Slashdot Mirror
Vulnerability in Z-Wave Wireless Communications Protocol, Used By Some IoT and Smart Devices, Exposes 100 Million Devices To Attack (bleepingcomputer.com)
An anonymous reader writes: The Z-Wave wireless communications protocol used for some IoT/smart devices is vulnerable to a downgrade attack that can allow a malicious party to intercept and tamper with traffic between smart devices. The attack -- codenamed Z-Shave -- relies on tricking two smart devices that are pairing into thinking one of them does not support the newer S-Wave S2 security features, forcing both to use the older S0 security standard.
The Z-Shave attack is dangerous because devices paired via an older version of Z-Wave can become a point of entry for an attacker into a larger network, or can lead to the theft of personal property. While this flaw might prove frivolous for some devices in some scenarios, it is a big issue for others -- such as smart door locks, alarm systems, or any Z-Wave-capable device on the network of a large corporation. The company behind the Z-Wave protocol tried to downplay the attack's significance, but its claims were knocked down by researchers in a video.
The Z-Shave attack is dangerous because devices paired via an older version of Z-Wave can become a point of entry for an attacker into a larger network, or can lead to the theft of personal property. While this flaw might prove frivolous for some devices in some scenarios, it is a big issue for others -- such as smart door locks, alarm systems, or any Z-Wave-capable device on the network of a large corporation. The company behind the Z-Wave protocol tried to downplay the attack's significance, but its claims were knocked down by researchers in a video.
Neat trick, but if you watch the video, they have to be able to connect to the device while it's pairing to inject the attack...so, pretty cool, but I wonder how practical an attack it is in practise.
Which electronic front door locks are using this vulnerable protocol? Asking for a friend, it's not like I go around breaking into houses or anything...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
If I can get inside the house to present the pair button? Why does it matter?
So, companies rushed to get products out the door, using a new protocol which hasn't been field tested by people who will break into it .. and now it's turning into a gaping security hole.
The problem with this IoT stuff is people have been rushing it out the door, and treating security as an afterthought.
I'm afraid this was pretty much inevitable, and many of us have been saying so for some time.
Oh well, that is what you get for being on the bleeding edge of technology, and this is truly a case of marketing driving the bus.
I mean, connecting your door locks to the internet. What could go wrong?
When/Will there ever be a backlash to all this "smart" shit.
I mean don't get me wrong, it's cool to tell a voice assistant to add shit to lists and turn lights on and off. But no way in hell am I going to install smart locks or any other critical component of home security and safety, just don't need it.
Who would ave thought that IOT devices would be insecure..
Oh that's right, everyone with at least at high school education or better!
This was only a matter of time.
I can recall after I got my new house I was looking into how I could better control the radiators and was kinda annoyed that my options seem to come down to either consumer-friendly z-wave or 'probably effective but more complicated industrial solutions'. I could not find a nice simple 'do this over PoE instead of wireless' type solution.
The locks in question pair over short distances - by design - and generally have to be taken off of the door and held need the controller to pair. Having an outsider cause a downgrade attack at that one critical time would be extremely unlikely. Once paired, there is no path to attack.
Sure, I would have locks reflashed if the manufacturer offered it inexpensively. But there's no reason to panic.
Bruce Perens.
*Looks at your fancy door lock* ,,. *throws rock through window*
Or, you know, you could post a link to the original research.
During the pairing process you can pair with the older version of the protocol. However, the pairing process only happens when you add the device to your network and it only happens once.
I'd agree with Sigma, this is a pretty minor issue.
Sure someone could come in, disassemble your Z-Wave device, exclude the device, then re-pair it. At that point they have physical access to your stuff, so why not just crack open your home automation system?
Compare the difficulty and cost of this attack versus a brick through a window.
Which attack is quicker, easier, cheaper, and requires no planning?
Yes, I can imagine the HIGHLY unlikely scenario where the FBI targets you, drops a "bug" in your flowerbed, then leverages the attack to compromise your entire Z-Wave network, to disarm your high-tech alarm system, enter your home, do dirty deeds, and then depart without you ever being aware that they were there. I know you think they want snaps of your gentleman's sausage. But take my word, nobody wants to see that. NOBODY.
I can much more likely see the neighbor's drug-addicted kid busting the window and making off with your valuables while everyone tries to ignore your "annoying alarm siren" and the police arriving 20 minutes later, to the theme of yakety sax, only to confirm that you've indeed been burgled.
It is the XKCD encryption scenario all over. https://xkcd.com/538/