How To Teach Threading To A Dolphin - Andras Tevesz

How To Teach Threading To A Dolphin - Andras Tevesz

Speakers: Andras Tevesz, Security Researcher, Kujo AI

Conference: Nullcon

YouTube: https://www.youtube.com/watch?v=8Tk01A9T63E

Overview

Andras Tevesz, a security researcher at Kujo AI, presented a fascinating deep dive into the security of Thread and Matter networks, the foundational protocols for modern Internet of Things (IoT) home automation. The talk, titled "How To Teach Threading To A Dolphin," explored the challenges of interacting with these typically locked-down networks using a Flipper Zero, a popular multi-tool for hackers and security enthusiasts. Tevesz's primary motivation stemmed from a research goal to block TCP connections from IoT devices, particularly due to privacy concerns surrounding devices like spy cameras communicating with the internet.

The presentation highlighted the critical absence of readily available "hackish" devices capable of interacting with Thread networks, prompting Tevesz to develop a custom solution. By integrating a Thread radio with a Flipper Zero, he demonstrated novel methods for network discovery, device commissioning, and even establishing covert communication tunnels. This research underscores the evolving threat landscape in home automation, emphasizing the need for robust security practices as these interconnected ecosystems become more prevalent and sophisticated.

Background

▶ Watch: Introduction and speaker's security research background (0:00)

The proliferation of smart home devices has introduced a complex web of interconnected systems, often operating on proprietary protocols or within isolated ecosystems. Matter and Thread represent a significant industry effort to standardize and unify this landscape, promising greater interoperability between devices from different manufacturers. Matter, an application-layer protocol, enables devices from companies like Apple, Amazon, and Google to communicate seamlessly, transcending previous compatibility barriers. It can operate over various network technologies, including Wi-Fi, Ethernet, and crucially, Thread.

Thread, developed by Google and introduced openly around 2016, is a low-power, IPv6-based mesh networking protocol designed specifically for IoT devices. It operates in the 2.4 GHz spectrum, sharing frequencies with Wi-Fi and Zigbee, which can lead to interference. Key advantages of Thread include its self-healing mesh architecture, which ensures network resilience, and its energy efficiency, making it ideal for battery-powered devices. Unlike older protocols like Zigbee, Thread's IPv6 foundation allows for direct IP addressing of devices, eliminating the need for proprietary gateways and theoretically simplifying network access. However, this direct IP accessibility also introduces new security considerations. The critical component connecting a Thread network to a home's broader IP network is the Thread Border Router, which translates between the two domains. Prior to this research, the ability to interact with and analyze Thread networks using off-the-shelf hacker tools was severely limited, posing a challenge for security researchers aiming to understand and mitigate potential vulnerabilities.

Key Findings

▶ Watch: Flipper Zero's hacking capabilities and extensions (4:00)

Andras Tevesz's research revealed several critical insights into the security posture of Thread and Matter networks, primarily highlighting the lack of accessible tools for security analysis and the vulnerabilities arising from common deployment practices. The most significant finding was the successful development of a Flipper Zero-based Thread network interaction tool, effectively bridging the gap between a versatile hacker multi-tool and the emerging IoT standard. This custom solution, which integrates a Nordic nRF52840 Thread radio with the Flipper Zero via UART, demonstrated that despite the locked-down nature of these networks, it is possible to:

