Making (and Breaking) an 802.15.4 WIDS presented at Troopers 2014

by Ryan Speers, Sergey Bratus, Javier Vazquez,

Summary : Real-world security-critical systems including energy metering and physical security monitoring are starting to rely on 802.15.4/ZigBee digital radio networks. These networks can be attacked at the physical layer (reflexive jamming or via Packet-in-packet attacks), the MAC layer (dissociation storms), or at the application layers. Proprietary WIDS for 802.15.4 exist, but don’t provide much transparency into how their 802.15.4 stacks work and how they may be tested for evasion.
As the classic Ptacek & Newsham 1998 paper explained, tricks used to evade a NIDS tell us more about how a protocol stack is implemented than any specifications or even the RFCs. For WIDS, evasion can go even deeper: while classic evasion tricks are based on IP and TCP packet-crafting, evading 802.15.4 can be done starting at the PHY layer! We will explain the PHY tricks that will make one chip radio see the packets while the other would entirely miss them regardless of range; such tricks serve for both WIDS testing and fingerprinting.
We will release an open, extensible WIDS construction and testing kit for 802.15.4, based on our open-source ApiMote hardware. ApiMote uses the CC2420 digital radio chip to give you access to 802.15.4 packets at the nybble level. It can be easily adopted for detecting attacks at any protocol level. It also lets you test your ZigBee WIDS and devices from the frame level up. We will give out some of the ApiMotes.

Ryan Speers: Ryan Speers and Ricky Melgares are Computer Science majors at Dartmouth College, pursuing a senior honors thesis in Zigbee security under Professor Sergey Bratus. So far, their thesis work has entailed receiving an accidental forwarding of a vendors internal email thread discussing the cons of us being security researchers wanting to buy their products, getting caught by campus security physically probing a sensor network, ripping apart the 802.15.4 and ZigBee protocols frame by fame, and spoofing these frames for a variety of attacks. They wish to remind you that “your RF is showing” and that wireless injection is king.

Sergey Bratus: Sergey Bratus is a Research Assistant Professor of Computer Science at Dartmouth College. He enjoys wireless and wired network hacking and tries to help fellow academics to understand its value and relevance. Before coming to Dartmouth, he worked on machine learning for natural text processing at BBN Technologies. He has a Ph.D. In Mathematics from Northeastern University.