Presentation by Wesley Wineberg at B-Sides Vancouver 2015. It includes an analysis of EMU-2, introduction to hardware security and the ZigBee Smart Energy device.

1. Wesley Wineberg
B-Sides Vancouver 2015

5. 



6. 



7. 



8. 



12. 




14. 




15. 





16. 


• PORT NAME: determined by OS
• BAUD RATE: 115,200
• DATA BITS: 8
• STOP BITS: 1

17. 
<Command>
<Name>get_device_info</Name>
</Command>

18. 
<DeviceInfo>
<DeviceMacId>0xFFFFFFFFFFFFFFFF</DeviceMacId>
<InstallCode>0xFFFFFFFFFFFFFFFF</InstallCode>
<LinkKey>0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF</LinkKey>
<FWVersion>{string}</FWVersion>
…
</DeviceInfo>

19. 

20. <NickName>test</NickName>
<Command>
<Name>set_meter_info</Name>
<NickName>testtesttesttesttesttesttesttesttesttesttesttestt
esttesttesttesttesttest</NickName>
</Command>

21. <MeterInfo>
<DeviceMacId>0xd8d5b90000001e74</DeviceMacId>
<MeterMacId>0x00078100008dc8e6</MeterMacId>
<Nickname>testtesttesttesttesttesttesttesttesttesttesttes
ttesttesttesttesttesttest</Nickname>
<Account>sttesttesttesttesttest</Account>
<Auth></Auth>
</MeterInfo>

22. 



23. 


/debug /trace

24. 

25. 


26. 



27. 






28. 





29. stringBuilder.AppendLine("<command>");
stringBuilder.AppendLine("<name>image_block_dump</name>");
stringBuilder.AppendLine("<offset>0x" + offset.ToString("X8") +
"</offset>");
stringBuilder.AppendLine("<blksize>0x" + blksize.ToString("X2") +
"</blksize>");
stringBuilder.AppendLine("</command>");

30. 





31. 



32. 



34. 





35. 




36. 




38. 





39. 


40. 



41. 


47. 






53. 




56. 




57. 



 echo -e $(cut -d',' -f4 spi.txt | sed -e 's/0x(..).?/x1/g' | tr -d 'n')

58. 


59. 



60. 



61. 





62. 


63. JN5142 and JN5148-J01/Z01 Flash Header
Bytes Word Contents
0x0000 to 0x000F 0 - 3 16-byte Boot Image Record
0x0010 to 0x0017 4 - 5 64-bit MAC address
0x0018 to 0x0027 6 - 9 Encryption Initialisation Vector (ignored if unencrypted)
0x0028 to 0x0029 10 16-bit load address for .text segment in RAM (word aligned)
0x002A to 0x002B 10 16-bit length of .text segment, in 32-bit words
0x002C to 0x002D 11 16-bit load address for .bss segment in RAM (word aligned)
0x002E to 0x002F 11 16-bit length of .bss segment in RAM, in 32-bit words
0x0030 to 0x0033 12 32-bit wake-up entry point (word aligned) – warm start
0x0034 to 0x0037 13 32-bit reset entry point (word aligned) – cold start
0x0038 to (MemA –1) 14 - .text segment
MemA to (MemB-1) .data segment
MemB Overlay segment

64. 

 

65. 



66. 





67. 



68. 

69. 



70. 



71. 


72. 



73. 
get_meter_attributes
set_meter_attributes
erase_halt
secret


74. 





75. 






76. 



77. 






78. 





79. 



80. 





81. 





83. 





84.  Send Beacon Request, and look for a device that has the 'join'
flag enabled in its beacon.
 After joining the network, wait for the Coordinator to send the
network key encrypted with our link key (derived from the install
code).
 Look for the Key Establishment Cluster using match descriptor.
 Perform Key Exchange.
 If successful, look for the time cluster…

86. 




87. 




88. Source Address (8 bytes) +
Frame Counter (4 bytes) +
Security Control (1 byte)

89. 




90. 




91. 




92. 



93. 
https://bitbucket.org/secdev/scapy-com




95. 



97. 



101. 



102. 





103. 




104. 

