Zigbee's wireless security flaws threatens IoT devices

10 August 2015
By James Hayes
Mobile version
Share |
Cognosec's Tobias Zillner [R] and Sebastian Strobl [L], whose research uncovered the ZigBee vulnerability

Cognosec's Tobias Zillner [R] and Sebastian Strobl [L], whose research uncovered the ZigBee vulnerability

The ZigBee wireless communications specification used by many Internet of Things (IoT) devices contains critical security flaws, IT firm Cognosec has claimed.

Speaking at the Black Hat USA conference in Las Vegas recently, Cognosec senior IS auditor Tobias Zillner named the principle security risks in ZigBee implementations, revealed which devices are affected by them and demonstrated practical exploitations of actual product vulnerabilities.

Conducting real-world assessments on identified vulnerabilities, Cognosec found that it is possible to compromise ZigBee networks and thereby take control of connected devices on a network. Smart home devices such as lights, motion sensors, temperature sensors and even door locks, for example, could be compromised via such vulnerabilities, Zillner warned.

First standardised in 2003, the ZigBee specification was developed to enable secure wireless communication for a range of IoT devices; however, low per-unit-costs, interoperability and compatibility requirements, along with the application of legacy security concepts, has resulted in persistent known security risks, said Zillner.

"The key to communicating between devices on a ZigBee network is the usage of 'application profiles'. ZigBee home automation profiles permit a series of device types to exchange
control messages to form a wireless home automation application," Zillner explained in his Black Hat presentation. "These devices are designed to exchange well-known messages to effect control, such as turning a lamp on or off, sending a light sensor measurement to a lighting controller, or sending an alert message if an occupancy sensor detects movement."

Vendors wanting a device to be compatible to other certified devices from other manufacturers have to implement the standard interfaces and practices of this profile, Zillner added: "However, the use of a default link key introduces a high risk to the secrecy of the network key. As the security of ZigBee is reliant on the secrecy of the key material - and therefore on the secure initialisation and transport of the encryption keys - this default fallback mechanism has to be considered as a critical risk."

As a result the ZigBee specification "requires that an insecure initial key transport has to be supported, making it possible to compromise ZigBee networks, and take control of all connected devices on the network,” Zillner argued. The practical security analysis of devices Cognosec assessed indicated that the solutions are designed for easy set-up and usage, "but lack configuration possibilities for security, and [also] perform a vulnerable device pairing procedure that allows external parties to 'sniff' the exchanged network key... This represents a critical vulnerability, as the security of the solution is reliant on the secrecy of this network key”.

One use case Zillner highlighted was of external parties able to gain control over home automation systems, which have high privacy requirements, and as such can be a source of personalised data. Cognosec tests with light bulbs, motion and temperature sensors and door locks also showed that the vendors of the tested devices implemented the minimum of the features required to be certified; no other options to raise the level of security were implemented and available to the end-user, the company asserted.

“The shortcomings and limitations we have discovered in ZigBee have been created by [vendors wanting] to create the latest and greatest products – which these days means they are likely to be Internet-connected,” according to Cognosec's Zillner. “Simple units such as light switches have to be compatible with a host of other devices and [therefore] little consideration is made to security requirements – most likely to keep costs down.”

Cognosec has published its findings in a Zigbee security white paper.

Further information

https://www.cognosec.com

https://www.blackhat.com/us-15/

Latest Issue

E&T cover image 1606

"Where would Frankenstein and his creative mind fit into today's workplace? Should we fear technological developments or embrace them?"

E&T jobs

  • Principal Consultant

    EA Technology
    • Capenhurst
    • Up to £60k DOE + company bonus, generous pension scheme & benefits package

    EA Technology are recruiting for Experienced Consultants to deliver a broad portfolio of projects within our Smart Interventions Division.

    • Recruiter: EA Technology

    Apply for this job

  • Senior Consultant

    EA Technology
    • Capenhurst
    • Up to £45k DOE + company bonus, generous pension scheme & benefits package

    EA Technology are recruiting for Experienced Consultants to deliver a broad portfolio of projects within our Smart Interventions Division

    • Recruiter: EA Technology

    Apply for this job

  • Mid-Level Electrical Engineer

    Max Fordham LLP
    • London

    We are looking for an electrical engineer with around 4- 6 years of design experience to join and work with an able and talented group of engineers..

    • Recruiter: Max Fordham LLP

    Apply for this job

  • Electrical Training Officer / NVQ 3 Assessor

    Premium job

    JTL
    • Norwich, Norfolk
    • Competitive + Pension + Personal BUPA cover

    As a Qualified Electrician, you know what it takes to complete electrical work to exceptional standards of safety and quality.

    • Recruiter: JTL

    Apply for this job

  • Electrical Training Officer / NVQ 3 Assessor

    Premium job

    JTL
    • Dorchester, Poole or Bournemouth
    • Circa £29,000

    As a Qualified Electrician, you know what it takes to complete electrical work to exceptional standards of safety and quality.

    • Recruiter: JTL

    Apply for this job

  • Electrical Training Officer / NVQ 3 Assessor

    Premium job

    JTL
    • London
    • Competitive + Pension + Personal BUPA cover

    As a Qualified Electrician, you know what it takes to complete electrical work to exceptional standards of safety and quality.

    • Recruiter: JTL

    Apply for this job

  • Project Manager - Eastern Region

    Defence Infrastructure Organisation
    • Woolwich, London
    • £24,362 (plus car, +10% supervisory allowance)

    Opportunity to be at the heart of what SSG will be delivering to its wide and varied client base.

    • Recruiter: Defence Infrastructure Organisation

    Apply for this job

  • Project Manager - South West

    Defence Infrastructure Organisation
    • Shrivenham, Swindon
    • £24,362 (plus car, +10% supervisory allowance)

    The Project Manager would be responsible for remedial and small/medium new project works across the Southwest of England

    • Recruiter: Defence Infrastructure Organisation

    Apply for this job

  • Nuclear Facilities Governance Manager

    BAE Systems
    • England, Cumbria, Barrow-In-Furness
    • Negotiable

    Nuclear Facilities Governance Manager Would you like to be accountable for all the Nuclear Governance for both existing day to day facilities on the Barrow Site in addition to the Proposed Facilities development which is part of the multi-million pound si

    • Recruiter: BAE Systems

    Apply for this job

  • Impact Specialist

    Cardiff University
    • Cardiff, Cardiff (Caerdydd)
    • £31,656 - £37,768 per annum (Grade 6).

    You will enhance the interface with business, public and third sector research users.

    • Recruiter: Cardiff University

    Apply for this job

More jobs ▶

Subscribe

Choose the way you would like to access the latest news and developments in your field.

Subscribe to E&T