Locally Exploiting Wireless Sensors

Architecture and Background

Locally Exploiting Wireless Sensors Travis Goodspeed Engineer of Superior Buckles, Goodspeed and Gourneau Wireless sensors are often built with a microcontroller and a radio chip, connected only by a SPI bus. The radio, not the MCU, is responsible for symmetrical cryptography of each packet.

Vulnerability Analysis

When the key is loaded, it is sent as cleartext over the SPI bus, and an attacker with local access can steal the key using a few syringe probes and readily available hardware. This attack and other local attacks against wireless sensor networks will be presented in detail, including a live demo of an AES128 key being extracted from an operational network.

Exploitation and Demonstrations

Following the conclusion of the lecture, audience members will be brought onstage to perform the attack themselves on various pieces of example hardware. Travis Goodspeed is a neighborly reverse engineer from Southern Appalachia.

Remediation and Defensive Strategies

He has been exploiting and reverse engineering wireless sensors since writing the first stack overflow exploit for them in 2007. His recent projects have included a timing attack on the MSP430 bootstrap loader and an extra-neighborly party-mode belt buckle in the shape of Tennessee. For copies of the slides and additional materials please see the DEF CON 17 Archive here: