Zigbee & Z-Wave Protocol-Exploitation Framework · Hacking Project

Demonstrate key capture and command injection/replay across both Zigbee and Z-Wave on a controlled mesh and score the network's security posture.

**The problem**
Smart-home and building-automation ecosystems run on low-power mesh protocols — Zigbee (IEEE 802.15.4) and Z-Wave — whose security historically depended on weak key provisioning, insecure "install-code"/default-key pairing, and legacy S0 frames vulnerable to key sniffing during join. Attackers within RF range can intercept join keys, inject or replay commands, or force devices off the network, yet defenders rarely have tooling to test these mesh protocols. As these networks control locks, sensors, and HVAC, the exposure is physical-world and under-assessed.

**What you'll build**
Build a unified exploitation-and-assessment framework that sniffs and decodes Zigbee and Z-Wave traffic, captures keys during the pairing/join handshake, and demonstrates command injection, replay, and denial-of-service against a controlled test network. Consolidate and extend existing tooling (KillerBee, Z-Wave/Scapy-radio, zigbee2mqtt for context) behind a common CLI, add security-posture scoring (S0 vs S2, default-key detection, rejoin exposure), and produce hardening guidance mapped to secure-pairing best practices.

**Objective** — Demonstrate key capture and command injection/replay across both Zigbee and Z-Wave on a controlled mesh and score the network's security posture.

**Expected outcome** — A dual-protocol exploitation/assessment framework with sniffing, key-capture, injection, and DoS modules, plus a posture-scoring report and hardening recommendations (S2, secure join, key rotation).

**Difficulty** — Expert — spans two RF stacks, 802.15.4 internals, key-management analysis, custom radio tooling, and dual offensive/defensive engineering.

**Primary category** — Wireless/IoT Security; Secondary = Penetration Testing, Protocol Reverse Engineering, Cryptographic Analysis

**Security domains** — Primary = Red Team; Secondary = Security Research, Blue Team (mesh monitoring), IoT Security, Threat Intelligence

**Technical focus** — IEEE 802.15.4/Zigbee stack analysis, Z-Wave RF analysis, packet sniffing/decoding, key capture during join, command injection, replay attacks, RF DoS/jamming analysis, S0 vs S2 security assessment, mesh network mapping, secure-pairing evaluation

**Core technologies** — Languages: Python, C; Frameworks/Libraries: KillerBee, Scapy / scapy-radio, Zigbee/802.15.4 dissectors, python-openzwave, zigpy, EZ-Wave tooling; Security Tools: ApiMote/Atmel RZUSBstick, CC2531/CC2652 sniffer, HackRF/RTL-SDR (Z-Wave sub-GHz), Wireshark with 802.15.4 dissectors, Ubiqua; Cloud/Infra: local mesh test bench (controlled hub + sensors), shielded lab; AI/Data: traffic-classification datasets, anomaly baselines; Databases: SQLite/Elasticsearch for captured frames and device inventory

**Where it's valued** — Smart-home and building-automation vendors, physical-security (smart locks/sensors), commercial real estate/PropTech, healthcare facilities, IoT security consultancies, red-team services

**Careers it builds toward** — IoT/Wireless Security Researcher, Red Team IoT Specialist, Product Security Engineer (connectivity), Penetration Tester (smart building), Protocol Security Analyst

**Framework alignment**
• MITRE ATT&CK: Network Sniffing (T1040), Adversary-in-the-Middle (T1557), Endpoint/Network Denial of Service (T1499/T1498) at the mesh layer, Hardware Additions (T1200); ICS ATT&CK Wireless Compromise (T0860), Wireless Sniffing (T0887), Denial of Control (T0813) for building-automation OT.
• NIST CSF 2.0: Identify (mesh/wireless asset & key posture), Protect (validating S2/secure join and key rotation), Detect (mesh anomaly/rogue-join detection), Respond (isolating compromised nodes). Strong Identify + Protect + Detect.
• OWASP: OWASP IoT Top 10 (I1 Weak/default credentials & keys, I5 Insecure network communication, I4 Lack of secure update mechanism, I9 Insecure defaults); MASVS-CRYPTO analog for key-handling.
• CIS Controls v8: Control 12 (Network Infrastructure Management — wireless mesh), Control 13 (Network Monitoring and Defense), Control 4 (Secure Configuration — enforce S2/secure pairing), Control 3 (Data/key Protection).

**Innovation** — Research-Level Project — unifying Zigbee and Z-Wave assessment with automated posture scoring behind one framework goes beyond scattered existing tools and has clear consultancy/product value. Scores: Innovation 8/10, Startup 7/10, Enterprise-Readiness 7/10, Patent = Possible.