<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-zigbee-security-assessment
description: >-
  Assess ZigBee and Z-Wave IoT protocol security including network key extraction, device enumeration, replay attacks, and firmware analysis for smart home and industrial deployments.
domain: cybersecurity
subdomain: wireless-security
tags:
  - zigbee
  - z-wave
  - iot-security
  - killerbee
  - smart-home
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1200", "T1011", "T1552.004"]
  nist-csf: ["PR.AC-3", "DE.CM-1", "PR.DS-2"]
  uuid: 64d9d98a-ddc4-473f-97a5-f364b8de9320
---

# Performing ZigBee Security Assessment

## Overview

ZigBee security assessment evaluates the security of IEEE 802.15.4-based wireless networks
used in IoT, smart home, and industrial environments. Testing includes network key sniffing,
device enumeration, replay attacks, and exploitation of common ZigBee vulnerabilities such
as default trust center keys, insecure key transport, and unauthenticated OTA updates.
Uses KillerBee framework and compatible hardware.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| KillerBee framework with compatible hardware (ApiMote, RZUSBSTICK) | Required |
| Wireshark with ZigBee dissector | Required |
| Texas Instruments CC2531 USB sniffer (alternative) | Required |
| zbstumbler, zbdump, zbreplay from KillerBee | Required |
| Target ZigBee network within RF range | Required |

## Key Concepts

### ZigBee Security Model

```
ZigBee Security Layers:
├── Network Layer Security
│   ├── Network key (shared among all devices)
│   ├── Default trust center key: "ZigBeeAlliance09" (well-known)
│   └── Key transport often unencrypted on join
├── Application Layer Security
│   ├── Application link keys (device-to-device)
│   └── Trust Center link key
├── Common Vulnerabilities
│   ├── Default/well-known trust center key
│   ├── Unencrypted key transport during device join
│   ├── No replay protection on some implementations
│   ├── Insecure OTA firmware updates
│   └── Touchlink commissioning abuse
└── ZigBee 3.0 Improvements
    ├── Install codes for initial key exchange
    ├── Distributed security model option
    └── Enhanced security for touchlink
```

### Network Discovery

```bash
# ZigBee network scanning with KillerBee
zbstumbler -i 0  # Scan channel 11-26 on interface 0

# Continuous sniffing on specific channel
zbdump -i 0 -c 15 -w zigbee_capture.pcap

# Enumerate devices on network
zbstumbler -i 0 -c 15  # Specific channel
```

### Key Sniffing

```bash
# Capture during device join (key transport)
zbdump -i 0 -c $CHANNEL -w join_capture.pcap

# If default trust center key is used:
# Key: 5A:69:67:42:65:65:41:6C:6C:69:61:6E:63:65:30:39
# ("ZigBeeAlliance09" in hex)

# Decrypt in Wireshark:
# Edit > Preferences > Protocols > ZigBee > Security Level: AES-128
# Add key: ZigBeeAlliance09
```

### Replay Attacks

```bash
# Capture legitimate command (e.g., unlock, light on)
zbdump -i 0 -c $CHANNEL -w command_capture.pcap

# Replay captured command
zbreplay -i 0 -c $CHANNEL -r command_capture.pcap

# If no frame counter validation, command replays successfully
```

## Workflow

### Step 1: Discovery

```bash
zbstumbler -i 0  # Enumerate ZigBee networks
```

### Step 2: Passive Sniffing

```bash
zbdump -i 0 -c $CHANNEL -w passive_capture.pcap
```

### Step 3: Key Extraction

Monitor for device join events. Attempt decryption with default trust center key.

### Step 4: Traffic Analysis

Decrypt and analyze ZigBee traffic in Wireshark with recovered keys.

### Step 5: Replay Testing

Test replay attack resistance by capturing and replaying commands.

### Step 6: Document findings and IoT-specific remediation recommendations.

## Detection

```yaml
title: Zigbee Security Assessment Detection
id: ad211f57-d3cc-4bce-860d-063569bd6ae2
status: experimental
description: Detects suspicious activity related to performing zigbee security assessment techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1011
  - attack.t1552.004
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Zigbee Security Assessment Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1011, T1552.004 |

## Verification

- [ ] ZigBee networks in scope enumerated
- [ ] Default trust center key tested
- [ ] Key transport security assessed during device join
- [ ] Replay attack resistance validated
- [ ] OTA update security verified
- [ ] Findings documented with IoT-specific remediation

## References

- ZigBee Alliance Security Specification
- MITRE ATT&CK for IoT
- [KillerBee framework](https://github.com/riverloopsec/killerbee)
- NIST SP 800-183: Networks of Things
