Api-do: Tools for exploring the wireless attack surface in smart meters

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2012, Pages 2133-2140

  Goodspeed, Travis ^a   Bratus, Sergey ^b   Melgares, Ricky ^b   Speers, Ryan ^b   Smith, Sean W ^b  

^a UNIVERSITY OF PENNSYLVANIA   (United States)

^b DARTMOUTH COLLEGE   (United States)

Author keywords

802.15.4; Attack surface exploration; ZigBee

Indexed keywords

DIGITAL RADIO; SMART METERS; ZIGBEE;

802.15.4; EXPLORATION PHASE; HARDWARE AND SOFTWARE; RADIO PLATFORMS; STATE OF THE ART; SURFACE EXPLORATION; WIRELESS INTERFACES; WIRELESS NETWORKING;

NETWORK SECURITY;

EID: 84863269702     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2012.115     Document Type: Conference Paper

References (37)

1. Aircrack-ng. http://www.aircrack-ng.org/.
2. Airbase-ng. http://www.aircrack-ng.org.
3. Airpwn. http://airpwn.sourceforge.net/Airpwn.html.
4. Esri. "ArcGIS." http://www.esri.com/software/arcgis/.
5. Chaudhary, R. (2010, November 17). In-State: Smart Energy to Fuel 802.15.4 and ZigBee Adoption. Smartgrid TMCNET.
6. Choong, Leslie, "Multi-Channel IEEE 802.15.4 Packet Capture Using Software Defined Radio," UCLA, 2009.
7. Daintree Networks. "Getting Started with ZigBee and IEEE 802.15.4." www.daintree.net/downloads/whitepapers/zigbee-primer.pdf. 2008.
8. The Edison Foundation Institue for Electric Efficiency, "Utility-Scale Smart Meter Deployments, Plans and Proposals - February 2010." http://www.edisonfoundation.net/iee/issuebriefs/IEE- SmartMeterRollouts update.pdf.
9. Ettus Research. "USRP2." http://www.ettus.com.
10. Ellch, Jon. "Per-Packet Information specification for Geolocation." Version 1.2.0. Crucial Security, Inc., March 2011. http://new.11mercenary.net/-johnycsh/ppi-geolocation-spec/.
11. Finisterre, Kevin. "Successful Zigbee Wardrive Rig is Online!" Joint Direct Attack Munition Smart Weaponry Blog. http://www.digitalmunition. com//Blog/Entries/2010/10/13 Successful-Zigbee Wardrives!.html. October 2010.
12. Open Source Geospatial Foundation. "Geospatial Data Abstract:ion Library." http://www.gdal.org.
13. Goodspeed, T.; Bratus, S.; Melgares, R; Speers, R.; Shapiro, R. Packets in Packets: Orson Welles In-Band Signaling Attacks for Modern Radios. 20th USENIX WOOT. 2011.
14. Goodspeed, Travis. "Extracting Keys from SoC Zigbee Chips." http://travisgoodspeed.blogspot.com/2009/08/extracting-keys-from-soc-zigbee- chips.html.
15. Goodspeed, Travis. "Breaking 802.15.4 AES128 by Syringe." http://travisgoodspeed.blogspot.com/2009/03/breaking-802154-aes128-by-syringe. html.
16. Goodspeed, Travis. "GoodFET Project." http://goodfet. sourceforge.net.
17. Goodspeed, Travis. "Promiscuity is NRF24L01's Duty." http://travisgoodspeed.blogspot.com/2011/02/promiscuity-is-nrf24l01s-duty.html.
18. "gpsd." http://gpsd.berlios.de.
19. Itron. "Itron Selected by CenterPoint Energy as AMI Technology Provider: Agreement Outlines Phased Deployment for OpenWay Meters in Houston." Press release (May 14, 2008). http://www.itron.com/pages/news press individual.asp?id=itr 016460.xml.
20. IEEE Computer Society, LAN/MAN Standards Committee. "Part 15.4: Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications for Low Rate Wireless Personal Area Networks (LR-WPANs)." IEEE 802.15.4-2006, New York, NY, 2006. http://standards.ieee.org/getieee802/download/802.15.4-2006. pdf.
21. IEEE Computer Society, LAN/MAN Standards Committee. "Part 15.4: Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications for Low Rate Wireless Personal Area Networks (LR-WPANs), Amendment 1: Add Alternate PHYs." IEEE 802.15.4a-2007, New York, NY, August 2007. http://standards.ieee.org/getieee802/download/802.15.4a-2007.pdf.
22. "Karma" http://www.theta44.org/karma/.
23. "Kismet." http://www.kismetwireless.net/.
24. Konings, B., Schaub, F., Kargl, F., Dietzel, S. "Channel switch and quiet attack: New DoS attacks exploiting the 802.11 standard." Proceedings of the IEEE 34th Conference on Local Computer Networks, LCN (2009)
25. KoreK. "chopchop." http://www.aircrack-ng.org/doku.php?id=korek chopchop.
26. Melgares, Ricky A. "802.15.4/ZigBee Analysis and Security: tools for practical exploration of the attack surface." Dartmouth Computer Science Technical Report TR2011-689, June 2011.
27. Northcutt, Stephen. "Network Intrusion Detection: An Analyst's Handbook." Sams, June 1999.
28. Ptacek, Thomas and Newsham, Timothy. "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection." Secure Networks, Inc., January, 1998. http://insecure.org/stf/secnet ids/secnet ids.html.
29. Speers, Ryan M. "IEEE 802.15.4 Wireless Security: Self-Assessment Frameworks." Dartmouth Computer Science Technical Report TR2011-687, June 2011.
30. Speers, Ryan and Ricky Melgares. "Api-do: Tools for Zig-Bee and 802.15.4 Security Auditing." http://code.google.com/p/zigbee-security/.
31. Schiffman, Mike. "Building Open Source Network Security Tools: Components and Techniques." Wiley, October 2002.
32. Texas Instruments. "CC2420: 2.4 GHz IEEE 802.15.4 /ZigBee-ready RF Transceiver." SWRS041B, Dallas, TX, 2010.
33. Vladimirov, Andrew, Gravrilenko, Konstantin, and Mikhailovskiy, Andrei. "Wi-Foo: The Secrets of Wireless Hacking," page 174. Pearson Education, 2004.
34. Matthias Wilhelm, Ivan Martinovic, Jens B. Schmitt, and Vincent Lenders. "Short Paper: Reactive Jamming in Wireless Networks How Realistic is the Threat?." ACM WiSec '11. http://www.lenders.ch/publications/conferences/ wisec11.pdf.
35. Wood, Anthony D. and J.A. Stankovic. "Denial of Service in Sensor Networks." Prentice-Hall, Inc, 2002. http://citeseerx.ist.psu.edu/viewdoc/ summary?doi=10.1.1.20.6380.
36. Wright, Joshua. "KillerBee: Framework and tools for exploiting ZigBee and IEEE 802.15.4 networks." Version 1.0, 2010. https://code.google. com/p/killerbee/.
37. ZigBee Alliance. "ZigBee Specification." ZigBee Document 053474r17, January 2008.