D1T2 - Pwning KNX & ZigBee Networks
summary
Researchers demonstrate remote compromise of KNX/IP routers to eavesdrop or DoS building bus and reprogram group tables to control devices across rooms in a 300-room hotel by exploiting default KNX key ffff and accessible IP router settings. For ZigBee they show full-network takeover against devices from ABB, Samsung, Xiaomi using a Raspberry Pi 3 B "zombie" kit paired with a cheap ZigBee USB stick to sniff keys, force rejoin, and inject broadcast commands.
AI-written summary · about
chapters (27)
- 0:00Introduction to talk
- 2:08Intelligent building overview
- 4:42Remote attack on KNX demo
- 6:43ZigBee protocol basics
- 8:13ZigBee security measures
- 10:41ZigBee network joining process
- 13:11ZigBee security risks
- 15:49ZigBee attack tools
- 16:51Automated ZigBee attacks
- 18:22ZombieZigBee tool demo
- 19:32First part recap
- 19:56Introduction to KNX networks
- 21:03KNX device categories
- 22:10KNX network topologies
- 23:45KNX protocol basics
- 25:12KNX IP communication
- 27:25KNX security models
- 29:12KNX attack surface
- 30:39Testing environment setup
- 31:44Discovering KNX devices
- 33:36Cracking KNX networks
- 35:23Attacking isolated KNX networks
- 36:48Physical access to KNX
- 38:15Modifying KNX group tables
- 40:30Final attack process
- 41:35Security recommendations
- 43:06Q&A session
related talks
26mBMS is destroyed by "smart button"
20mA Universal Controller to Take Over a Z-Wave Network
21mLearn How to Control Every Room at a Luxury Hotel Remotely
48mMoving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites
31mHacking Everything – The Dark Side of the Internet of Things
44m"Attacking industrial remote controllers for fun and profit"
26mHacking buildings: Security flaws in embedded building control systems
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors