Thursday, February 23, 2012

Wardriving for Zigbee

by Travis Goodspeed <travis at>
with kind thanks to @fbz, @skytee, and their Hacker Hostel.

While I don't do much on-site work these days, it's always fun to pull out a packet sniffer for a weird protocol and show a client how much cleartext is bouncing around his facility. It's even more fun in the vendor room of a conference. Toward that end, I made a Microsoft Keyboard Sniffer in September that forwards keyboard traffic to my Nokia N900. (By the by, Microsoft still refuses to issue an advisory for that bug.)

A few months and a new phone later, I found myself doing the same thing for ZigBee/802.15.4. The result, presented in this article, is a complete wardriving solution for my Nokia N9, allowing for efficient mapping of ZigBee usage when walking or driving. This lets me to map networks similar to the irrigation and city bus networks that KF identified, but for any of the cities that I pass through.
Zigbee Wardriving


Just as I last used the Next Hope Badge for its nRF24L01+ radio to sniff Microsoft's keyboard traffic, the new device uses a MoteIV TMote Sky, better known in some circles as a TelosB. These flooded every university campus four years ago, and you can probably pick a few up for a cup of coffee with a neighborly professor.
Pocket ZigBee Sniffer

The TelosB has a 10-pin expansion port exposing UART0's RX and TX pins, as well as AVCC and GND. Running these lines to the Roving Networks RN42 module provides an RFCOMM connection at 115,200 baud, coincidentally the same default rate used by the GoodFET firmware. Be sure to swap RX and TX for a proper connection.

Finally, a LiPO battery and charging circuit were soldered in to replace the AA batteries of the original TelosB. This allows for quick recharges and several days of battery life.

In use, I either leave the box in my jacket or put in on the dashboard of a car. The Lego Duplo case keeps all components together, and the SMA jack allows for an antenna external to the car. (Not that I ever stay in one city long enough to buy a car, but surely one of my neighbors has a convenient external 2.4GHz antenna for me to wire into.)
Zigbee Wardriving


The GoodFET firmware natively supports the TelosB, as described here. Firmware is normally compiled by running "board=telosb make clean install", but a second board definition exists to use the external serial port instead of the internal one. So set board=telosb for local use and board=telosbbt for use over Bluetooth. Luckily both the TelosB and the RN42 module default to 115,200 baud.

This image exposes both the TelosB's CC2420 radio and its SPI Flash chip to the host. The host also has the authority to load and execute code in the device, so a standalone mode that writes recorded packets to the SPI Flash is a distinct possibility.

Standard Client

The standard GoodFET client works as expected, once py-bluez is manually installed and Nokia's DRM infrastructure, Aegis, has been disabled. To use a Bluetooth device instead of a serial port, just set the GOODFET environment variable to the appropriate MAC address.
GoodFET on the N9

Custom Client

The standard GoodFET client is written in Python, in a style where most of the guts are exposed for tinkering. This is great for doing original research on a workstation, but it's terrible when trying to show off a gizmo in a bar or at a client site. For this reason, I hacked together a quick client in QT Quick using my reverse engineered SPOT Connect client as a starting point.

The interface is composed of a Bluetooth selection dialog, a packet sniffer, and a packet beaconing script that repeatedly broadcasts a sample Packet-in-Packet Injection.
N9 ZigBee Sniffing (cropped)
GoodFET for Meego

A log is kept in the N9's internal storage, so that any captured packet can be fetched later. The log is append-only, with a record of every received packet and timestamps from each start of the application. Additionally, GPS positions are dumped for positioning.


The position log is then translated by a script into the Keyhole Markup Language or any other GIS format for plotting.
Wardriving for Zigbee

KML is simple enough to compose, with the one oddity that longitude comes before latitude. Use the <Placemark> and <Point> tags to mark packets. For small data sets, I've had luck using <LineString> to mark my path, but after touring much of North America, I exceeded Google Maps hundred-thousand line limit.
KML Point

Post processing is frequently needed to smooth out a few erroneous GPS positions. I've collected GPS locks up to twenty kilometers from my real position when indoors and, in one instance, my phone believed itself to be in Singapore while I was actually in the USA. Be sure to check for these when making your own maps.


Now that I have a lightweight system for grabbing Zigbee packets in the wild, I'd like to expand my collection system to vendor proprietary protocols such as TI's SimpliciTI, the Turning Point Clicker, and other protocols that the GoodFET stack supports. I could also use it to map neighbors with the CCC's r0ket badge and similar OpenBeacon transmitters as they stray from the conference venue.

