安全研究人员对广泛使用的Flume Water Monitor智能水表设备进行了安全分析，发现其915 MHz通信协议存在关键弱点 1。该设备通过在902.5-927 MHz频段的50个信道中进行跳频与桥接设备通信，采用2-FSK调制和200 kbps数据速率 1。负载采用AES-128 ECB模式加密，但密钥生成机制存在设计缺陷 1。
研究人员发现，128位密钥由8字节硬编码密钥衍生，结合未加密报头字节后，有效密钥空间仅为44位，而非理论上的128位 1。利用这一弱点，研究团队通过非优化的Python脚本在GPU上花费约一天时间即成功暴力破解密钥，云平台成本不足10美元 1。破解后的密钥可被用于生成欺骗性消息，可能启用恶意固件更新 1。
Flume公司已知悉此分析结果，并表示已有进一步改进隐私和安全的计划，同意公开发布此研究分析 1。
Security researchers have successfully broken the encryption protecting Flume Water Monitor, a widely deployed smart water meter that communicates with bridge devices over the 915 MHz frequency band 1. The attack exploited weaknesses in the device's cryptographic implementation, reducing the effective key space from 128 bits to just 44 bits through a combination of factors including hardcoded key derivation and unencrypted header bytes 1.
The researchers detailed how the device implements frequency hopping across 50 channels between 902.5 and 927 MHz with 500 kHz spacing and uses 2-FSK modulation at 200 kbps to transmit data 1. Payloads of 16 bytes are encrypted using AES-128 ECB mode, but the 128-bit key is derived from an 8-byte key through simple hardcoded mapping, substantially weakening the security 1. Using a non-optimized Python script running on GPU hardware, the team required approximately one day of computation to brute-force the encryption, with cloud platform costs falling below $10 1. The vulnerability is particularly concerning because anyone possessing the AES key and knowledge of the CRC algorithm could generate fraudulent messages capable of triggering malicious firmware updates 1.
Flume acknowledged the findings and indicated plans for further improvements to privacy and security protections 1. The company agreed to allow public release of the security analysis 1.
评论
还没有评论，欢迎留下第一条。