Now you can actually use that tool
to eavesdrop Z-Wave networks
and also intercept and inject Z-Wave frames.
However, most of the vulnerabilities
they actually leverage have already been fixed
by many vendors.
Now, as you probably remember, in lesson three
I cover the different wireless antennas and adapters.
You learn about the yard stick one
which is an antenna that allows you to monitor
and inject frames to RF signals lower than one gigahertz.
You can use it in conjunctions with many tools
like RFcat to monitor not only Z-Wave signals,
but again anything that transmits under one gigahertz.
In this example, I'm actually showing RFcat
and I'm using the RF receive function.
And you can see that all the functions starts with a D
in here, and this actually function
I'm actually specifying the Z-Wave frequency of 908.4.
I have actually Z-Wave door lock
that is actually transmitting
so once I actually a press enter,
you see a series of hexidecimal values.
These are just a quick example of a transmission
from the door lock looking for a Z-Wave controller.
Now, as I mentioned,
I'm actually using RFcat with a yardstick one.
And here I'm actually printing
the radio configuration using
the d rep r radio config function.
And as you can see, I'm actually using the yardstick one,
as I mentioned before, and it gives you information
about the current configuration
including things like the frequency, modem packet,
crypto and radio test signal configuration.
And it also shows you the radio state
and the client state information.
Now, there are many features within Rfcat.
It even comes with a spectrum analyzer.
In this example, I'm actually using the 908.4 frequency.
And here we actually see a couple of spikes
in very adjacent frequencies, right?
So again, you can actually use the built-in
spectrum analyzer that actually comes with RFcat
and not only for Z-Wave,
but for any type of frequency under one gigahertz.
Now let's exit this and show you a few other
built in-functions and capabilities
in RFcat like the RF transmit, right?
So you can use this to transmit specific data
into there at a specific frequency.
Now you can use this in replay attacks.
And of course here, I'm actually just showing you a simple
you know, hello,
but it can be anything that you actually want to replay.
And later in this lesson,
I'll show you a couple of other tools
that actually makes your life easier with replay attacks.
Now you can have many other options and functions
that allow you to do things
like adjusting frequency offsets, change a channel,
perform low level debugging, and much more.
Now the discover function can be used to listen
for specific sync words.
The RF capture function dumps data into the screen
returning a list of packets.
And you have many, many, many other options
in here as well.
So for year reference,
I actually have documented several
of the RFcat useful commands
and other references for you at our GitHub repository.
Now there's another tool
that you can actually use for packet interception
and injection called the Z-Attack.
And I also had added a few references
about this tool in the GitHub repository.
Now a very handy tool that can be used
in combination with the yardstick one and Rfcat
is called RFcrack.
And this is a tool created by the console Cowboys folks
that actually allows you to perform replay attacks
to any frequency below one gigahertz.
And again, this is not only for Z-Wave,
but anything that operates at those frequencies.
You can also send safe payloads,
perform jamming attacks, scan incrementally
through a specific frequencies, and much more.
Now here I'm showing the scanning capabilities,
and you can see the different frequencies
that is actually scanning.
And then, of course, it frames
from adjacent devices that is actually picking up.
Now, you can also perform live replay attacks
and it's actually pretty powerful.
And you do this by using the minus eye option,
as I'm actually showing in this screen.
You can even save the packet
to a file for future replace.
Now, in this lesson, I cover zero security
but I also gave you a few pointers on tools
and devices that you can play with to perform research
on this evolving world of RF and IOT devices.