1. Discover Thread Network Parameters: The Flipper Zero, equipped with the custom radio, could passively scan for and identify essential Thread network parameters such as the PAN ID, Channel ID, and Network Name using standard OpenThread API calls like OT scan and thread discover. This capability is fundamental for any subsequent interaction.
2. Commission Devices to a Thread Network: Tevesz successfully used the Flipper Zero as a "Joiner" to connect to an existing Thread network, simulating a new device being added. This process involved extracting pairing codes (e.g., from QR codes for Matter commissioning) and relaying them via Bluetooth from a phone to the Flipper's extension board, demonstrating the Flipper's ability to act as a legitimate Thread client.
3. Perform Active Network Reconnaissance: Once connected, the Flipper Zero could conduct active reconnaissance, including pinging other devices within the Thread network, pinging external internet hosts via the Thread Border Router, and performing port scanning on both local Thread devices and internet targets. This ability exposes the internal network topology and services running on IoT devices.
4. Establish Covert Communication Tunnels: Perhaps the most impactful finding was the demonstration of creating a tunnel from a device within the Thread network to an external attacker-controlled host on the internet. This capability effectively bypasses standard network segmentation, allowing an attacker to potentially exfiltrate data or gain remote access to vulnerable internal services (e.g., an SSH server or a Plex device) that would otherwise be inaccessible.
5. Identify Weaknesses in Key Management: The research uncovered that some Thread Border Routers still utilize default Thread network keys or easily guessable values. While the Thread Group has recognized this issue and implemented protocols for generating random keys, the prevalence of older or poorly configured devices means that "leaked" or default datasets remain a viable attack vector for gaining unauthorized network access.

These findings collectively underscore that while Thread and Matter aim for secure and interoperable IoT, practical implementations and the absence of readily available security analysis tools leave significant gaps for attackers to exploit. Tevesz's work provides a foundational toolset for future research and defensive strategies in this critical domain.

Technical Deep Dive

▶ Watch: Understanding Matter protocol and IoT ecosystem unification (5:00)

The core of Tevesz's project involved integrating a Nordic nRF52840 Thread radio with a Flipper Zero to create a versatile platform for Thread network analysis and interaction. The choice of the Nordic chip was driven by its developer-friendly environment and robust SDK, contrasting with the more challenging build processes encountered with ESP and Silicon Labs solutions. The nRF52840 runs Zephyr RTOS, a scalable real-time operating system ideal for resource-constrained IoT devices. Tevesz developed a custom application within Zephyr to manage the Thread stack and expose functionality via a UART interface.

The physical connection between the Flipper Zero and the Nordic radio was surprisingly straightforward, leveraging the Flipper's GPIO pins for UART communication and power. This setup allowed the Flipper to send commands to the Thread radio and receive responses, effectively making the Flipper the control plane for the Thread module. While the Flipper Zero's native firmware development (using its application API) proved challenging due to memory constraints and a limited C++ environment, Tevesz opted for JavaScript running on the Flipper's embedded mjs library. This environment, though also limited (50KB interpreter, 1KB RAM, missing basic string/number functions), offered a more manageable development experience for scripting the interactions.

To connect to a Thread network, several parameters are essential:

• PAN ID: A 16-bit identifier for a specific Thread network, similar to a VLAN ID.
• Channel ID: The radio frequency channel used for communication (e.g., Apple often uses channel 25).
• Network Name: A human-readable name for the network.
• Network Key: A unique, long cryptographic key that secures the network. This is the most critical and hardest parameter to obtain.

Tevesz demonstrated two primary methods for obtaining the first three parameters:

1. OT scan command: Executed directly on the OpenThread radio, this command sends out a Thread Beacon. Other Thread devices respond with messages containing their PAN ID, MAC address, and Channel ID. This works without prior network setup.
2. thread discover command: This requires the Thread device to be initialized and set up. It's a higher-layer (Layer 3) message that sends out a mesh CoAP discover message, eliciting responses that include the Network Name, PAN ID, and an Extended PAN ID.

The Network Key is the primary barrier to unauthorized access. Tevesz highlighted several ways this could be compromised:

• Leaked Thread Data Sets: Thread devices, by their mesh nature, share a common Thread Data Set containing network keys. If these datasets are inadvertently exposed online, attackers can extract the key.
• Default Values: Historically, some Thread Border Routers used default or easily guessable keys. Although the Thread Group now mandates random key generation, legacy or misconfigured devices remain vulnerable.
• Matter Commissioning: During Matter commissioning, a device typically receives the network key. While this process is designed to be secure (e.g., via QR codes, Bluetooth), an attacker could intercept or extract this information if they control the commissioner or exploit vulnerabilities in the pairing process. Tevesz's demonstration effectively leveraged this by using the Flipper Zero as a "Joiner" and receiving the necessary data.

