<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-lora-wan-security-assessment
description: >-
  LoRaWAN security assessment including join procedure analysis, ABP vs OTAA evaluation, session key extraction, gateway security testing, and downlink injection attacks on IoT deployments.
domain: cybersecurity
subdomain: wireless-security
tags:
  - lorawan
  - iot-security
  - lpwan
  - sdr
  - iot-pentest
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1557", "T1200", "T1600"]
  nist-csf: ["PR.DS-2", "PR.AC-5", "DE.CM-1"]
  uuid: 687d60d5-2218-4f62-888f-4546414c7b70
---

# Performing LoRaWAN Security Assessment

## Overview

LoRaWAN networks support IoT deployments across smart cities, agriculture, and industrial
control. Security assessments evaluate join procedure integrity, encryption implementation,
gateway security, and network server configurations. This covers OTAA/ABP analysis,
packet capture and decoding, replay attacks, and gateway compromise scenarios using
SDR and LoRa-specific tools. All testing requires explicit written authorization.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| LoRa-capable SDR (HackRF One, LimeSDR, or USRP) | Required |
| LoRa gateway for testing (RAK, Dragino, or similar) | Required |
| ChirpStack or TTN for network server testing | Required |
| gr-lora or lora-sdr for GNU Radio LoRa support | Required |
| Written authorization / Rules of Engagement | Required |

## Key Concepts

### LoRaWAN Attack Surface

```
LoRaWAN Security Assessment:
├── Join Procedure Analysis
│   ├── OTAA join request/accept capture
│   ├── ABP static key extraction
│   ├── DevNonce replay testing
│   └── AppKey/NwkKey recovery attempts
├── Data Plane Attacks
│   ├── Frame counter manipulation
│   ├── Replay attacks (ABP devices)
│   ├── Downlink injection
│   └── ADR manipulation
├── Gateway Security
│   ├── Gateway management interface audit
│   ├── Packet forwarder configuration
│   ├── Backhaul encryption verification
│   └── GPS spoofing impact
└── Network Server Assessment
    ├── API authentication testing
    ├── Device provisioning security
    ├── Key management evaluation
    └── Multicast group security
```

### LoRa Packet Capture

```bash
# Capture LoRa packets using SDR (GNU Radio + gr-lora)
# Configure for common LoRaWAN frequencies
# US915: 902-928 MHz, EU868: 863-870 MHz

# Using HackRF for LoRa packet capture
hackrf_transfer -r lora_capture.raw -f 868100000 -s 1000000 -g 40 -l 32

# Decode captured LoRaWAN packets
python3 -c "
from lorawanpacket import LoRaWANPacket
import json

# Parse captured LoRaWAN frame
packet = LoRaWANPacket.from_hex('40F17DBE4900020001954378762B11FF0D')
print(json.dumps({
    'mtype': packet.mhdr.mtype.name,
    'devaddr': packet.payload.fhdr.devaddr.hex(),
    'fcnt': packet.payload.fhdr.fcnt,
    'fport': packet.payload.fport,
    'encrypted_payload': packet.payload.frmpayload.hex()
}, indent=2))
"

# Monitor LoRaWAN join requests
python3 lora_join_monitor.py --freq 868.1 --sf 7 --bw 125000
```

### ABP Device Replay Attack

```bash
# ABP devices use static keys — vulnerable to replay
# Capture uplink frame and extract parameters
python3 -c "
import json
frame = {
    'devaddr': '260B1234',
    'fcnt': 42,
    'nwkskey': '00000000000000000000000000000000',  # default/extracted key
    'appskey': '00000000000000000000000000000000',
    'payload': 'test_replay'
}
print('[WARNING] ABP with frame counter reset vulnerability')
print(json.dumps(frame, indent=2))
"

# Test frame counter rollover (16-bit vs 32-bit)
# If device resets counters on reboot, replay window opens
```

### Gateway Security Assessment

```bash
# Scan gateway management interface
nmap -sV -p 80,443,1700,8080,22,1883 $GATEWAY_IP

# Check packet forwarder configuration
ssh admin@$GATEWAY_IP "cat /etc/lora/local_conf.json" 2>/dev/null

# Verify backhaul encryption
tcpdump -i eth0 port 1700 -w gateway_backhaul.pcap
tshark -r gateway_backhaul.pcap -Y "udp.port == 1700" \
  -T fields -e data | head -5
# Semtech UDP protocol is unencrypted by default

# Test ChirpStack API authentication
curl -s http://$NETWORK_SERVER:8080/api/devices \
  -H "Grpc-Metadata-Authorization: Bearer $API_TOKEN" | jq '.totalCount'
```

## Workflow

### Step 1: Pre-Engagement

Confirm scope includes LoRaWAN infrastructure and obtain authorization from network operator.

### Step 2: Device Enumeration

```bash
# Capture and identify active LoRaWAN devices
python3 lora_scanner.py --freq 868.1 --duration 3600
```

### Step 3: Protocol Analysis

Analyze join procedures, frame counters, and encryption implementation.

### Step 4: Gateway Testing

```bash
# Assess gateway management and backhaul security
nmap -sV $GATEWAY_IP
```

### Step 5: Reporting

Document findings including key management issues and protocol weaknesses.

## Detection

```yaml
title: Lora Wan Security Assessment Detection
id: 9fb79d98-4fb6-48f4-b5b8-b7ad56f513bd
status: experimental
description: Detects suspicious activity related to performing lora wan security assessment techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557
  - attack.t1200
  - attack.t1600
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Lora Wan Security Assessment Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1040, T1557, T1200, T1600 |

## Verification

- [ ] LoRaWAN devices enumerated within authorized scope
- [ ] OTAA vs ABP implementation documented per device
- [ ] Frame counter behavior verified (16-bit vs 32-bit, reset handling)
- [ ] Gateway management interfaces assessed
- [ ] Backhaul encryption status confirmed
- [ ] Findings documented with severity ratings

## References

- MITRE ATT&CK T1040 — Network Sniffing
- MITRE ATT&CK T1600 — Weaken Encryption
- LoRa Alliance LoRaWAN Security Specification
- [ChirpStack documentation](https://www.chirpstack.io/docs/)
