Zigbee sniffing

I bought Attify's IoT Exploit lerning kit.
Since that was soooo fun, I want to show you some.

Zigbee sniffing with APImote

Zigbee is a global standard for wireless technology which supports low cost, highly reliable networks for device-to-device
communication.

In the lerning kit, APImote enables to monitor zigbee packets.
Following tools are used for hands-on demo.

All of these tools are included in the IoT Exploit learning kit.
(Since I bought this kit in beginning of 2019, contents may be changed.)

And also we can use VM image that required tools are installed.
https://github.com/adi0x90/attifyos

Upload code to Arduino Nano

Let's upload code to Arduino Nano with Arduino IDE.

It just sending text and counting up value.

#include 
int a=0;
SoftwareSerial mySerial(2,3); //RX, TX

void setup(){
	Serial.begin(2400); //baudrate: 2400bps
}

void loop(){
	Serial.println("Hello!!!");
	Serial.println(a);
	a++;
}

For just in case, check if it can build.
Sketch -> Verify/Compile

Then upload code to Arduino Nano.
Sketch -> Upload

If it failed to upload code, you should check the followings.
・Is board selected "Arduino Nano"?
・Port is correct?
・Does it work Get Board Info?

・Tools -> Get Board Info
It shows like this.

BN: Unknown board
VID: 1A86
PID: 7523
SN: Upload any sketch to obtain it

and also you may need to add user to dialout group for accessing serial port.

$sudo usermod -a -G dialout <username>

Set up XBee

XBee is a wireless module which supports Zigbee.
Configure XBee by XCTU.

Important setting in this experiment is
CH : channel. This controls the frequency band that your XBee communicates over.
Interface Data Rate: baud rate. need to set same value with uploaded code to Arduino Nano.

Configuring Networks
https://learn.sparkfun.com/tutorials/exploring-xbees-and-xctu/configuring-networks

Capturing packets with APImote

Now let's start up gadgets.

Checking as if APImote being detected.

➜  tools git:(master) ✗ sudo python ./zbid
[sudo] password for oit: 
           Dev Product String       Serial Number
  /dev/ttyUSB0 GoodFET Api-Mote v2

Identifying the channel. It seem to be 16. It is matched which was set on XCTU (0x10).

➜  tools git:(master) ✗ sudo python ./zbstumbler -v
zbstumbler: Transmitting and receiving on interface '/dev/ttyUSB0'
Setting channel to 11.
Transmitting beacon request.
Setting channel to 12.
Transmitting beacon request.
Setting channel to 13.
Transmitting beacon request.
Setting channel to 14.
Transmitting beacon request.
Setting channel to 15.
Transmitting beacon request.
Setting channel to 16.
Transmitting beacon request.
# DEBUG Clearing overflow
Received frame.
Received frame is not a beacon (FCF=4188).
Received frame.
Received frame is not a beacon (FCF=4188).
Setting channel to 17.
Transmitting beacon request.
Setting channel to 18.
Transmitting beacon request.

Now starting capture.

➜  tools git:(master) ✗ sudo zbwireshark -c 16 

Strings and counting up values could be observed like this.