Forgot your password?
typodupeerror
Security Networking Wireless Networking Technology

Black Hat Talks To Outline Attacks On Home Automation Systems 79

Posted by timothy
from the hal-do-you-do? dept.
colinneagle writes "If you use the Z-Wave wireless protocol for home automation then you might prepare to have your warm, fuzzy, happiness bubble burst; there will be several presentations about attacking the automated house at the upcoming Las Vegas hackers' conferences Black Hat USA 2013 and Def Con 21. For example, CEDIA IT Task force member Bjorn Jensen said, 'Today, I could scan for open ports on the Web used by a known control system, find them, get in and wreak havoc on somebody's home. I could turn off lights, mess with HVAC systems, blow speakers, unlock doors, disarm alarm systems and worse.' Among other things, the hacking Z-Wave synopsis adds, 'Zigbee and Z-wave wireless communication protocols are the most common used RF technology in home automation systems...An open source implementation of the Z-wave protocol stack, openzwave, is available but it does not support the encryption part as of yet. Our talk will show how the Z-Wave protocol can be subjected to attacks.'"
This discussion has been archived. No new comments can be posted.

Black Hat Talks To Outline Attacks On Home Automation Systems

Comments Filter:
  • by Anonymous Coward

    If I can't connect my heater and stereo to the internet I might as well be living in a dumpster. The humanity!

    • But think of the creative potential for staging some awesome swatting theater when the neighbours are away... lights flashing, beepers beeping, curtains ruffling as the authorities arrive... great fun.

  • So your AMP does not have a overdrive cut off?

    • by Gr8Apes (679165)
      Not until it shows potential to damage the amp....
    • by Anonymous Coward

      The amp's overdrive cutoff protects the amp, not the speakers. Mine goes out all the time when I'm on the porch with a beer and the stereo cranked. However, if your speakers are rated at less than the amp's peak power (not root mean square) you're doing it wrong. You can't blow 200 watt speakers with a 100 watt amp any more than you can blow a twenty amp fuse with ten amps.

      People make the mistake of buying 100 watt speakers and a 100 watt RMS amp and think they're safe. That 100 watt stereo can actually bla

  • Anyone directly connects their home automation equipment to the internet is asking for trouble.
    • No home automation system is an Island. - John Donne
    • by gnick (1211984)

      Anyone directly connects their home automation equipment to the internet is asking for trouble.

      If you don't realize that there are security concerns, there are minor conveniences to be had. E.g. heating up the jacuzzi for when you get home, checking to make sure you turned the oven off, cancelling the A/C timer because you won't be home until much later than expected, etc. Minor, but "neat" enough to sell to somebody who wants to show it off.

    • by peragrin (659227) on Wednesday June 26, 2013 @02:30PM (#44115585)

      Comcast is pushing their home automation/security system that ties into their servers.

      Part of the advertising is to watch your kids come home from school and turn on the lights for them.

      Now that is scary. Letting any idiot know when your kids are home alone.

      • Comcast is pushing their home automation/security system that ties into their servers.

        Part of the advertising is to watch your kids come home from school and turn on the lights for them.

        Now that is scary. Letting any idiot know when your kids are home alone.

        What is your dream ? Please said to me, How to create responsive web design?

    • by Miamicanes (730264) on Wednesday June 26, 2013 @02:41PM (#44115671)

      Connecting HA gear to the internet in a way that's both secure and works (especially with the manufacturer's own Android/iOS/ActiveX software) is actually pretty hard to do with real-world equipment, mainly because the overwhelming majority of stuff that's affordable (and shocking amounts of stuff that's supposedly top of the line) gets implemented with little more than symbolic security that's the equivalent of a TSA lock.

      One of the most common ways embedded hardware gets connected to the Internet is via Wiznet w5100 modules (and variants). Basically, the w5100 is a bridge between UDP and a serial port. Data arrives on some port, and gets blindly sent to the serial port. Data comes in through the serial port, and gets sprayed out via UDP. There's some minimal logic that implements a half-assed 8-character "password" that -- at best -- might be equivalent to a 64-bit random number IF you hacked their setup utility to accept arbitrary byte values instead of just letters and digits (effectively turning it into more like a 40-bit random value). Keep in mind that there's no rate-limiting or lockout, so the only limiting factor at which someone can try to bruteforce you is your internet connection.

