The last time Hackerfall tried to access this page, it returned a not found error. A cached version of the page is below, or clickhereto continue anyway

GitHub - AFITWiSec/EZ-Wave: Tools for Evaluating and Exploiting Z-Wave Networks using Software-Defined Radios.

Updates / News

06-16-2016:

06-07-2016: We have added the ability to send and receive beams. Beams are used to wake-up battery powered devices.

EZ-Wave

EZ-Wave: Tools for Evaluating and Exploiting Z-Wave Networks using Software-Defined Radios. The tools depend heavily on a modified form of the Scapy-Radio Z-Wave gnuRadio transciever (https://bitbucket.org/cybertools/scapy-radio/overview). A special thanks goes out to the Scapy-Radio guys for providing this useful tool to the public, which also sports modules for Bluetooth and ZigBee for those interested in such things.

Notes

ezstumbler: passive Z-Wave network discovery and active network enumeration

ezrecon: Z-Wave device interrogation including:

ezfingerprint: determines device's Z-Wave module generation (3rd or 5th gen) using a PHY layer manipulation technique (preamble length manipulation).

Requirements

**Tested on Ubuntu 14.04 only

Python 2.7

GNU Radio 3.7+ (recommend Pybombs: https://gnuradio.org/redmine/projects/pybombs/wiki/QuickStart)

Wireshark 1.12 to 2.0.1 (https://code.wireshark.org/review/wireshark)

Mercurial (sudo apt-get install mercurial -y)

**Default configuration is for 2 HackRF One SDRs. Other SDRs can be use by modifying the GRC files accordingly post install ($HOME/.scapy/radio).

OsmocomSDR (http://sdr.osmocom.org/trac/wiki/GrOsmoSDR)

HackRF host software (https://github.com/mossmann/hackrf/tree/master/host)

Installation

The setup script will clone Scapy-radio (https://bitbucket.org/cybertools/scapy-radio/) and modify installation files

./setup.sh

Install Scapy-radio

cd $HOME/scapy-radio
./install.sh scapy
./install.sh blocks

Open [gnuradio prefix]/etc/gnuradio/conf.d/grc.conf in a text editor and append ":/usr/local/share/gnuradio/grc/blocks" to global_blocks_path

./install.sh grc

Install Wireshark dissector

Copy all files in EZ-Wave/setup/wireshark to [wireshark]/epan/dissectors

cd [wireshark]
./autogen.sh
./configure
make
sudo make install
sudo ldconfig

Usage

ezstumbler

ezstumbler.py [-h, --help] [-p, --passive] [-t, --timeout] [-a, --active] [--homeid] -p, --passiveConduct a passive scan for a set time (secs) -t, --timeoutTimeout (secs) for scans, default=60 -a, --activeConduct an active scan for a set time (secs) --homeid4 byte HomeID to scan (ex: 0x1a2b3c4d)

30s passive followed by active scan:

ezstumbler.py --timeout=30

passive scan:

ezstumbler.py --passive

active scan:

ezstumbler.py --active --homeid=0x1a2b3d4e

ezrecon

ezrecon.py [-h, --help] [-c, --config] [-t, --timeout] homeid nodeid homeid4 byte HomeID of target network (ex: 0x1a2b3c4d) nodeidTarget device NodeID (in decimal, <233) -c, --configInclude scan of device configuration settings (takes a while) -t, --timeoutStop scanning after a given time (secs, default=30)

ezrecon.py 0x1a2b3c4d 20

ezfingerprint

ezfingerprint.py homeid nodeid homeid4 byte HomeID of target network (ex: 0x1a2b3c4d) nodeidTarget device NodeID (in decimal, <233)

ezfingerprint.py 0x1a2b3c4d 20

Continue reading on github.com