A Universal Controller to Take Over a Z-Wave Network
summary
Claims that an attacker can seize an entire Z-Wave installation using only cheap, certified kit: capture the installation Home ID with a DVB‑T SDR, edit the controller backup/restore archive to set that Home ID (two standard Z‑Wave commands) and boot the controller to trigger auto-discovery of every node. The process lets a foreign controller learn and send commands to lights, sensors or locks; demonstrated on ~50-node scans and implemented with low‑cost hardware (USB controller + DVB‑T + Raspberry Pi).
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:40Features
- 1:30Security
- 3:16Devices
- 3:56Raspberry Pi
- 4:35ZWave Controller
- 4:50ZWave Identifier
- 5:35Association
- 6:13Not Information Frame
- 7:24Association and Parrying
- 8:10Complex Attacks
- 8:40New Approach
- 9:08Controller ID
- 11:02DVBT Tuner
- 12:06Screenshot
- 12:23Backup Restore
- 12:47Backup Archive
- 13:00Side Effects
- 13:54Modifying the Controller
- 14:36Autodiscovery
- 15:26Node IDs
- 15:47Demo
- 18:49Summary
related talks
46mD1T2 - Pwning KNX & ZigBee Networks
44m"Attacking industrial remote controllers for fun and profit"
55mAttacking Industrial Remote Controllers
31mConquer the Enterprise from Inside
39mHacking your home-reverse engineering wireless transmission
45mBadUSB - On Accessories that Turn Evil
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
27mLock It and Still Lose It —on the (In)Security of Automotive Remote Keyless