      A few months ago, I estimated that an attacker who knows you have something specific behind a Wiznet interface that responds to a known command with a known response would take about 1-3 months to bruteforce if they kept the rate low enough to not noticeably affect your internet access or attract undue attention, and less than a weekend if they just all-out hammered you as fast as they could, trying only 8-character alphanumeric values and starting with those that begin with digits & plaintext English words.

      That itself isn't necessarily the problem per se... there's nothing that says you can't encrypt the data being sent via UDP and in response, and implement stronger authentication and authorization checks on your own... except nothing actually DOES.

      99.9% of the time, you have a circuit with almost no real network-level security that was developed with the assumption that someone with physical access to the serial port has already demonstrated some level of authorization, connected to a serial-ethernet bridge whose "security" is almost a complete sham, with predictable results: disaster.

      Short answer: if you want to connect consumer gear over the internet, buy a Raspberry Pi, and use it as a middleware gateway device that accepts incoming connections via https, enforces its own strong authentication, passes no raw commands directly between the internet and embedded device, or at least requires that any raw value be signed with a pinned certificate. Then connect THAT to the embedded device through the Wiznet serial-ethernet adapter. Never, ever, EVER expose a serial port directly to the internet through a serial-ethernet adapter... I can almost guarantee that any such adapter that ISN'T built around a RPi and costs less than $200 is inherently insecure and a hack attack waiting to happen.

      If you absolutely MUST expose some consumer-grade device with insecure ethernet-serial interface over the internet, at least hide it behind a router running OpenWRT/Tomato/dd-WRT and use something like port knocking and IP range-blocking to temporarily unblock access to your mobile device's current IP address for short periods of time when you intentionally enable it (keeping in mind that with many wireless providers, switching between HSPA/EVDO and LTE will radically change your IP address, and your address might change from request to request ANYWAY.

      • For criminy's sake. TLS is *there*. It's *free*. Why the hell aren't these guys using it??

        • by Miamicanes (730264) on Wednesday June 26, 2013 @04:19PM (#44116597)

          > For criminy's sake. TLS is *there*. It's *free*. Why the hell aren't these guys using it??

          Quite a few embedded home automation devices are built around 8-bit MCUs like the Atmel AVR family. You'd be massively challenged to get even a minimal subset of TCP/IP working with a chip like the Microchip ENC28J60 ethernet controller and an Atmel Atmega 128. SSL/TLS? ROFLMAO. It's not happening. You could probably kludge something with more chips and sram, but by that point, you'd be better off throwing in the towel and buying a RPi board.

          Pre-RPi, ARM boards with additional RAM were pretty expensive (at least $80-150), so a $10 AVR plus $15 Wiznet board represented a huge cost savings. Now that you can get a RPi for $30, it's kind of stupid to keep building controllers with 8-bit MCUs and ethernet-serial bridge boards... but a year ago, the RPi basically didn't exist, and even 6 months ago, it was pretty expensive once you factored in rape-level shipping charges to the US. Genuinely cheap ARM chips with external RAM are game-changing for anything that involves communication over the internet.

          • by Miamicanes (730264) on Wednesday June 26, 2013 @07:40PM (#44118265)

            For the morbidly-curious, here's a book that might give you somewhat of an idea of what USED to be involved with interfacing a microcontroller with a network over Ethernet pre-Wiznet w5100, and give the benefit of context to understand why that module (and its descendants) have been so wildly popular among embedded developers working with 8-bit microcontrollers.

            http://www.amazon.com/Networking-Internetworking-Microcontrollers-Fred-Eady/dp/0750676981/ref=wl_it_dp_o_pC_S_nC?ie=UTF8&colid=75OKCKDXZ6YI&coliid=I2PABIRD1YO96X [amazon.com]

            The Microchip ENC28J60 falls somewhere between the older chips written about in that book and a "plug & play" module like the W5100. With the older chips, you were lucky to hack together your own personal networking protocol that (barely) managed to coexist on the same wire as NETBIOS, TCP/IP, and IPX/SPX. The ENC28J60 does for networking kind of what the ATI Rage Theater chipset did for MPEG-2 video compression... it accelerates and automates some of the grunt work of interacting with signals on the cable so you can pay attention to bigger details, like your actual protocol. I've never personally used it, but from what I've read, ENC28J60 TCP/IP is "do-able, but with a few cautions and limits". By comparison, the W5100 is pure black magic... to your embedded app, it turns the Internet and/or your local LAN into a big virtual serial cable.

