LoRaWAN & Sub-GHz Attacks

LoRaWAN 与 Sub-GHz 攻击

LoRaWAN provides long-range low-bitrate communication for IoT — common in smart cities, asset tracking, and industrial telemetry. Outside LoRaWAN, the 433 / 868 / 915 MHz ISM bands host garage doors, doorbells, smart plugs, weather stations, and TPMS — most with weak or no crypto.

LoRaWAN 为 IoT 提供远距离、低比特率通信——常见于智慧城市、资产追踪和工业遥测。在 LoRaWAN 之外，433 / 868 / 915 MHz ISM 频段承载着车库门、门铃、智能插座、气象站和 TPMS——大多数设备都采用薄弱或完全没有加密机制。

Quick Workflow

快速工作流

Identify the band + modulation (LoRa CSS vs. simple OOK/FSK)
Capture transmissions with appropriate hardware (HackRF / RTL-SDR / Flipper Zero)
For LoRaWAN: capture join + uplinks; analyze key derivation
For proprietary sub-GHz: demodulate, identify packet format, replay or craft

识别频段 + 调制方式（LoRa CSS 与简单 OOK/FSK）
使用合适的硬件捕获传输（HackRF / RTL-SDR / Flipper Zero）
对于 LoRaWAN：捕获 join + uplink；分析密钥派生
对于专有 sub-GHz：解调、识别数据包格式、重放或构造

Hardware

硬件

Tool	Range	Use
RTL-SDR	RX only, 24 MHz–1.7 GHz	Cheap reconnaissance
HackRF One	RX/TX, 1 MHz–6 GHz	Full transceiver
Flipper Zero	RX/TX, sub-GHz	Quick replays, fixed-code attacks
LimeSDR / BladeRF	RX/TX, wider band	Higher fidelity for LoRaWAN
YARD Stick One	TX-focused sub-GHz	Targeted replays
LoRa-specific gateway (RAK / Heltec)	LoRaWAN dual-direction	Standards-compliant LoRaWAN testing

工具	频率范围	用途
RTL-SDR	仅 RX，24 MHz–1.7 GHz	低成本侦察
HackRF One	RX/TX，1 MHz–6 GHz	全功能收发器
Flipper Zero	RX/TX，sub-GHz	快速重放、固定码攻击
LimeSDR / BladeRF	RX/TX，更宽频段	针对 LoRaWAN 的更高保真度
YARD Stick One	以 TX 为主的 sub-GHz	定向重放
LoRa 专用网关（RAK / Heltec）	LoRaWAN 双向	符合标准的 LoRaWAN 测试

LoRaWAN

LoRaWAN is a MAC layer over LoRa physical (chirp spread spectrum). Devices either:

OTAA (Over-the-Air Activation) — derive session keys at join
ABP (Activation By Personalization) — pre-flashed keys

LoRaWAN 是构建在 LoRa 物理层（chirp spread spectrum）之上的 MAC 层。设备有两种类型：

OTAA（Over-the-Air Activation）——在 join 时派生会话密钥
ABP（Activation By Personalization）——预烧录密钥

OTAA Join Capture

OTAA Join 捕获

bash

undefined

bash

undefined

Capture LoRa packets with HackRF + Inspectrum

hackrf_transfer -r capture.iq -f 868000000 -s 1000000 -n 60000000

Or LoRa-specific: rak_common_for_gateway

Decode with PHY + MAC stack

git clone https://github.com/Lora-net/LoRaMac-node

Or use ChirpStack as a sniffing gateway


The Join-Request and Join-Accept are encrypted with the device's AppKey. With AppKey (extracted from device firmware — see `offensive-iot`):

- Decrypt Join-Accept → recover NwkSKey, AppSKey
- Subsequent traffic decryption + injection


Join-Request 和 Join-Accept 使用设备的 AppKey 加密。获取 AppKey（从设备固件中提取——参见 `offensive-iot`）后：
- 解密 Join-Accept → 恢复 NwkSKey、AppSKey
- 解密后续流量 + 注入

ABP — Pre-Flashed Keys

ABP——预烧录密钥

ABP devices have NwkSKey + AppSKey flashed at manufacture. Common flaws:

Same key across thousands of devices (vendor laziness)
No frame counter rollover protection → replay any historical uplink
DevAddr predictability (sequential allocation)

bash

undefined

ABP 设备在制造时烧录 NwkSKey + AppSKey。常见缺陷：

数千台设备使用相同密钥（厂商偷懒）
没有帧计数器回绕保护 → 可重放任意历史 uplink
DevAddr 可预测（顺序分配）

bash

undefined

If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools

git clone https://github.com/IoTsec/loraserver-attack-tools python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR>

undefined

git clone https://github.com/IoTsec/loraserver-attack-tools python lora_inject.py --nwkskey <NWKS> --appskey <APPS> --devaddr <ADDR>

undefined

Frame Counter Replay

帧计数器重放

Older LoRaWAN 1.0.x doesn't enforce strict frame counter monotonicity in all stacks. Replay an uplink with a different timestamp → server processes as fresh.

