#HITB2018AMS D1T2 - Pwning KNX & ZigBee Networks

### Overview In this presentation at Hack in the Box Amsterdam 2018 (HITB2018AMS), researchers Nikki and Allen from Tencent's security team examine vulnerabilities in intelligent building management systems. Highlighting a relative lack of public security research despite increasing IoT adoption in modern buildings, the speakers target two of the most ubiquitous building automation and home automation protocols: ZigBee and KNX. They showcase practical attacks, culminating in a demonstration of controlling smart lighting systems remotely, including via a drone, and attacking room controls in a luxury hotel.

### Key Topics - **Intelligent Building Architecture**: Systems for lighting control, fire detection, and access control spanning home automation and industrial building automation. - **ZigBee Network Vulnerabilities**: Examination of ZigBee topologies (cluster tree, star, mesh) and device types (coordinator, router, end device), noting weaknesses in key distribution, storage, and replay counter mechanisms. - **Automated ZigBee Attack Tool (Zombie)**: Development of a multi-transceiver attack platform built on a Raspberry Pi 3B to overcome radio coverage limitations and scan across multiple ZigBee channels simultaneously. - **KNX Architecture and Protocol Analysis**: Structure of KNX networks over twisted pair (TP) and IP (KNXnet/IP), detailing group objects, physical addressing, couplers, and default group filtering configurations. - **KNX Security Exploitation**: Practical attack scenarios against unisolated LANs and physically accessed twisted-pair buses in a hotel, including default key exploitation and group filter table reconfiguration. - **Security Recommendations**: Countermeasures for both ZigBee and KNX deployments to mitigate unauthorized interception and command injection.

### Technical Details - **ZigBee Attacks & "Zombie" Tool**: - ZigBee utilizes 128-bit AES symmetric cryptography with link keys, network keys, and master keys across distributed or centralized security models. Common failure modes include well-known default keys (such as ZigBee Alliance default link keys), insecure over-the-air key transmission during node joining or rejoining, insecure storage in flash/firmware, and bypassable replay protection once network keys are sniffed. - To resolve channel-hopping and signal-range constraints during automated building auditing, the researchers built "Zombie," a multi-radio device powered by a Raspberry Pi 3B and multiple CC2531 USB dongles. Zombie spins up virtual network devices with randomized addresses and initial sequence numbers to broadcast attack payloads with valid PAN IDs across multiple channels. - **KNX Attacks & Hotel Case Study**: - KNX transmits Common External Message Interface (cEMI) frames over UDP port 3671 for KNXnet/IP. While "KNX Secure" (Data Secure and IP Secure) exists in modern specifications, legacy deployments lack encryption and authentication. - In a tested 300-meter-high hotel featuring 340 rooms with KNX-controlled lighting, thermostats, TVs, and curtains, the KNX network was isolated from external ethernet/Wi-Fi. The researchers gained physical access to the room's locked utility closet, tapped the twisted-pair bus using a USB interface, and mapped out individual room addresses and group objects. - By identifying that IP router couplers shared between adjacent rooms were protected only by default factory authorization keys (`0xFFFF`), they used ETS software to rewrite router group filter tables. This enabled injection of malicious telegrams from one guest room into another, allowing arbitrary control over devices in neighboring rooms.

### Takeaways To defend ZigBee deployments, organizations must routinely update network keys, avoid well-known default pre-configured keys, and consider higher-layer application encryption. For KNX networks, operators must physically protect bus cables, segment and isolate networks per room, avoid exposing KNXnet/IP to public or untrusted Wi-Fi networks, update to modern ETS versions supporting KNX Secure, and immediately replace default authorization keys (`0xFFFF`) on routers and couplers.