Once the Flipper Zero, acting as a Thread device, successfully joins a network, it gains the ability to:

• Ping: Send ICMP (IPv6) packets to other devices within the Thread network or to external internet hosts (via the Border Router). This confirms connectivity and network reachability. Tevesz specifically noted that IPv4 pinging also works due to Network Address Translation (NAT) on some Border Routers, but IPv6 is preferred for direct device access.
• Port Scanning: Identify open ports on Thread devices within the local network or on external internet servers. This reveals running services and potential vulnerabilities.
• Tunneling: Establish a covert communication tunnel. This involves forwarding TCP ports from a vulnerable internal device (e.g., an SSH server or a Plex media server) within the Thread network to an external attacker-controlled host on the internet. This effectively bypasses perimeter defenses and allows direct remote access to internal resources.

The development process was not without its challenges. Tevesz detailed significant difficulties with Zephyr RTOS configuration, where enabling one feature could silently break another without meaningful error messages. Debugging was also a major pain point, often requiring specialized tools like a J-Link debugger to recover bricked Flipper Zero devices. The limitations of the Flipper's JavaScript environment and the constant, often undocumented, API changes in Flipper firmware updates added further complexity, making consistent development difficult.

Demo / Proof of Concept

▶ Watch: Analogy: Thread hacking compared to early Wi-Fi hacking (9:00)

Andras Tevesz presented a live demonstration of his Flipper Zero-based Thread network interaction tool, though he had to fall back to a pre-recorded video due to an unexpected live error. The demonstration showcased the entire workflow from device commissioning to active exploitation, illustrating the practical implications of his research.

The initial phase involved commissioning the Flipper Zero's Thread extension board to an existing Thread network. This process was designed to simulate a new Matter-capable device joining the network:

1. A QR code (generated by the custom device and printed for convenience) was scanned by a smartphone.
2. The phone, acting as the Matter controller and external commissioner, initiated communication with the Thread Border Router.
3. Via Bluetooth, the phone sent the necessary pairing data (including the network key) to the Flipper Zero's extension board.
4. The Flipper Zero, running Tevesz's custom JavaScript code and controlling the Nordic Thread radio via UART, processed this data and successfully joined the Thread network. The video log clearly showed the communication flow and the eventual connection, despite a non-certified device error message. Crucially, the network key and network name were briefly visible in the log during this process, highlighting how an attacker could obtain these critical pieces of information.

Once connected to the Thread network, the Flipper Zero demonstrated its offensive capabilities:

1. Network Discovery: The Flipper executed a discover message, successfully identifying the PAN ID, Channel ID, and Network Name of the target Thread network.
2. Pinging: The Flipper sent both IPv4 and IPv6 ping requests. It successfully pinged external hosts (e.g., Google's DNS server) via the Thread Border Router and internal Thread devices, confirming full network connectivity and the ability to traverse the Border Router to the internet.
3. Port Scanning: Tevesz demonstrated port scanning against both a public DNS server (revealing an open HTTPS port) and a local IP address within the home network. The local scan successfully identified an open SSH server (running Dropbear) and HTTP/HTTPS ports, illustrating how an attacker could map internal services.
4. Covert Tunneling: The most impactful part of the demo involved establishing a tunnel. The Flipper Zero initiated a connection from a service running on a scanned internal device (e.g., the SSH server) to an attacker-controlled host on the internet. The logs on the Flipper showed data being extracted and forwarded, effectively demonstrating how an attacker could bypass network firewalls and gain direct access to internal services through the Thread network and its Border Router.

The demonstration clearly validated Tevesz's findings: the Flipper Zero, with its custom Thread radio, can act as a powerful tool for discovering, joining, and exploiting vulnerabilities within Thread-based IoT networks, underscoring the significant security implications.

