New vulnerability found in internet-connected building automation devices

Critical internet-connected smart building devices used in many commercial and industrial properties, have been found to be vulnerable to a new malicious attack. This is according to a report from cybersecurity researcher Bertin Bervis.

The vulnerability exploits the properties in the building automation protocol (Bacnet) which enables technicians and engineers performing monitoring, setup changes and remote control of a wide range of key smart systems that impact temperature control, and other monitoring systems. Bervis analysed several building automation devices with built-in web applications for remote monitoring and control. They were disclosed to manufacturers who didn’t respond.

The research entitled Mixing industrial protocols with web application flaws in order to exploit devices connected to the internet, was presented at the DEF CON IoT Village at the Flamingo Hotel. DEF CON IoT Village is organised by security consulting and research firm Independent Security Evaluators.

The attacker is able to maliciously modify the system’s web application code by injecting javascript code in the Bacnet device, abusing the read/write properties from the Bacnet protocol itself. The code is stored in the Bacnet database helping the attacker to achieve persistence on browser devices that are used in building environments or industrial facilities that connect via BACnet.

The web applications allow malicious code modification in specific elements taken directly from the protocol level user interaction and protocol level database information changes, which means any data change performed directly from protocol interaction can modify pieces of code in the whole web application in a persistent way.

“Remote attackers can jump from that point to another using this technique to steal sensitive information from technicians or engineers who interacts directly with the infected devices,” Bervis says. “It opens a new door for remote attacks without touching or interacting with the web application in those devices. The attacker only needs an insecure building automation protocol to modify the data.”

Bertin Bervis is an independent cyber security researcher from Costa Rica. He has been a featured speaker at DEF CON, Ekoparty and other technical conferences worldwide. His research is focused on internet-connected devices and industrial protocols and is focused on analysing web servers on the wild and exploiting their vulnerabilities. Presentation is available on request.

IoT Village was founded by Independent Security Evaluators as a platform to educate, inform, and empower, IoT Village is a security research community that brings together the brightest minds from security researchers, product manufacturers, solution providers, and academics in order to collaborate on solving the security challenges that plague IoT.

It consists of many programming elements: talks, exploit demos, zero-day hunting contests, capture the flag style contests, and other hacktivites. As a security research platform, IoT Village has represented the discovery and publication of more than 300 zero-day vulnerabilities – previously unknown, critical security vulnerabilities that are readily exploitable in systems that are already out in the market being used by consumers, businesses, and governments alike. These critical issues afflict more than 50 different IoT device types.

Independent Security Evaluators (ISE) is a security consulting firm specialising in application, network, and blockchain vulnerability assessments, as well as training and secure software development for companies protecting high-value assets who may be frequently targeted. Our adversary-centric approach to security has proven highly effective for bolstering our clients’ defensive security postures. ISE analysts are also active in the security research community, speaking at conferences about relevant security issues and providing the public with cutting edge threat-based advisories. ISE is headquartered in Baltimore, with offices in San Diego and Los Angeles. For more information, visit here. Click here to subscribe to the ISE blog.

Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

RECENT ARTICLES

Blackline Safety sets new standard in connected worker safety with launch of G6

Posted on: September 26, 2022

San Diego, United States – Blackline Safety Corp., a global provider in connected safety technology, continues to trailblaze in the industrial worker safety market with the launch of a new connected wearable to transform single-gas detection. The all-new G6 personal gas detector – unveiled at the National Safety Council (NSC) Safety Congress & Expo in San Diego

Read more

Senet expands public LoRaWAN network across New York

Posted on: September 26, 2022

Portsmouth, United States – Senet, Inc., a provider of cloud-based software and services platforms that enable global connectivity and on-demand network build-outs for the Internet of Things (IoT) announced it is has expanded the build out of its public LoRaWAN network across all five boroughs of New York City. Through the combined operation of Senet’s

Read more
FEATURED IoT STORIES

9 IoT applications that will change everything

Posted on: September 1, 2021

Whether you are a future-minded CEO, tech-driven CEO or IT leader, you’ve come across the term IoT before. It’s often used alongside superlatives regarding how it will revolutionize the way you work, play, and live. But is it just another buzzword, or is it the as-promised technological holy grail? The truth is that Internet of

Read more

Which IoT Platform 2021? IoT Now Enterprise Buyers’ Guide

Posted on: August 30, 2021

There are several different parts in a complete IoT solution, all of which must work together to get the result needed, write IoT Now Enterprise Buyers’ Guide – Which IoT Platform 2021? authors Robin Duke-Woolley, the CEO and Bill Ingle, a senior analyst, at Beecham Research. Figure 1 shows these parts and, although not all

Read more

CAT-M1 vs NB-IoT – examining the real differences

Posted on: June 21, 2021

As industry players look to provide the next generation of IoT connectivity, two different standards have emerged under release 13 of 3GPP – CAT-M1 and NB-IoT.

Read more

IoT and home automation: What does the future hold?

Posted on: June 10, 2020

Once a dream, home automation using iot is slowly but steadily becoming a part of daily lives around the world. In fact, it is believed that the global market for smart home automation will reach $40 billion by 2020.

Read more

5 challenges still facing the Internet of Things

Posted on: June 3, 2020

The Internet of Things (IoT) has quickly become a huge part of how people live, communicate and do business. All around the world, web-enabled devices are turning our world into a more switched-on place to live.

Read more

What is IoT?

Posted on: July 7, 2019

What is IoT Data as a new oil IoT connectivity What is IoT video So what’s IoT? The phrase ‘Internet of Things’ (IoT) is officially everywhere. It constantly shows up in my Google news feed, the weekend tech supplements are waxing lyrical about it and the volume of marketing emails I receive advertising ‘smart, connected

Read more
IoT Newsletter

Join the IoT Now online community for FREE, to receive: Exclusive offers for entry to all the IoT events that matter, round the world

Free access to a huge selection of the latest IoT analyst reports and industry whitepapers

The latest IoT news, as it breaks, to your inbox