Demystifying and Fingerprinting the 802.15.4 ZigBee PHY Layer

Explore the intricacies of the 802.15.4 ZigBee physical layer in this comprehensive conference talk from BSidesLV 2014. Delve into the fundamental principles of wireless communication, including preamble synchronization, start frame delimiter (SFD) usage, and error correction techniques. Examine the concept of packet-in-packet transmission and learn about various modulation schemes such as FSK and PSK. Discover how radios can exhibit "dialects" and how these variations can be exploited for fingerprinting and security purposes. Gain insights into the potential vulnerabilities at the physical layer and understand the implications for network security in ZigBee and other 802.15.4-based protocols.

Intro
KNOWING THE PHY WELCOME TO BABYLON
Wright's Principle
Scapy dot15d4
APlmote v4 beta hardware
Fairy tales of PHY
The Layer Cake is a PHY!
802.15.4 frame (PHY+LNK)
how a frame is received
diving into the PHY layer
Why Preamble? Forget sending data -- can you even agree on time?
How much preamble is really needed?
Fingerprinting with variable preamble
Why SFD?
Is SFD in the symbol set?
Packet-in-packet in Hex
Read the Fscking Paper
Error correction connection Symbol codes rotate into each other.
Modulation of chips
Wifi to Morse
FSK Ghosts
PSK
Do radios have dialects?
Isotope: Fingerprinting FTW!
Cumberland Gap
Franconia notch
Local Dialect as a Shaped Charge
There be pwnage in PHY!