Slashdot Mirror
Vulnerability in Z-Wave Wireless Communications Protocol, Used By Some IoT and Smart Devices, Exposes 100 Million Devices To Attack (bleepingcomputer.com)
An anonymous reader writes: The Z-Wave wireless communications protocol used for some IoT/smart devices is vulnerable to a downgrade attack that can allow a malicious party to intercept and tamper with traffic between smart devices. The attack -- codenamed Z-Shave -- relies on tricking two smart devices that are pairing into thinking one of them does not support the newer S-Wave S2 security features, forcing both to use the older S0 security standard.
The Z-Shave attack is dangerous because devices paired via an older version of Z-Wave can become a point of entry for an attacker into a larger network, or can lead to the theft of personal property. While this flaw might prove frivolous for some devices in some scenarios, it is a big issue for others -- such as smart door locks, alarm systems, or any Z-Wave-capable device on the network of a large corporation. The company behind the Z-Wave protocol tried to downplay the attack's significance, but its claims were knocked down by researchers in a video.
The Z-Shave attack is dangerous because devices paired via an older version of Z-Wave can become a point of entry for an attacker into a larger network, or can lead to the theft of personal property. While this flaw might prove frivolous for some devices in some scenarios, it is a big issue for others -- such as smart door locks, alarm systems, or any Z-Wave-capable device on the network of a large corporation. The company behind the Z-Wave protocol tried to downplay the attack's significance, but its claims were knocked down by researchers in a video.
Neat trick, but if you watch the video, they have to be able to connect to the device while it's pairing to inject the attack...so, pretty cool, but I wonder how practical an attack it is in practise.
Which electronic front door locks are using this vulnerable protocol? Asking for a friend, it's not like I go around breaking into houses or anything...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
The vulnerability is not in someone getting a hold of your device in your house. The vulnerability is in someone using a device to get inside your network from outside your home. The Z-Wave protocol has a range of 100m. This attack means that someone could use a device, force pair it with your door locks from a distance and then unlocking the doors without you knowing. In the article it shows researchers doing that. And that's just door locks. Any IoT device can be force paired from a distance.
Well, there's spam egg sausage and spam, that's not got much spam in it.
What could go wrong?
https://www.youtube.com/watch?v=_CQA3X-qNgA
Have gnu, will travel.
I can recall after I got my new house I was looking into how I could better control the radiators and was kinda annoyed that my options seem to come down to either consumer-friendly z-wave or 'probably effective but more complicated industrial solutions'. I could not find a nice simple 'do this over PoE instead of wireless' type solution.
The locks in question pair over short distances - by design - and generally have to be taken off of the door and held need the controller to pair. Having an outsider cause a downgrade attack at that one critical time would be extremely unlikely. Once paired, there is no path to attack.
Sure, I would have locks reflashed if the manufacturer offered it inexpensively. But there's no reason to panic.
Bruce Perens.
Not rhetorical. Can you remotely pair? Every system I've ever used that required "pairing", required physical access. I could see someone intercepting the pairing from a distance, but I would hope that a remote attacker could force pairing from a distance.
This. You have to press a pairing button either on the webpage or on the physical controller. Either way you'd already have access if you could do either of those.
Mike @ The Geek Pub. Let's Make Stuff!
Considering the range of 100m, yes. Now this vulnerability relies on attacking during a pairing process so an attacker cannot drive by and take control of all IoT networks but they can just wait outside a physical home for a pairing. How often does pairing occur? That depends. For unknown reasons my bluetooth devices required to be re-paired every now and then. If the devices do not need to be paired often then the chance of a remote attack is less
Well, there's spam egg sausage and spam, that's not got much spam in it.
I've never had to re-pair any Z Wave devices in my home... I guess you'll be waiting a LONG time for that event, which takes place at $RANDOM time and maybe once a year when I add a new device...
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
Only if you will NEVER EVER add a new device or replace a device. I mean I still use all the same electronic devices I purchased in 1977. Now get off my lawn.
Well, there's spam egg sausage and spam, that's not got much spam in it.
During the pairing process you can pair with the older version of the protocol. However, the pairing process only happens when you add the device to your network and it only happens once.
I'd agree with Sigma, this is a pretty minor issue.
Sure someone could come in, disassemble your Z-Wave device, exclude the device, then re-pair it. At that point they have physical access to your stuff, so why not just crack open your home automation system?
You know, I still have my Coleco Electronic Quarterback you insensitive clod! :)
Browsing at +1 - no ACs, I ignore their posts. So refreshing!