旧版 LoRaWAN 1.0.x 并不会在所有协议栈中严格强制执行帧计数器单调性。使用不同的时间戳重放一个 uplink → 服务器会将其作为新数据处理。

Downlink Injection

下行注入

If you control AppSKey + NwkSKey, you can inject downlinks (configuration changes, remote commands) to devices.

如果你控制 AppSKey + NwkSKey，就能向设备注入 downlink（配置变更、远程命令）。

Sub-GHz Proprietary Protocols

Sub-GHz 专有协议

Quick Capture + Replay (Flipper Zero / HackRF)

快速捕获 + 重放（Flipper Zero / HackRF）

bash

undefined

bash

undefined

RTL-SDR live monitor

rtl_433 -f 433.92M -A # auto-decode many devices gqrx # interactive spectrum analyzer

Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save

Then replay from the saved file

HackRF capture

hackrf_transfer -r garage.iq -f 433920000 -s 8000000 -n 80000000

Inspectrum to visualize, identify OOK / FSK, decode bits

undefined

undefined

KeeLoq (Old Garage Doors, Some Cars)

KeeLoq（旧式车库门、部分汽车）

KeeLoq uses a 32-bit block cipher with a manufacturer key. The manufacturer key was extracted publicly years ago for major brands. With it:

Decrypt rolling code → predict next valid code
Combined with capture-replay, take over the remote

bash

undefined

KeeLoq 使用带有制造商密钥的 32 位分组密码。多年前，主流品牌的制造商密钥已被公开提取。有了该密钥：

解密滚动码 → 预测下一个有效码
结合捕获-重放，接管遥控器

bash

undefined

rolling-code-tools (research)

git clone https://github.com/AndrewMohawk/RollingPwn


Modern KeeLoq deployments (last 5 years) have rotated manufacturer keys, but legacy hardware (older garage doors, some industrial equipment) is in scope.

git clone https://github.com/AndrewMohawk/RollingPwn


现代 KeeLoq 部署（最近 5 年）已经轮换制造商密钥，但旧版硬件（老旧车库门、部分工业设备）仍在此范围内。

Fixed-Code Remotes

固定码遥控器

Many cheap garage openers, doorbells, and smart plugs use fixed codes — the same packet every time you press the button. Capture once, replay forever.

bash

undefined

许多廉价的车库门控制器、门铃和智能插座使用固定码——每次按下按钮都会发送相同的数据包。捕获一次，即可永久重放。

bash

undefined

Flipper Zero: Read → Save → Send (from saved file)

Or with RFCat:

python -c "import rflib; ..."

OR with HackRF:

hackrf_transfer -t replay.iq -f 433920000 -s 8000000

undefined

hackrf_transfer -t replay.iq -f 433920000 -s 8000000

undefined

TPMS Spoofing

TPMS 欺骗

Tire-pressure monitoring sensors broadcast at 315/433 MHz with no authentication. Spoof low-pressure alerts:

bash

undefined

胎压监测传感器在 315/433 MHz 广播，且不进行身份验证。可以伪造低胎压告警：

bash

undefined

Capture legitimate TPMS

rtl_433 -f 315M -F json | grep TPMS

Synthesize crafted alerts (custom modulator with HackRF)

Useful for testing TPMS-aware vehicle systems or as denial-of-trust attack

undefined

undefined

Reconstruction of Unknown Protocols

未知协议重建

bash

undefined

bash

undefined

Universal Radio Hacker (URH) — visual reverse engineering

urh

Load .iq capture, identify modulation visually,

auto-detect symbols, decode bits, identify packet structure


URH walks you from raw RF to a parsed protocol description, even with no docs.


