LoRa-WAN

Introduction

The long range wide area networking (LoRaWAN) protocol is designed to allow lowpowered devices to communicate with Internet-connected applications over long range (LoRa) wireless connections. It is a MAC layer protocol built on top of LoRa, which is the physical layer (PHY) or the wireless modulation protocol.

As previously mentioned, one of the biggest advantages of LoRaWAN is its long range capability: a single gateway (antenna) can cover an entire city or hundreds of square miles, although it heavily depends on the environment and obstructions in a given location. Furthermore, the LoRaWAN stack does not require a licensed spectrum to transmit messages but rather the opposite, making it a low-cost technology when compared to licensed spectrum solutions.

Interactive Map to Detect LoRa Gateways

LoRaWAN Applications

Smart City (i.e. parking, lighting, traffic management, metering, weather monitoring)
Industry (i.e. asset tracking, climate control)
Security (i.e. panic buttons, gunshot detection, flood monitoring)
Smart Home (i.e. alarms systems, home automation)
Smart Agriculture
Smart Healthcare

Architecture

Security in LoRaWAN

Device Activation

Data Required for Session Key Derivation

AES(AppKey, 0x1 + AppNonce + NetID + DevNonce) = AppSKey
AES(AppKey, 0x2 + AppNonce + NetID + DevNonce) = NwkSKey

Cyber Security Risks and Threats

Reverse Engineering Devices
Device Tags
Hardcoded Keys in Open Source Code
Easy-to-guess Keys
Network Servers with Default or Weak Credentials
Servers with Security Vulnerabilities
Compromised Device Manufacturers
Device/Infrastructure Deployment Technicians
File Disclosure
Service Provider Breach
Offline Key Cracking

Compromised keys and Cyber Attacks

Denial of Service to Devices and Networks
- Sending Valid Messages
- Regenerating Session Keys
- Sending Valid MAC Commands
Sending Fake Data

Cyber Attack Scenarios

Utilities and Smart Meters
Smart Industry
Smart Cities
Smart Home

Auditing Insecure Networks and Detecting Cyber Attacks

Message Replay
Fake Messages and Denial of Service (Simultaneous Sessions)
ABP Devices
Well-known or Non-random Keys

REFERENCES

PreviousProtocols NextActive Directory Post Exploitation

Last updated 1 year ago

hashtagIntroduction

hashtagInteractive Map to Detect LoRa Gateways

hashtagLoRaWAN Applications

hashtagArchitecture

hashtagSecurity in LoRaWAN

hashtagDevice Activation

hashtagData Required for Session Key Derivation

hashtagCyber Security Risks and Threats

hashtagCompromised keys and Cyber Attacks

hashtagCyber Attack Scenarios

hashtagAuditing Insecure Networks and Detecting Cyber Attacks

hashtagREFERENCES