Abstract
Smart meters are typically equipped with a ZigBee wireless interface. ZigBee enables a customer to connect intelligent displays (called In-Home Displays, or IHD) wirelessly to the smart meter to receive real-time energy consumption data. ZigBee gives customers ways to save energy by connecting a washing machine or a fridge to the utility's current electricity price feed and adjust their time of use automatically. Although currently all smart meters have the wireless interface disabled, the utilities are starting to enable it for pilot users. However, this new wireless functionality comes with security risks. This project is about the analysis of security and privacy issues of ZigBee implementations. This involved a number of steps. First, ZigBee device firmware was modified so that well-known attack frameworks such as KillerBee and Scapy could be used to do security testing of other ZigBee devices. Second, Scapy, which is a packet manipulation program, was improved to support more ZigBee packets. This allows the use of the Python programming language for fast creation of standard compliant frames and an easy parsing of received frames. This work will help future attack frameworks to build on this existing Scapy system. Major contributions of this project are an improved implementation of the 802.15.4/ZigBee layer in Scapy, a command-line tool to generate Matyas-Meyer-Oseas (MMO) hashes (converts installation codes to preconfigured link keys), and a security analysis of a closed ZigBee network.