即使没有任何文档，URH 也能引导你从原始 RF 信号一路分析到已解析的协议描述。

Engagement Cheatsheet

实操速查表

bash

undefined

bash

undefined

1. Identify band + modulation

rtl_433 -f <freq> -A # auto-detect known protocols gqrx # spectrum view to find activity

2. For LoRaWAN

- Set up gateway (or HackRF + LoRa decoding)

- Capture joins + uplinks

- Extract keys from device firmware (see offensive-iot)

3. For proprietary sub-GHz

- Capture with HackRF / RTL-SDR

- Visualize / decode with Inspectrum or URH

- Replay or craft

4. Document modulation, frequency, packet format, replay viability

undefined

undefined

Detection

检测

LoRaWAN networks have server-side anomaly detection (frame counter, signal strength, geographic) — varies widely by operator
Sub-GHz consumer products typically have no monitoring
TPMS / industrial equipment has minimal telemetry on RF anomalies

LoRaWAN 网络具备服务器端异常检测能力（帧计数器、信号强度、地理位置）——因运营商而异
Sub-GHz 消费类产品通常没有任何监控机制
TPMS / 工业设备针对 RF 异常的遥测极少

Reporting

报告

Identify exact frequency, modulation, baud, and packet format per device
Distinguish capture-replay vs. crafted-frame attacks
Note crypto state (cleartext / weak-fixed-key / standards-compliant)
For LoRaWAN: identify AppKey / NwkSKey / AppSKey storage in firmware

精确记录每台设备的频率、调制方式、波特率和数据包格式
区分捕获-重放攻击与构造帧攻击
注明加密状态（明文 / 弱固定密钥 / 符合标准）
对于 LoRaWAN：确定 AppKey / NwkSKey / AppSKey 在固件中的存储方式

Key References

关键参考

rtl_433 protocol database: github.com/merbanan/rtl_433
Universal Radio Hacker: github.com/jopohl/urh
RollingPwn (KeeLoq research): github.com/AndrewMohawk/RollingPwn
LoRaWAN Specification: lora-alliance.org
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

rtl_433 协议数据库：github.com/merbanan/rtl_433
Universal Radio Hacker：github.com/jopohl/urh
RollingPwn（KeeLoq 研究）：github.com/AndrewMohawk/RollingPwn
LoRaWAN Specification：lora-alliance.org
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-lorawan-sub-ghz

Original

Translation

LoRaWAN & Sub-GHz Attacks

LoRaWAN 与 Sub-GHz 攻击

Quick Workflow

快速工作流

Hardware

硬件

LoRaWAN

LoRaWAN

OTAA Join Capture

OTAA Join 捕获

Capture LoRa packets with HackRF + Inspectrum

Capture LoRa packets with HackRF + Inspectrum

Or LoRa-specific: rak_common_for_gateway

Or LoRa-specific: rak_common_for_gateway

Decode with PHY + MAC stack

Decode with PHY + MAC stack

Or use ChirpStack as a sniffing gateway

Or use ChirpStack as a sniffing gateway

ABP — Pre-Flashed Keys

ABP——预烧录密钥

If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools

If you have NwkSKey + AppSKey + DevAddr, decode/inject with lorawan-test-tools

Frame Counter Replay

帧计数器重放

Downlink Injection

下行注入

Sub-GHz Proprietary Protocols

Sub-GHz 专有协议

Quick Capture + Replay (Flipper Zero / HackRF)

快速捕获 + 重放（Flipper Zero / HackRF）

RTL-SDR live monitor

RTL-SDR live monitor

Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save

Flipper Zero Sub-GHz menu: Read → identify modulation → capture → save

Then replay from the saved file

Then replay from the saved file

HackRF capture

HackRF capture

Inspectrum to visualize, identify OOK / FSK, decode bits

Inspectrum to visualize, identify OOK / FSK, decode bits

KeeLoq (Old Garage Doors, Some Cars)

KeeLoq（旧式车库门、部分汽车）

rolling-code-tools (research)

rolling-code-tools (research)

Fixed-Code Remotes

固定码遥控器

Flipper Zero: Read → Save → Send (from saved file)

Flipper Zero: Read → Save → Send (from saved file)

Or with RFCat:

Or with RFCat:

OR with HackRF:

OR with HackRF:

TPMS Spoofing

TPMS 欺骗

Capture legitimate TPMS

Capture legitimate TPMS

Synthesize crafted alerts (custom modulator with HackRF)

Synthesize crafted alerts (custom modulator with HackRF)

Useful for testing TPMS-aware vehicle systems or as denial-of-trust attack

Useful for testing TPMS-aware vehicle systems or as denial-of-trust attack

Reconstruction of Unknown Protocols

未知协议重建

Universal Radio Hacker (URH) — visual reverse engineering

Universal Radio Hacker (URH) — visual reverse engineering

Load .iq capture, identify modulation visually,

Load .iq capture, identify modulation visually,

auto-detect symbols, decode bits, identify packet structure

auto-detect symbols, decode bits, identify packet structure

Engagement Cheatsheet

实操速查表

1. Identify band + modulation

1. Identify band + modulation

2. For LoRaWAN

2. For LoRaWAN

- Set up gateway (or HackRF + LoRa decoding)

- Set up gateway (or HackRF + LoRa decoding)

- Capture joins + uplinks