At the Shmoocon 2011 conference which recently concluded in Washington, DC, Ryan Speers and Ricky Melgares presented ZigBee Security: Find, Fix, Finish.
ZigBee is a low-power, low-data rate wireless protocol based on IEEE 802.15.4. It connects lightweight embedded technology like HVAC, smart energy, security, and process automation systems, and is an attractive target as it touches the kinetic framework more than other wireless technologies. Techniques for sniffing ZigBee packets have been presented, as have theoretical vulnerabilities in other types of wireless sensor networks, but this talk uses injection and intelligent packet generation to move towards real proof-of-concept attacks on 802.15.4/ZigBee networks. This talk examines which attacks actually work on ZigBee, and provides proof of concept implementations of theoretical attacks. They present a tool that autonomously discovers and profiles networks in real time, gathering as much information over time about a network and its devices, their relationships, and traffic flows among other things.