            When the w5100 came out ~5-6 years ago, embedded developers were LITERALLY dancing in the streets, because it was dirt cheap and "just worked". Security wasn't even a CONSIDERATION until 2-3 years later, when the consequences of exposing the serial ports of devices with no security besides physical access to the port started to really sink in... and the devices themselves had almost no serial-port security, because pre-Wiznet, an ethernet-serial adapter cost somewhere between $250 and $400... at RESELLER prices. Pre-w5100, serial ports just plain didn't get exposed to the internet, because the adapters to do it were too expensive to even contemplate.

      • by g0bshiTe (596213)
        I can't believe you used Android/iOS/ActiveX in the same sentence as the word secure.

        Luckily I continued reading your post and saw what you did there.
      • I've never even seen a mod point, but +1 to you, sir!
  • Hackers can now become professional burglars. Revenge of the nerds anyone?

  • Yup ... (Score:5, Insightful)

    by gstoddart (321705) on Wednesday June 26, 2013 @02:07PM (#44115341) Homepage

    My cable company keeps sending me crap for home monitoring whereby you can control your alarm from your smartphone -- and I wouldn't trust that.

    My energy company wants me to sign up for a smart thermostat where they can remotely change my temperature if they decide I should be using less energy -- and I sure as hell wouldn't want that.

    Opening up access to these things from outside of your home sounds like it might be convenient, but it's a gaping security hold waiting to happen.

    No way, no how would I want things like this. Because I have zero confidence that the people writing this give a shit about my security, just getting a product to market.

    • If you are in North America your energy provider is most likely using ZigBee Smart Energy. That is a mostly open standard in that anyone can read the spec. but only ZigBee members can change it. The spec uses Elliptic Curve Cryptography for key exchange and authentication and AES for message security. It's pretty darn secure but unfortunately much harder to set up than the Z-wave. Users seem to choose convenience over security every time until after they have been attacked. Disclaimer - I'm working o
    • Re:Yup ... (Score:4, Interesting)

      by plover (150551) on Wednesday June 26, 2013 @04:46PM (#44116877) Homepage Journal

      My energy company wants me to sign up for a smart thermostat where they can remotely change my temperature if they decide I should be using less energy -- and I sure as hell wouldn't want that.

      And why is that?

      Here's the deal: the world is adding a lot of homes and factories to the existing power grid, but they're not building a lot of new electrical plants. Nobody wants coal stacks near their house, nobody wants nuclear power in their back yard, nobody's going to dam another valley and kill a bunch of endangered owls, yet everyone in those new homes and factories still expect the lights to come on when they flip a switch. The grid is not only close to capacity, it's frequently at capacity. Instead of causing rolling blackouts, your power company probably buys supplemental peak electricity from factories and data centers that have large backup generators - but that emergency electricity costs anywhere from 10X - 50X the price of their existing plants, and burns expensive diesel fuel or natural gas.

      The power companies would be happy to give you regular electricity at lower rates if they could charge you peak rates for consuming extra electricity during peak times. I say this because that's exactly what mine does. By agreeing to allow them to shut off the power to my heat pump for up to 40 minutes per hour during peak demand, I pay about $0.05/kWh for all the energy it uses year round. Without their demand sharing program, it would cost me at least $0.12/kWh no matter when I use it. Between me and the other members of my co-op signing up for this program, we have saved enough peak generating capacity to defer the construction of a new power plant by 10 years, so our overall rates have remained nice and low. I haven't seen an electricity price increase in 10 years. (Yes, electric co-ops are awesome and your giant energy conglomerate sucks.)

      So what if the house gets a few degrees warmer on about 5 afternoons out of the year? Cooperation is worth it.

      And regarding security, our load controller is a simple FM receiver that operates a relay. When it gets a "sharing request", it picks its own time window and shuts the pump to the compressor off for a random 40 minutes out of each hour. The thermostat is calling for cooling, the HVAC system is running the fans and it thinks it's turned the compressor on, but nothing cool actually happens. The relay is the only interface to my house, and it is wired directly into the compressor. There is no other interconnection with any home systems, no back channel through which a hacker could inject a rogue FM signal to unlock my doors, or disable my alarm system, or shut off my freezer and make my frozen foods all melty.