Other protocols, however, are a lot harder to wardrive. While my Microsoft keyboard sniffer can sniff traffic to the phone, it requires a learning phase that is too long to be performed while travelling in a car. This is because the keyboard protocol, unlike Zigbee and more like Bluetooth, has a Start of Frame Delimiter (SFD/Sync) that is unique to each keyboard/dongle pair, requiring special techniques for any promiscuous sniffing. The original Keykeriki exploit by Thorsten Schröder and Max Moser might identify keyboards quickly enough to be performed on the road, or there might be some new trick that will make it possible. For now, though, you'll need to know where the keyboard you'd like to attack is before you can start sniffing it.

While I'll stubbornly stick to Meego for the foreseeable future, an Android client should pop up sooner or later. Also, Mike Kershaw seems to be toying around with full-custom hardware for the job that'll be compatible with the GoodFET firmware. You can find the code for my client in /contrib/meegoodfet of the GoodFET repository.

As a final note, Zigbee traffic can be found just west of 40th Street in West Philadelphia, at Union Station in DC, in the Fort Sanders neighborhood of Knoxville, and at South Station's food court in Boston. In Louisville, Kentucky, search near the intersection of Lexington Road and Grinstead Drive. In Manhattan, try Seventh Avenue just south of Penn Station.

Have fun,


loid said...

Its June... I eagerly await your new post about your engineering feats...

Unknown said...

Thanks for providing such a social platform which give us variety of ideas to explore technical things.">Zigbee is the leading standard for smart energy networks, home automation, sensor networks, health care, and many other exciting applications.

Unknown said...

Friend very interesting project that could better inform me where I find that each component so that I can try to make one myself!


Unknown said...
This comment has been removed by the author.
Jack said...

Thank you for providing such a useful article for us. I liked your idea. Indeed, its very interesting project.And you described everything in detail. Cheers!
Protect those who sell alchohol and tobacco

Unknown said...

Thanks for sharing the useful information in an innovative manner. Your experience will help people in choosing the best home automation option.

deese said...

Very nice post. Any clue on why if I compile the goodfet with telosb works like hell but if I use the board telosbbt crash while flashing ? (Access denied in windows)

Thx a milion :D

Mohamed Goneam said...

موضوع اكثر من رائع تسلم ايديك علي هذه الكلمات
واتشرف بزيارتك لموقعي الالكتروني

تقبل تحيااتي

Mohamed Goneam said...

موضوع اكثر من رائع تسلم ايديك علي هذه الكلمات
واتشرف بزيارتك لموقعي الالكتروني

تقبل تحيااتي

Unknown said...

Hi. Can i ask for the sample code of your telosb interfacing?

John Emilton said...

find free logins here

Blogger said...

Teeth Night Guard is offering personalized fitting and high quality custom made dental guards.

Blogger said...

If you need your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (even if they're dating somebody else now) you got to watch this video
right away...

(VIDEO) Want your ex CRAWLING back to you...?

SFCable said...

Excellent article on Emulating USB Devices which are explained in detail. Each and every aspect of these Devices is comprehensively explained very easily. I am glad to see this valuable information.

The Travelius said...

Best travel holiday packages
Hong Kong Holiday Packages
Hong Kong Tour Package
Hong Kong City Tour
Hong Kong Disneyland Package
Hong Kong Package from India
Hong Kong Trip Package
Hong Kong Package Deals
Hong Kong Tour Package from Delhi

Nicole said...

If you think that you are the only student who does not catch up with the class material, I can definitely assure that you are not. I'm a real procrastinator and I just hate deadlines. Hopefully there are writing service which can help to write a
superb paper.

Technical Support 877-301-0214 said...

Why we use webroot antivirus software
A portion of the antivirus securities offered by Webroot are recorded underneath which may ensure your gadgets and help you to remain safe on the web with 877-301-0214.There is dependably the ascent of dangers online which can make people the casualties of digital assaults, malware, and infections. With Antivirus arrangements, you don't need to stress over the risks of noxious and undesirable projects.For more info visit our website:-

Dahrock said...

Download Latest Music

Sharon Wood said...

Mcafee Customer Support
Avast Customer Support Number
Norton Customer Support Number
Malwarebytes Customer Support Phone Number

Mp3race said...

Download Latest Music

reginald surict said...

Read the following post to know how to track a cell phone location for free with the number of the cell phone. All the information and tips are there. said...

Wonderful blog! I found it while browsing on Yahoo News


Mp3race said...

Download latest gospel music

Download Latest Naija Music

jacklinemelda said...

Every student has the chance of enjoying our affordable custom dissertation help. The writers hired at the company are legitimate paper writing services writers with significant experience.

Dale Morris said...

Microsoft Edge Customer Service
Mozilla firefox Customer Service Phone Number
Microsoft Outlook Customer Service Number
Sbcglobal Tech Support Phone Number
Customer Service Number for Yahoo Mail

aryanoone said...

Thanks for sharing such a nice Blog.I like it.
norton com setup enter product key
mcafee enter code
Outlook Customer service number
Microsoft Edge Customer Service Number

SkyNaijaMusic said...

