#z-wave

Okay I have not slept in *checks notes* some ungodly amount of time? Because my connective tissue was designed by Satan on a fucking bender and apparently sleeping is for people whose joints don't try to pop in half like a goddamn roast chicken when they lay down.

So let me tell you A Story about why you really, REALLY should not try to make the good guys infallible, and it goes with my favorite show, Power Rangers.

See, Power Rangers starts off with a premise: An alien sage\mystic\something caught in a time warp needs five teenagers to help save the world from The Forces of Evil.

"Now wait a minute," you might be thinking, "The Forces of Evil is actually an alien queen who's been missing from her kingdom for a couple thousand years due to her OWN time warp and there's apparently a couple dozen cultures involved in this 'evil' bit, plus Zordon, the alien sage, recruits TEENAGERS as SOLDIERS. Possibly Zordon is either 1) not the brightest bulb in the package, 2) slightly insane because he didn't talk to anyone but his robot pal for a couple thousand years, or 3) very weirdly religious?"

And these are good questions! And in the final season, when we see that 'the Forces of Evil' are actually a really vast empire, implied to be a very real nation-state compromised of many smaller planet-nations, we should be getting answers!

So instead the writers say this:

"But no, Zordon and the Power Rangers are Good, and their enemies are Evil. To prove it, we will save the day by having Zordon heroically sacrifice himself, which creates a wave of magic that saves anyone 'good' and turns everyone 'evil' into dust!"

And thus Zordon commits fucking genocide.

Seriously, he just straight-up warps a bunch of people--real, sapient beings--into dust piles. People who are...well, 'evil'? Eh. Paid minions, mostly. Elgar, for example, is a dumbfuck who couldn't pour piss out of a boot with instructions on the heel, but probably not 'evil' so much as 'works for his pirate aunt because he loves his family'. Goldar is a loyal henchman, who mostly fights out of cultural loyalty (and in the comics, they note that it's VERY cultural, and VERY loyalty-based). Ecliptor is an android dad who raised one of the main characters very lovingly, to the point where his love actually convinced her she was fighting on the wrong side.

They all just die.

So it's worth considering here--Do you really want a story with an infallible good guy, who is never questioned? Because when your good guy is never questioned, and can never make mistakes, this is what happens.

Or do you want a good guy who can fail, apologize, and try again? Because the Power Rangers do that, repeatedly. And they actually save the world, just before Zordon does his damndest to kill off an entire civilization.

Z-Wave is a wireless technology designed for smart home devices, enabling seamless communication between them for enhanced automation and control. It operates on low power and is known for its reliability in creating interconnected, efficient home environments.

Tools

VFuzz-public & YARD stick One - Z-wave fuzzer

Z-wave & YARD stick One - Z-wave capture and injection

Zniffer & ACC-UZB3-U-STA - Z-wave capture

Tactics

Network Overview

Authentication

Z-wave has an outdated and weak pairing method called S0. Using this pairing mode, the network key is transmitted with a fixed key of 0000000000000000. This network key can then be captured by a sniffer and used to attack nodes on the network. See Security Evaluation for more details.

Since 2017, Z-wave requires devices to use a more secure authentication called S2, which uses a Diffie-Hellman Key Exchange with an optional 5 digit code authentication. With S2 authentication, it should be impossible to get the network key.

However, the Z-wave is backwards compatible and susceptible to a downgrade attack (called Z-shave) and force the nodes to use the vulnerable S0 authentication.

Encryption

If nodes are using S0 authentication, then the network key can be captured via Zniffing.

If the nodes are using S2, then you'll need to join the PC controller (using an unmodified UZB3 dongle) to the network to get the network key. You will also need a nonce update, either single pre-agreed-nonce (SPAN) or multicast pre-agreed-nonce (MPAN) frame, to be able to decrypt packets. If you're in a hurry, a power-cycle will cause the device to issue a frame to resynchronize nonces.

Enumeration

The network is referred to by a "Home ID" with a value of 32bits. Each node is referred to by their "Node ID" of 8bits. The primary controller will have the Node ID of 1, and assigns the Node ID values for every other node on the network, typically sequentially. If there is a Node ID of 8, you can expect node values of 2-7 to be present. though devices can be assigned new node values when reset, leaving gaps in the addressing.

Neither Node ID (sending or receiving) or the Home ID is protected. Therefor traffic analysis can be used to identify the function of various nodes, and the nature of their encrypted messages. Though the encryption used is not susceptible to plain-text attacks.

Jamming

Jamming Z-wave requires multiple transmitters, or a single transmitter hopping quickly on each frequency being used.

US Z-wave

908.4MHz @ 9.6Kbps and 40Kbps

916Mhz @ 100Kbps

US Z-wave Long Distance are on 912MHz and 920MHz.

Jamming detection and response is dependent on implementation and should be tested.

Z-Wave detects jamming via End Device detection and Controller detection. The End Device expects to receive an ACK for each frame it sends. If an ACK isn't received the End Device may check the RSSI to see if its at expected values. If its determined that jamming is occurring, it may send RF Jamming notification to the controller, repeating at longer durations until an ACK is received.

The controller may sample background RSSI a few times a minute to determine if jamming is occurring. Additionally, it may detect jamming if it misses a heartbeat from a node that hasn't reported a low-battery status. If it detects jamming, then it may alert the user.

Known Vulnerabilities

See https://www.kb.cert.org/vuls/id/142629

Project Ideas

The Zniffer UI is a windows only tool. I should make a linux driver that can save captured packets into pcaps. Might violate EULA/TOS.

Create a jammer that hops both frequencies to test the detection and response of the z-wave devices.

Additional Resources

Zniffer User Guide

Super Zniffer - Modifying the Zniffer to attach an external antenna

Best Practices for Z-Wave Door Locks