      • > And why is that?

        Because they'll cut your AC precisely on the hottest days of the year when you need it the most. But wait, it gets worse. If you cut the compressor, but allow the fan to run, you're effectively running dry air over a pool of water in the evaporator pan. If your compressor can only run for 20 minutes per hour, it's 100+ degrees outside, and your thermostat is set to 74, the interior temperature is probably going to go up more in 40 minutes than it can be cooled in the remaining 20, which

        • by Rich0 (548339)

          Because they'll cut your AC precisely on the hottest days of the year when you need it the most.

          Tend to agree - the way it is implemented is really dumb.

          There should be three options:
          1. No participation
          2. Load balancing / emergency use only.
          3. Rollback on high demand days.

          Option 3 should get you a big utility break - it allows the utility to greatly reduce their peak supply capacity as they can count on being able to really turn you back on hot days. This would be ideal for locations that are unoccupied during peak periods.

          Option 2 is where most people would want to be. It would not affect your d

      • by Ol Olsoc (1175323)

        And why is that?

        Here's the deal: the world is adding a lot of homes and factories to the existing power grid, but they're not building a lot of new electrical plants. Nobody wants coal stacks near their house, nobody wants nuclear power in their back yard, nobody's going to dam another valley and kill a bunch of endangered owls, yet everyone in those new homes and factories still expect the lights to come on when they flip a switch.

        We once had a drought in our area. The powers that be demanded that we all cut back on our water usage by 20 percent. But they didn't restrict new water connections. In an area where growth was around 10 percent annually at the time, that didn't mean much. It's an interesting calculation to figure that one new connection wiped out the gains from a lot of water conservation by existing citizens.

        Using energy efficiently is the wise thing to do, but we cannot conserve ourselves out of this problem, because e

  • by girlintraining (1395911) on Wednesday June 26, 2013 @02:08PM (#44115343)

    I don't get it... we can't even secure our nuclear power plants, water and waste processing facilities, and other critical public infrastructure from attacks on industrial infrastructure. Why would anyone in their right mind think home automation would be any more secure?

    • Re:Encryption (Score:4, Informative)

      by gstoddart (321705) on Wednesday June 26, 2013 @02:25PM (#44115529) Homepage

      Why would anyone in their right mind think home automation would be any more secure?

      Because it's shiny.

      They're not thinking of security, they're thinking "ZOMG, I can switch off teh lights from teh phone".

      Nobody thinks that if there's a way for you to remotely control your home, there's a threat vector for someone else to remotely control your home.

      • by bws111 (1216812)

        Yep, you're a genius and everyone else is stupid, right? Or isn't that what you were implying with your use of shiny, ZOMG, and teh?

        People don't care because in the list of 'threats' we are faced with in everyday life, the threat of getting your home automation system hacked is so low it doesn't even register. Furthermore, the consequences of getting your home automation system hacked are equally as low. Think - same likelihood as getting hit by lightning with the same consequences as getting a paper cut

    • by plover (150551)

      I don't get it... we can't even secure our nuclear power plants, water and waste processing facilities, and other critical public infrastructure from attacks on industrial infrastructure. Why would anyone in their right mind think home automation would be any more secure?

      We wouldn't think they're more secure, because we don't need to take them as seriously. By the same logic, why would anyone worry too much about their home automation system when there are so many other more valuable systems to attack?

      I don't yet have door locks, windows, or security systems tied into mine, so pretty much all a bad guy could do would be to blink the lights. If he was way smarter than me, he might figure out how to turn on my TV remotely (I'm still having problems integrating it, and would

    • by pongo000 (97357)


      I don't get it... we can't even secure our nuclear power plants, water and waste processing facilities, and other critical public infrastructure from attacks on industrial infrastructure. Why would anyone in their right mind think home automation would be any more secure?
      Reply to This Share

      Because some of us are in our right mind. I use an SSH tunnel accessible by my smartphone to control a Radio Thermostat [radiothermostat.com] via my wifi router, with WPA-2 authentication and MAC authentication. Perfect? Of course not...but

  • All your base belong to us!

    • by plover (150551)

      All your base belong to us!

      A meme, and perfectly on topic! Congratulations, sir, you win at Internet today. Do a barrel roll!