Excellent blog & I love your
latest foreign Music you have a good work here... It's hard to find good quality writing like yours nowadays..
Naija Entertainment
Excellent blog & I love your
latest naija Music

Ivymelda said...

Our College Term Paper services have enabled many students to excel in their studies that make us proud of contributing to the success of student life. It is important to note that, the Custom Dissertation Services that we offer to our clients are usually original and written from scratch by our qualified writers.

Unknown said...

Download Latest Naija Music & Video

mikerock said...

i found it so amazing change the name to Apple AirPods

AltPartsInc said...

Your post is really better for increase knowledge about.

Dale Morris said...

Phone Number for Yahoo Mail
Outlook Email Customer Service

Angela Richard said...

As a new one to this blog this is really an excellent post. Here the author tried the best the present the main points in an understanding way. Thanks a lot. Read more

Unknown said...

Really good updates Nnuforum

Nnuforum Review

how to make money on Nnuforum

how to register on Nnuforum   

is Nnuforum legit or scam

iPhone 11 Pro Review 

How to grow your blog

How Much Can I
Use To Set Up A Blog In Nigeria

How much does it cost to create a website in

make more money from blogging

MTN 0.0Kb Latest Free Browsing Cheat Via 24Clan VPN Green Edition

MTN free browsing cheat on 24Clan VPN

how to browse for free with 24clan VPN Green VPN on mtn 

How To Configure 24clan VPN Green Edition For MTN Free Browsing Cheat

Nice article

SkyNaijaMusic said...

naija entertainment

Download latest naija music

Phone Reviews


I love this content..

Petertech said...

This Is To Inform You About This Blog "Africans Music Website"That They Have Many Feature Such As Latest Naigeria Music/Video So If You're Interested In Any Of This Please Do Check The Site Out Click here

Rachel Pike said...

Thanks for sharing such a nice Blog.I like it.
Malwarebytes Tech Support
Avast Customer Service Number
McAfee Customer Service Phone Number
Norton Customer Service Phone number

Beecoded said...

Wow, nice blog , I love this blog seriously, and you can follow us @ Fulloaded

And also Download Latest Naija Music

Even you can visit our Fulloaded public Forum

Loadedrace said...

Naija Music & Videos Downloading

meldaresearchusa said...

When you have a reliable Nursing Papers for Sale company, you only expect to obtain high-quality Nursing Research Paper that have been written according to your instructions.

Beecoded said...

Wow, nice blog , I love this blog seriously, and you can follow us @ Fulloaded

And also Download Latest Naija Music

Even you can visit our Naija Freebeat

blogger said...

not bad travis, not bad at all
john |

dorcassmith said...

Criminology Paper Writing Services are the leading ones in the industry, being specialists in Criminology Research Paper Services enabling you to achieve profound success in your endeavors and on your Custom Criminology Assignment Writing Services tasks.

meldaresearch said...

Unsure which firm produces Best Custom Research Paper Writing Services in the industry to solve your writing needs? Legitimate Custom Research Paper Services is there for your to produce the best Research Paper Help Assistance Services.

Term Paper Writing Services said...

Legitimate Custom Nursing Writing Service company is well known in USA for completing the Best Nursing Writing Services and Nursing Research Paper Services.

Robbie Payton said...

I rarely share my story with people, not only because it put me at the lowest point ever but because it made me a person of ridicule among family and friends. I put all I had into Binary Options ($690,000) after hearing great testimonies about this new investment

 strategy. I was made to believe my investment would triple, it started good and I got returns (not up to what I had invested). Gathered more and involved a couple family members, but I didn't know I was setting myself up for the kill, in less than no time all we had put ($820,000) was gone. It almost seem I had set them up, they came at me strong and hard. After searching and looking for how to make those scums pay back, I got introduced to maryshea03 @mailcom who helped recover about 80% of my lost funds within a month.

Admin said...

payment proof on Oforum


Ibtforum review


Treasureboz Income

How Legit Is Treasureboz Income Program

How To share Nnu Forum Sponsored Post On Your Facebook Timeline

2019 9mobile SocialPak 2.5GB Cheat Via HTTP Injector VPN File

Does Oforum Pay Without Referral   

Payment Proof On Oforum

Nnu Forum

Admin said...

Mulabux Income 


Mulabux income Review

800tollfreenumber said...

How to disable malwarebytesy
turn off avast
McAfee enter code
Microsoft edge customer service
Norton product key
Hp envy 5055 ink cartridge
Microsoft edge support number

Olamikesh said...

Good Article I Rate You One Of The Best ..... Continue the hard work Nigerian Song
Ghana Song
South Africa Song
East Song
Gospel Song, Latest Song

Good Article I Rate You One Of The Best ..... Continue the hard work Nigerian Song
Ghana Song
South Africa Song
East Song
Gospel Song, Latest Song


Off Pages Sites List said...

