🦸
PEN TESTING BOOK
  • 📘PENETRATION TESTING BOOK
  • ☮️PENTESTING PROCESS
    • 1️⃣Pre-Engagement
    • 2️⃣Intelligence Gathering / Reconnaissance
    • 3️⃣Threat Modeling
    • 4️⃣Vulnerability Assessment
    • 5️⃣Exploitation
    • 6️⃣Post-Exploitation
    • 7️⃣Reporting
  • 🪟Windows Privilege Escalation
    • 🛠️Windows Exploit Suggester
    • 🏄‍♂️Windows-Privilege-Escalation
  • 🐧Linux Privilege Escalation
    • 🏄‍♀️LInux-Privilege-Escalation
  • 🐧Linux Exploit Development Tools
    • 🔧Exploit Development Tools
  • 🕸️Web Application Pentesting
    • 📈graphql injection
    • 🐱cross site scripting
    • 💉Command Injection
    • 🗃️file upload vulnerability
    • 🍶flask
    • 🦕idor
    • 📂local file inclusion
    • 🚛Sensitive Data Exposure Cheat Sheet
    • 🐴wordpress pentesting
    • ❌xxe attack
    • 🔓Authentication Bypass
    • 🕸️Webshells
    • 🏂SSRF
    • 🐈‍⬛Git Exposure
    • ✖️XSS WAF Bypass
    • XPath Injection
  • 🔁Reverse Engineering
    • 🐲intro to ghidra
  • 🦹‍♂️Network Pentesting 101
    • ☢️Router Setup
      • Vyatta Router VM Setup Guide
    • 🔢Enumeration
      • 22, 161, 162 - SSH, SNMP
    • 🧙Brute Force Attacks
      • Brute Forcing Cheat sheet
    • 🛂Post Exploitation
    • Firewall Pentesting
  • 🔅Internet of Things
    • 📳Enumerating IoT Devices
    • 😷Dissecting Embedded Devices
    • 👨‍💻Exploiting Embedded Devices
    • 🎮Dynamic Analysis with Emulation
    • ☮️Firmware Analysis
      • Firmware Analysis
      • Bootloader testing
    • Drone Pentesting
      • Common Attacks
      • Threat Categories
    • Hacking Vending Machines
  • 🚔Automotive Pentesting
    • 🔌Virtual CAN
      • Dump Traffic
  • 🗳️Container Pentesting
    • 🐳docker pentesting
    • 🐋docker container escape
    • 🐋Docker CVE's
    • ☸️kubernetes pentesting
  • 🌆SMART CITY PENTESTING
    • ♾️Protocols
      • LoRa-WAN
  • 🪦ACTIVE DIRECTORY PENTESTING
    • 🌌Active Directory Post Exploitation
  • ☄️Command and Control
    • 🌩️C2 In The Cloud
    • 🔁C2 HTTP Redictor
    • ☸️Havoc C2
    • ⛎Sliver C2
    • 🦄Mythic C2
  • 🦋PENTESTING CISCO DEVICES
    • 🔦Cisco-Torch : Enumeration
    • 🔓Password Attack (Type 5)
  • RED TEAMING
    • 🦕Initial Access
      • ⚔️Weaponization
    • 🔥Frameworks
      • Atomic Red Team
      • MITRE Caldera
Powered by GitBook
On this page
  • Introduction
  • Interactive Map to Detect LoRa Gateways
  • LoRaWAN Applications
  • Architecture
  • Security in LoRaWAN
  • Device Activation
  • Data Required for Session Key Derivation
  • Cyber Security Risks and Threats
  • Compromised keys and Cyber Attacks
  • Cyber Attack Scenarios
  • Auditing Insecure Networks and Detecting Cyber Attacks
  • REFERENCES

Was this helpful?

  1. SMART CITY PENTESTING
  2. Protocols

LoRa-WAN

PreviousProtocolsNextActive Directory Post Exploitation

Last updated 7 months ago

Was this helpful?

Introduction

The long range wide area networking (LoRaWAN) protocol is designed to allow lowpowered devices to communicate with Internet-connected applications over long range (LoRa) wireless connections. It is a MAC layer protocol built on top of LoRa, which is the physical layer (PHY) or the wireless modulation protocol.

As previously mentioned, one of the biggest advantages of LoRaWAN is its long range capability: a single gateway (antenna) can cover an entire city or hundreds of square miles, although it heavily depends on the environment and obstructions in a given location. Furthermore, the LoRaWAN stack does not require a licensed spectrum to transmit messages but rather the opposite, making it a low-cost technology when compared to licensed spectrum solutions.

Interactive Map to Detect LoRa Gateways

LoRaWAN Applications

  • Smart City (i.e. parking, lighting, traffic management, metering, weather monitoring)

  • Industry (i.e. asset tracking, climate control)

  • Security (i.e. panic buttons, gunshot detection, flood monitoring)

  • Smart Home (i.e. alarms systems, home automation)

  • Smart Agriculture

  • Smart Healthcare

Architecture

Security in LoRaWAN

Device Activation

Data Required for Session Key Derivation

AES(AppKey, 0x1 + AppNonce + NetID + DevNonce) = AppSKey
AES(AppKey, 0x2 + AppNonce + NetID + DevNonce) = NwkSKey

Cyber Security Risks and Threats

  • Reverse Engineering Devices

  • Device Tags

  • Hardcoded Keys in Open Source Code

  • Easy-to-guess Keys

  • Network Servers with Default or Weak Credentials

  • Servers with Security Vulnerabilities

  • Compromised Device Manufacturers

  • Device/Infrastructure Deployment Technicians

  • File Disclosure

  • Service Provider Breach

  • Offline Key Cracking

Compromised keys and Cyber Attacks

  • Denial of Service to Devices and Networks

    • Sending Valid Messages

    • Regenerating Session Keys

    • Sending Valid MAC Commands

  • Sending Fake Data

Cyber Attack Scenarios

  • Utilities and Smart Meters

  • Smart Industry

  • Smart Cities

  • Smart Home

Auditing Insecure Networks and Detecting Cyber Attacks

  • Message Replay

  • Fake Messages and Denial of Service (Simultaneous Sessions)

  • ABP Devices

  • Well-known or Non-random Keys

REFERENCES

🌆
♾️
https://github.com/IOActive/laf
https://act-on.ioactive.com/acton/attachment/34793/f-87b45f5f-f181-44fc-82a8-8e53c501dc4e/1/-/-/-/-/LoRaWAN%20Networks%20Susceptible%20to%20Hacking.pdf
https://www.thethingsnetwork.org/map
The Things NetworkThe Things Network
The Things Network
Figure 3. Session Key Generation in LoRaWAN v1.0.*
https://act-on.ioactive.com/acton/attachment/34793/f-87b45f5f-f181-44fc-82a8-8e53c501dc4e/1/-/-/-/-/LoRaWAN%20Networks%20Susceptible%20to%20Hacking.pdf
Logo