  • ... about being overly automated and the risks involved?

  • by Anonymous Coward
    Schlage [nexiahome.com] made a big deal about how secure their system was, since it was basically controlled by them (hence the monthly fee). That was one of the main selling points that we were to emphasis to potential customers (I work for a Schlage distributor).

    A lot of high income customers have this entire system set up, down to the door locks, cameras and everything else. This is going to make it much more difficult to sell without some sort of response from the industry.
  • I would really like to have one installed, but all the wireless ones don't seem to even consider that the attacker might be able to attack electronically first. (It's not even mentioned on most of their websites).

    So.. who makes a good security system that is open and secured (means they actually need to update the software!), and ideally will install it for me? I'm fine with a wired system but I still want it to be open...

    (Price range: ideally not more than $500, and I would prefer text/phone alerts with

    • by plover (150551) on Wednesday June 26, 2013 @03:44PM (#44116255) Homepage Journal

      Mi Casa Verde [micasaverde.com] makes the Vera home automation system. It's built on OpenWRT. For security systems it supports several different brands of Z-wave wireless sensors. It can control lights, locks, alarms, blinds, temperature, IP cameras, etc. It speaks Z-wave via a built in radio, but can also control Insteon and other home automation systems. And it's meant to be hacked and extended. You can even install a growl plugin for Vera, and then a growl notification app on your cell phone, if you want to be alerted by it. Nothing requires a monthly fee.

      They offer a free service for remote access, but you certainly don't need them to do it for you. (All their service does is eliminate hassles with DNS and firewalls by serving as a proxy.) Some people simply poke a hole in their firewall allowing them to SSL directly into it.

      The company is really good with their customers.

      My only complaint is that no matter what they say, it still takes technical ability to set it up. It's not what I'd call plug-and-play ready to sell at Home Depot. No home automation system has reached that level of maturity yet.

      • by gQuigs (913879)

        Yea.. I was looking at something similar (although more DIY) in http://ninjablocks.com/ [ninjablocks.com]

        > Mi Casa Verde
        They really seem to want to use cameras in their packages at least. What devices do you have from them? Where is the footage stored from the cameras?

        • by plover (150551)

          Sorry, I don't have cameras, so I don't know how they work through Vera. From what I understand, if you have a compatible IP camera system that can be remotely controlled, you could play it back through Vera. I also know there's only a certain subset of cameras that work through Vera - and you can find them on their wiki. But I know Vera doesn't do the actual video compression or storage - that's part of your camera/video system.

  • by tqk (413719) <s.keeling@mail.com> on Wednesday June 26, 2013 @02:20PM (#44115467)

    Erm ...

    An open source implementation of the Z-wave protocol stack, openzwave, is available but it does not support the encryption part as of yet. Our talk will show how the Z-Wave protocol can be subjected to attacks.

    If the closed source implementation *with encryption* is this fragile, what reason is there not to replace it with the OSS implementation? Eventually, the OSS version will support encryption and in the meantime you'll have a better (more reliable and manageable, likely more extensible, obviously less expensive (no support contracts)) system.

    No, "lawyers" or anything related is not a good answer.

  • So hackers are gonna change the colors on my lightbulbs?
    • by Anonymous Coward

      If you can compromise all of them in your city, poll every 5 minutes, and find out who's out of town? Easier than driving around every day and seeing which cars aren't moving.

      • by dgatwood (11270)

        And then disable the alarm system, and if the home is really automated, unlock the door. Devices intended to provide security should, first and foremost, be secure. If they aren't, they are worthless—doubly so if they actually open up additional vulnerabilities that otherwise would not have existed.

  • so we found a backdoor to your back door so we can own your home if you are a homeowner!

  • Only the low end stuff for home automation uses Z-wave.

    AMX and Crestron dont.

  • Wardriving is about to go to a whole new level..
  • Those camera are advertised as having decent resolution, at least at TWC.

    Why break in?

    Just collect the family in various states of undress, not to mention activity, and sell it to the underground.

    I'd like to see the ad where the wife in the meeting catches her husband and neighbor having sex on the dining room table. Be a real winner to drop on the table at the meeting.

The flow chart is a most thoroughly oversold piece of program documentation. -- Frederick Brooks, "The Mythical Man Month"

Working...