Offensive Z-Wave

Problem to Solve

Z-Wave home-automation meshes operate in the 800/900 MHz ISM band. Older networks used S0 with a fixed-derivation key, while newer deployments use S2 ECDH commissioning. Implementation differences can still expose inclusion keys, cleartext commands, or plaintext PSKs stored on hubs. Security engineers need a concrete way to identify regional frequency, S0 versus S2 posture, inclusion phases, and the realistic attack surface.

How the Skill Works

The skill turns Z-Wave assessment into a repeatable engineering workflow:
- Match the frequency and adapter: verify US 908 MHz or EU 868 MHz, then select Z-Force, EZ-Wave, HackRF, or RTL-SDR based on passive sniffing or full transceiver needs.
- Capture inclusion traffic: focus on the controller adding a device, especially the short key-exchange window where network keys are derived or exchanged.
- Test S0 weaknesses: target the fixed all-zero PSK derivation path for offline decryption, replay, or injection where authentication is weak.
- Inspect S2 implementation flaws: review Curve25519/ECDH verification, DSK physical access, inclusion mode left open, or firmware bugs in verification.
- Pivot through the hub: locate keys in Linux hubs such as SmartThings, Home Assistant, or Hubitat, including zwave_js.json when present, to understand command authority across paired devices.
It also adds detection and reporting notes, such as recording chipsets/firmware revisions and mapping S0 versus S2 per node.

Boundaries and Cautions

This material is intended for authorized IoT penetration testing, lab work, and security research, not unapproved scanning or disruption of production systems. S2 networks should not be treated like S0 offline cracking targets; success usually depends on implementation flaws, physical access, or hub compromise. Replay or injection on unauthenticated nodes only applies when encryption is absent, and command testing can change device state.