Defensive Implications

▶ Watch: Overview of current Thread protocol versions and adoption (10:00)

The research presented by Andras Tevesz highlights critical vulnerabilities and operational security considerations for anyone deploying or managing Thread and Matter-based IoT networks. Defenders must take proactive steps to mitigate the risks demonstrated:

1. Avoid Default Network Keys: This is paramount. As Tevesz noted, some Thread Border Routers may still use default or easily guessable network keys. Defenders must ensure that all Thread networks are configured with strong, unique, and randomly generated network keys during initial setup. Regularly auditing key configurations is also advisable.
2. Secure Commissioning Processes: The Matter commissioning process, while designed for user-friendliness, can be an attack vector if not handled carefully. Be wary of physical QR code exposure, as these can contain sensitive pairing information. Ensure that Bluetooth pairing is conducted in a secure environment and that devices are not left in an open commissioning state longer than necessary.
3. Network Segmentation: While Thread creates a mesh network, the Border Router acts as a critical gateway. Defenders should consider segmenting their home network, isolating IoT devices on a separate VLAN or subnet. This can limit the blast radius if a Thread device is compromised, preventing attackers from easily pivoting to more sensitive devices on the main network.
4. Monitor for Unusual Traffic: The ability to ping external hosts and establish tunnels from within the Thread network underscores the need for robust network monitoring. Defenders should look for unusual outbound connections from IoT devices, especially those that are not expected to communicate directly with the internet or external IP addresses. IPv6 traffic, in particular, should be scrutinized.
5. Regular Firmware Updates: Keep all Thread devices and especially Thread Border Routers updated with the latest firmware. Manufacturers often release patches for known vulnerabilities, including those related to protocol implementation and key management. The talk highlighted the fragmentation of Thread versions (1.1, 1.2, 1.3, 1.4), emphasizing the importance of staying current to benefit from improved security features.
6. Understand Device Capabilities and Open Ports: The port scanning demonstration revealed that even seemingly simple devices like light switches might expose open ports via IPv6. Defenders should understand the network services running on their IoT devices and ensure that only necessary ports are accessible, both internally and externally. Tools for IPv6 port scanning and network mapping can help identify these exposures.
7. Physical Security: The Flipper Zero, being a small, portable tool, can be used by an attacker with physical proximity. While difficult for home users, organizations deploying Thread in critical environments should consider physical security measures to prevent unauthorized devices from being introduced into the network.

By implementing these defensive strategies, users and organizations can significantly enhance the security posture of their Thread and Matter-based IoT ecosystems against the types of attacks demonstrated by Tevesz.

Key Takeaways

• Flipper Zero as a Thread Hacking Tool: The Flipper Zero, when paired with a custom Thread radio and firmware, transforms into a powerful and portable tool for discovering, joining, and exploiting Thread-based IoT networks.
• Thread Network Vulnerabilities: Despite its modern design, Thread networks are vulnerable to reconnaissance (PAN ID, Channel ID, Network Name discovery) and active attacks (pinging, port scanning, tunneling) if network keys are compromised or easily obtained.
• Weaknesses in Key Management: The use of default or easily discoverable Thread network keys in some deployments, alongside the potential for leaked Thread Data Sets, poses a significant risk to network security.
• Matter Commissioning as an Attack Vector: The Matter device commissioning process, while user-friendly, can be leveraged by attackers to acquire network keys and gain legitimate access to the Thread network.
• Covert Tunneling Capabilities: Attackers can establish covert tunnels through Thread Border Routers, bypassing perimeter defenses and gaining direct access to internal vulnerable services from the internet.
• Challenges in IoT Security Research: Developing tools for new IoT protocols like Thread is complex due to fragmented standards, difficult debugging environments, and limitations of embedded platforms like the Flipper Zero.

About the Speaker(s)

Andras Tevesz is a seasoned security researcher currently working at Kujo AI, a company that, as he noted, "almost no one knows what Kujo is." With over 20 years of experience in IT security, Tevesz's background is diverse, encompassing coding, architecture, penetration testing, Big Data auditing, and reverse engineering. His current focus lies heavily in IoT security research, particularly on firmware and hardware, with a keen interest in "how we can break stuff." His extensive expertise in analyzing complex systems and his hands-on approach to hardware hacking were evident throughout his detailed presentation on Thread and Matter security.