Breaking Z-Waves: How We Use Symbolic Execution to Find Critical RF Vulnerabilities

Explore the cybersecurity challenges of emerging IoT Radio Frequency protocols in this 49-minute conference talk from Recon 2024. Follow Oliver Lavery, Sr. Security Engineer at Amazon Element55, as he details the journey of securing new RF attack surfaces in smart home devices. Learn about the team's evolution from initial experiments with symbolic execution tools like CBMC and Klee on Amazon Sidewalk protocol stacks to discovering critical vulnerabilities in SiLabs Z-Wave protocol implementation. The presentation covers practical applications of symbolic execution for vulnerability research in wireless protocols including ZigBee, Z-Wave, OpenThread, and Amazon Sidewalk, highlighting both the technical challenges encountered and successful exploitation techniques. Lavery brings decades of experience in offensive and defensive security, reverse engineering, and vulnerability research across high-tech, finance, and critical infrastructure sectors to this technical deep dive.