Thwarting attacks on ZigBee - Removal of the KillerBee stinger

Abstract

Wireless Sensor Networks (WSNs) have recently emerged as an important research topic. Due to the enormous number of sensor nodes and the constrained resources, specific research challenges can be identified with respect to security. Almost all available commercial and research sensor nodes are equipped with ZigBee transceiver chips, and thus making ZigBee the de-facto standard in WSN communication. Since Joshua Wright's KillerBee Framework was released with its focus on exploring and exploiting the security of ZigBee networks, non security-hardened WSNs increase the risk of being vulnerable against certain attacks such as simple association flooding and packet replay attacks. We propose an anomaly-based approach intrusion detection system (IDS) optimized for ZigBee-based WSN to protect ZigBee-based WSN nodes against KillerBee supported attacks. We describe the KillerBee attack procedure and propose an approach of guarding a ZigBee transceiver. Based on an extended sensor node/network simulation and analysis framework, we demonstrate furthermore how our anomaly-based detection engine can thwart attacks on a ZigBee transceiver.

Exploring security in ZigBee networks

“…Additionally, ZigBee provides minimal replay protection, a 4-octet frame counter, so using zbreplay can be extremely effective attacking strategy. In [8] the authors provide a proof of concept for using an anomaly-based detection system in order to prevent association and replay flooding on a network. They claim that an anomaly-based intrusion detection system is more feasible than a pattern-based system because it uses fewer resources, which are scarce on ZigBee devices.…”

Security And Privacy Issues in Healthcare Monitoring Systems: A Case Study

“…ZigBee. ZigBee is widely used in pervasive computing due to its low bandwidth, low cost, and low power consumption (Stelte and Rodosek, 2013). Our vulnerability analysis is based on KillerBee 2 , in particular on its zbtumbler tool, which detects active ZigBee networks, records and display information about the found devices.…”

“…zbreplay lounges a replay attack, which is countered in (Stelte and Rodosek, 2013). Another MITM attack is explained in (Choi et al, 2013) and exploits a vulnerability in the key distribution.…”

“…This floods the coordinator node, creating denial of service from the coordinator note, which is the sink of the sensor network. A counter measure for this problem has been proposed in (Stelte and Rodosek, 2013), by filtering the incoming traffic.…”

Remotely Exploiting AT Command Attacks on ZigBee Networks

“…Such retrieval requires the attacker to be located in proximity of the network nodes, in order to sniff the key exchange. Killerbee also includes other threats such as replay [19] or manipulation/injection [20].…”