2018: Attacking industrial Wireless Mesh Networks by E. Paternotte And M. v Ommeren

### Overview In this talk, Aaron (E. Paternotte) and Matthias (M. van Ommeren) investigate the security of industrial wireless sensor networks, specifically focusing on WirelessHART (released in 2007) and ISA100.11a (released in 2009). Used widely in critical environments like oil fields, refineries, and chemical plants, these systems traditionally measured process parameters (e.g., flow rate, liquid level, pressure) within industrial control loops. While previous research identified theoretical vulnerabilities or relied on expensive, non-injecting hardware, practical tooling has remained virtually nonexistent. The speakers present low-cost, open tooling built on commercial off-the-shelf microcontrollers to inspect, synchronize with, and attack these time-synchronized channel-hopping mesh networks.

### Key Topics - **Industrial Wireless Mesh Protocols:** Comparison of WirelessHART and ISA100.11a. Both share underlying IEEE 802.15.4 physical and MAC properties and use Time Synchronized Mesh Protocol (TSMP) concepts with channel hopping (hopping up to 100 times per second across channels). ISA100 relies on 6LoWPAN/IPv6/UDP and International Atomic Time (TAI) timestamps, whereas WirelessHART uses sequence-numbered slots and the legacy HART application layer. - **Cryptographic Management & Weaknesses:** Examination of AES encryption across data link (integrity) and transport (confidentiality) layers. Keys include well-known advertisement keys, network keys, join keys, and session keys. The presenters highlight vulnerabilities such as predictable or hardcoded factory join keys (e.g., Dust Networks default keys, 4-byte weak keys on Emerson devices, or vendor names in ASCII/hex), weak over-the-air provisioning, and exposed debugging interfaces on radio SoCs enabling complete firmware and key extraction from decommissioned hardware. - **Tooling and Hardware Implementation:** Evaluating hardware platforms including multi-radio OmniSpot/BeamLogic analyzers, Atmel RZ Raven sticks, and NXP development kits. The speakers settled on an active, affordable NXP board (~$50–$60), developing custom firmware integrated into the KillerBee framework along with Scapy and Wireshark dissectors.

### Technical Details - **Channel Hopping Synchronization:** Because networks hop 100 times per second across 10 ms timeslots within repeating superframe structures (e.g., 512 slots), standard host-to-USB serial control was too slow. The hopping logic had to be executed on the bare-metal microcontroller. - **Embedded Scheduling Workarounds:** Attempts to use FreeRTOS software timers failed due to timing jitter and serial starvation. The authors instead leveraged NXP's bare-metal scheduler, keeping tasks strictly under 2 milliseconds. Rather than hopping every single 10 ms slot, the firmware calculates the timing of the next designated slot of interest (such as join slots or advertisement slots) from superframe sequence math, jumping precisely when needed. - **Demonstrated Attacks:** Even without network keys, attackers listening to advertisements signed with well-known keys can target specific communication slots: - **Targeted Jamming:** Selectively jamming advertisement slots desynchronizes transmitters until they lose connectivity, blinding the control room and potentially triggering emergency plant shutdowns. - **Join-Slot Denial of Service:** Jamming join slots prevents new devices from joining or rejoining. - **Rogue Advertisements / Evil Twin:** Transmitting spoofed advertisements using well-known keys to entice transmitters into connecting to a rogue attacker gateway. - **Key-Possession Attacks:** With dumped or recovered keys, attackers can inject rogue process values, spoof sensor data, or manipulate counter values to cause legitimate sensor packets to be dropped.

### Takeaways The lack of offensive and auditing tools previously masked the attack surface of industrial wireless mesh protocols. As industry operators consider expanding wireless networks from passive monitoring to active closed-loop control, the attack surface presents severe operational risks. The speakers announce the open-source release of their KillerBee driver, Wireshark dissectors, and firmware to spur community research, wireless fuzzing, and vendor remediation.