Wireless sensors are often built with a microcontroller and a radio chip, connected only by a SPI bus. The radio, not the MCU, is responsible for symmetrical cryptography of each packet. When the key is loaded, it is sent as cleartext over the SPI bus, and an attacker with local access can steal the key using a few syringe probes and readily available hardware. This attack and other local attacks against wireless sensor networks will be presented in detail, including a live demo of an AES128 key being extracted from an operational network. Following the conclusion of the lecture, audience members will be brought onstage to perform the attack themselves on various pieces of example hardware.
<strong>Travis Goodspeed</strong> is a neighborly reverse engineer from Southern Appalachia. He has been exploiting and reverse engineering wireless sensors since writing the first stack overflow exploit for them in 2007. His recent projects have included a timing attack on the MSP430 bootstrap loader and an extra-neighborly party-mode belt buckle in the shape of Tennessee.