Attacking HomeMatic

Presented at 30C3 (2013), Dec. 30, 2013, 4 p.m. (60 minutes)

HomeMatic is a good working, inexpensive and quickly spreading home automation system supporting wired as well as (partly AES handshake protected) wireless communication. The first part of our talk deals with security issues of HomeMatic devices and their wireless communication protocol called BidCoS (Bidirectional Communication Standard). In the second part we introduce Homegear, our own interface software to control HomeMatic devices. In the past few years wireless home automation systems have become increasingly available as a good alternative to wired systems. Since wireless devices are installable without ripping open walls, it is now possible to easily integrate them into an existing building infrastructure. We chose to work with HomeMatic, because we think that through its affordable prices, its good quality and its fast growing portfolio it will become the most widely spread wireless home automation system in Germany. In this live hacking presentation we will introduce different mechanisms to attack a HomeMatic system. We will show how to sniff BidCoS packets, how to send arbitrary packets in order to emulate a device (e. g. a HomeMatic central) and to control devices. Some devices use an AES handshake to verify the sender of a command. But not all devices support the handshake and for many devices it is disabled by default. We will demonstrate several attacks making use of this security issue. After the live hacking part we will give a short introduction into Homegear. Homegear is an interface software, which directly communicates with BidCoS devices and is controllable through XML RPC (XML Remote Procedure Call). It is possible to fully control most HomeMatic devices. We developed it to add features which are not integrated into the official system like controlling valve drives directly to implement custom room temperature control algorithms.

Presenters:

• Malli
  Electrical engineer, amateur radio operator, hobbyist (mostly making some AVR microcontroller stuff), gliding pilot (given-up hobby), peace activist, anarchist. 2005 Abitur 2005-2006 Zivildienst 2006 studies of Electrical Engineering at the Uni Kiel 2012 electrical engineer since 2012 working at the Fraunhofer-ISIT: (electrical) control of MEMS micromirrors for laser projectors using an FPGA
• sathya

Links:

• https://fahrplan.events.ccc.de/congress/2013/Fahrplan/events/5444.html

Similar Presentations:

• Black Hat Asia 2018 / AES Wireless Keyboard – Template Attack for Eavesdropping
• Black Hat USA 2013 / Honey, I'm Home!! - Hacking Z-Wave Home Automation Systems
• DEF CON 24 (2016) / Light-Weight Protocol! Serious Equipment! Critical Implications!