Hacking and auditing LoRaWAN networks
iSpeech
Hacking and auditing LoRaWAN networks - Cesar Cerrudo, Esteban Martinez Fayo and Matías Sequeira
IoT deployments just keep growing and one part of that significant grow is composed of millions of LPWAN (low-power wide-area network) sensors deployed at hundreds of cities (Smart Cities) around the world, also at industries and homes. One of the most used LPWAN technologies is LoRa for which LoRaWAN is the network standard (MAC layer). LoRaWAN is a secure protocol with built in encryption but implementation issues and weaknesses affect the security of most current deployments.
While there is already prior research on LoRaWAN security most of them focus on known protocol weakness and theory, none of them provides tools neither examples of common security problems of real deployments.
Currently, there are not guidelines neither tools to test the security of LoRaWAN networks, if someone wants to audit a LoRaWan network she has to start from scratch. Over the last year, we have been researching LoRaWAN to identify common security problems and building tools to test LoRaWAN networks security.
In this talk, we are going to describe the common security problems we found on LoRaWAN deployments. Also, we are going to provide step by step guidelines on how and what to test on LoRaWan networks indicating what hardware and software to use, also we will be releasing new tools to test the security of LoRaWan networks. Finally, we are going to provide recommendations for secure LoRaWan deployments.
About Cesar Cerrudo
Professional hacker, cyber security futurist and entrepreneur. Chief Technology Officer for IOActive Labs, where he leads the team in producing ongoing, cutting-edge research in areas including Industrial Control Systems/SCADA, Smart Cities, the Internet of Things, Robots, Blockchain, Cryptocurrencies, and software and mobile device security. Cesar is a world-renowned cyber security researcher with more than 15 years of experience.
Throughout his career, Cesar is credited with discovering and helping to eliminate dozens of vulnerabilities in leading applications including Microsoft SQL Server, Oracle database server, IBM DB2, Microsoft Windows, Yahoo! Messenger, and Twitter, to name a few. He has a record of finding more than 50 vulnerabilities in Microsoft products including 20 in Microsoft Windows operating systems. Based on his unique research, Cesar has authored white papers about cyber security problems, attacks and exploitation techniques in different widely used technology. He has presented at a variety of company events and conferences around the world including Microsoft, Intel, Black Hat, Bellua, CanSecWest, EuSecWest, WebSec, HITB, Microsoft BlueHat, EkoParty, FRHACK, H2HC, Infiltrate, 8.8, Hackito Ergo Sum, NcN, Segurinfo, RSA, and DEF CON.
He started Securing Smart Cities ( a non profit initiative to make cities around the world safer, after he found that most Smart City technologies are vulnerable to cyber attacks.
Cesar collaborates with and is regularly quoted in print and online publications. His research has been covered by Wired, Bloomberg Businessweek, TIME, The Guardian, CNN, NBC, BBC, Fox News, The New York Times, New Scientist, Washington Post, Financial Times, The Wall Street Journal, and so on.
Trying hard to make the world a more secure place.
Sobre Esteban Martinez Fayo
Security researcher with more than 15 years of experience; he has discovered and helped to fix multiple security vulnerabilities in key enterprise software from major vendors like Oracle, Microsoft and IBM. As part of his research, he has developed and presented novel database attack techniques at international conferences such as Black Hat, DEFCON, EkoParty, WebSec and NcN. Throughout his career, Esteban has performed dozens of penetration tests and provided security advice for companies across a variety of industries.
Sobre Matías Sequeira
Matías started his career in cyber security field as an information security consultant where he worked for clients from the financial and medical software field. Later, he started to research about ransomware and defense measures against it, as part of the AntiRansomware Team. Currently, his research interests focus on IoT security.
#eko15 (2019)
source
Gloss