100 Million IoT Smart Devices are Vulnerable to Z-Wave Wireless Communications Protocol Downgrade Attack

Z-Wave, a Wireless Communication Protocol that widely used in IoT Smart Devices vulnerability allow attackers to perform Downgrade Attack and compromise nearly 100 Million IoT devices around the world.

Z-Wave protocol used in many of wireless control IoT devices such as security systems, Door locks,  garage door openers and  Z-Wave automation system can be controlled from a wireless keyfob.

Also, it Helps to share the network key exchange to secure traffic in between controller and the client devices after the device paired.

Also, This key allows to protect the communications and prevent attackers from exploiting joined devices.

There are over 100 million Z-wave chips are used in smart devices and 2,400 vendors including the communication range between the device and the operator over 100 meters.

How Does this Z-Wave Downgrade Attack

Earlier Smart device pairing process between client device and controller using “S0” that had a vulnerability and the pairing node using a key of all zero which leads to sniffed by an attacker within RF range.

So later it was fixed and improved into S2 and this Vulnerability allow attacker back to S0 by obtaining the network key.

To perform this test researchers using  Sigma provided tool called ‘PC Controller’ also they said, This is not a Z-Wave certified S2 controller, and hence does not display a warning when S0 security is used. Most S2 controllers have a very limited UI, so even if they do alert the user it’s likely to be no more than a flashing LED.

This could lead to attacker Exchange the network key and they will replace the fixed key as “0000000000000000” which indicate that they obtain the network key and attack any device on the network when the device is paired with in the  RF range.

S2 pairing key cannot be intercepted but the attacker exploits this vulnerability while the time of pairing and perform the downgrade an S2 pairing to S0.

So attackers intercept the key then intercept, inject S0 traffic on the Z-Wave network and there is very very less time to perform this attack and attacker would need advanced equipment to perform this attack successfully. you can read technical analysis here.

Also Read:

“Hide ‘N Seek” the First IoT Botnet with the Ability to Survive Device Reboots

Cryptocurrency-mining Malware Sold in Underground Markets Targeting IoT Devices

Beware – Dangerous IoT Attacks Leads Some One to Hack and Control Your Car

Researchers Use Machine Learning to Create Real-time IoT DDoS Detection Tool to Block Attack Traffic from IoT Botnets

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as "GruesomeLarch"…

1 day ago

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based…

2 days ago

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central…

2 days ago

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India,…

2 days ago

Raspberry Robin Employs TOR Network For C2 Servers Communication

Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection…

2 days ago

145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks

Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report…

2 days ago