Matter aims to unify smart home ecosystems through an open, interoperable, and secure standard, relying on cryptographic mechanisms for device authentication and data confidentiality. However, its openness also exposes protocol details, credential structures, and implementation characteristics to adversaries. We show that an attacker with temporary physical access can exploit design and implementation flaws to extract credentials and impersonate devices and controllers. These replicas integrate seamlessly into the fabric, enabling persistent surveillance and control even after the attacker departs. Notably, the attack is vendor-agnostic and requires no device-specific reverse engineering, as long as the device is not physically secured. We validate its practicality through a proof-of-concept on a simulated smart home with both commercial devices and development boards. Our findings uncover previously underestimated attack surfaces in Matter, particularly under physical access scenarios, and motivate four targeted mitigation strategies.

翻译：暂无翻译