Meshtastic Attacktastic

The talk introduces Meshtastic, an open-source platform that passes text messages and GPS locations over long-range LoRa radio in the sub-gigahertz ISM bands. It lets groups communicate off-grid without cellular or internet service. The speaker, a longtime security practitioner, found little published security research when the tool spread quickly, so he framed the main risks around physical access, privacy leaks and key management.

On physical access, the small nodes are easy to conceal, and rooftop or grain-silo installations are reachable with basic tools. Defenders can watch for unexpected traffic in the 915 MHz band. Privacy concerns center on GPS position beaconing and route tracking, and one CVE published earlier in the year was cited. For keys, the default primary channel uses weak 8-bit encryption, shared channel keys are passed around by hand without rotation, device randomness is questioned, and remote administration can be enabled by anyone holding the key. The talk then showed a proof of concept built with a community member: a planted radio relayed commands to a Windows machine, which opened applications and typed text.

Recommendations included rotating shared keys, using GPS only when needed, monitoring for rogue nodes with wireless intrusion detection, keeping firmware patched, and blocking unauthorized USB devices. The speaker closed by asking the community to contribute code, review firmware and raise awareness of the risks.