Roku Com Link
Roku Link Activation Code
Roku account setup
Activate Roku Code
Roku Error Code Setup
Roku contact Support
Roku Activation Code -
Lets Activate your Roku Account

Off Pages Sites List said...
Roku Com Link
Roku Link Activation Code
Roku account setup
Activate Roku Code
Roku Error Code Setup
Roku contact Support
Lets Activate your Roku Account
Roku Activation Code -

كيمو نور00201201726286 said...

شركة تنظيف كنب بجازان
شركة تنظيف مجالس بجازان
شركة تنظيف منازل بجازان
شركة تنظيف فلل بجازان
شركة تنظيف شقق بجازان
شركة تنظيف خزانات بجازان

Denise Lee said...

canon ip110 setup

brother hl l2360d wifi setup

pixma mx922 error code b200

canon printer mg2920

canon mg3000 setup wifi

Unknown said...

As claimed by Stanford Medical, It's really the one and ONLY reason this country's women get to live 10 years more and weigh an average of 42 pounds lighter than us.

(And realistically, it really has NOTHING to do with genetics or some secret exercise and absolutely EVERYTHING to around "how" they are eating.)

P.S, What I said is "HOW", and not "what"...

CLICK this link to uncover if this little test can help you release your true weight loss potential

Admin said...


Electronics4all Income Program Review

How To Register On  Electronics4all Income Program  

Electronics4all Review

Nice article


Eking said...

Well such a detailed information.
Free East African music download

factocert1 said...

This is a really instructive post, you're an incredibly skilled blogger. I've joined your blog searching for a more noteworthy measure of your brilliant post. Moreover, I have shared your site on my informal communities!
iso certification in saudi arabia
iso 9001 certification in saudi arabia

CRMJetty said...

I love how this is written. This is very useful and gave me some ideas. Thanks so much for a great resource!

suitecrm customer portal

John Brown said...

I enjoyed reading about some great engineering feats through your blog. I would like to say thanks for sharing this piece of information.
Also, read blogs posted by Andrew
Error Code 0xc0000225

Naijarocks said...

Download Latest Music & Videos

Download Latest East African Music

lucifer1413 said...

Thanks for all the tips mentioned in this article! it’s always good to read things you have heard before and are implementing, but from a different perspective, always pick up some extra bits of information. Visit@
QuickBooks Support

pardu said...

Thanks for the article.


Hitzloadedza said...

Great Blog

Bradley Francis said...

Thanks for sharing this post.To get more information please click here.

Unknown said...

Thanks for sharing this great information

Learn online said...

thanks for sharing this wonderful article. We are the best At&t support,at&t wirless support, Contact at&t helpline,at&t customer care How to Contact at&t wirless support

Florahmelda said...

Those seeking cultural studies paper writing services have an advantage of hiring writers familiar with research papers on cultural diversity for their Cultural Studies Research Paper Services.

100mcxtips Best Commodity Tips Provider said...

Great Content, Superhigh-quality and keep it up :)

Jacob Oram said...

To make any sniffer is not an easy task but you worked hard and prepared it. I appreciate you on this success because it is great work which can't be done by everyone. Dissertation writing service.

Kelly Cain said...


Guest Blogger

Guest Blogging Site

Guest Blogging Website

Guest Posting Site

Best Boarding School in Dehradun said...

Nice Blog. Thanks for sharing.

Top Residential School in Dehradun

Best Engineering College in Dehradun said...

Nice Blog. Thanks for sharing.

Best college for mba International Business in Dehradun

Top 5 Career Options After Civil Engineering

Ethan jurk said...

Download drivers, programming, firmware and manuals for your Canon item and gain admittance to online specialized help assets and investigating. visit - connect canon pixma ix6820 printer wirelessly

Unknown said...

Download Mp3 Songs
Download Latest Naija Mp3 Songs
Download Latest Albums
Download Latest Wizkid Mp3 Songs
Download Latest Davido Mp3 Songs
Download Latest Burna Boy Mp3 Songs
Download Latest Naira Marley Mp3 Songs
Download Latest Zlatan Mp3 Songs
Download Latest Kizz Daniel Mp3 Songs
Download Kizz Daniel King Of Love Album Zip

Unknown said...

Download Mp3 Songs
Download Latest Naija Mp3 Songs
Download Latest Albums
Download Latest Wizkid Mp3 Songs
Download Latest Davido Mp3 Songs
Download Latest Burna Boy Mp3 Songs
Download Latest Naira Marley Mp3 Songs
Download Latest Zlatan Mp3 Songs
Download Latest Kizz Daniel Mp3 Songs
Download Kizz Daniel King Of Love Album Zip

Majeedexs said...

What a sad and terrifying story to hear, may God help us all,
South Africa 2020 MP3">DOWNLOAD mP3