Securing LoRaWAN Sensor Networks

This blogpost from NCC Group evaluates security risks in LoRaWAN and other LPWAN technologies deployed in smart-city contexts, covering key management weaknesses, session management (OTAA/ABP) issues, device and gateway vulnerabilities, metadata and privacy concerns, and operational recommendations (threat modeling, key management, monitoring, firmware updates). It highlights known specification deficiencies in LoRaWAN 1.0.x, improvements in 1.1, practical attack vectors (physical key extraction, replay attacks, gateway compromise), and provides pragmatic mitigations and considerations for deployers.