1
00:00:00,000 --> 00:00:06,540
Thanks guys for coming to see my talk on building automation. This talk is really meant to

2
00:00:06,540 --> 00:00:13,040
introduce you to probably a different type of control systems that maybe some of you have

3
00:00:13,040 --> 00:00:19,160
worked with already or have been exposed to that are a little outside of the generic

4
00:00:19,160 --> 00:00:25,980
industrial control systems that have been under discussion since DAXnet. Very short

5
00:00:25,980 --> 00:00:32,240
introduction about myself. So most noteworthy elements from my past. I was the lead incident

6
00:00:32,240 --> 00:00:39,580
handler for DAXnet back then when it was discovered in 2010. That was mainly also the reason

7
00:00:39,580 --> 00:00:48,020
why I created the dedicated computer emergency response team for Siemens products. I led this

8
00:00:48,020 --> 00:00:55,940
for two other years and these days I run my own ICS cyber security consultancy in Austria. I

9
00:00:55,980 --> 00:01:01,900
am a professor at two universities where basically teach ICS security and pen testing. I help out

10
00:01:01,900 --> 00:01:08,020
at the Sense Institute for teaching ICS courses and I am also conference chair for an academic

11
00:01:08,020 --> 00:01:15,740
cyber security conference focused on ICS. So first of all, short disclaimer, really important

12
00:01:16,050 --> 00:01:24,000
hacking building automation systems can have serious effects on your health. So I highly, I

13
00:01:24,000 --> 00:01:30,140
highly recommend not to hack building automation control systems without authorizations because

14
00:01:30,140 --> 00:01:37,420
dangerous things can happen. Also not if you are unsure what you are actually doing like system

15
00:01:37,420 --> 00:01:44,780
wise and control wise. You will see what I mean by when we go into the next slides. So as I said

16
00:01:44,780 --> 00:01:50,400
we are normally doing regular industrial control systems security. How did we end up working on

17
00:01:50,400 --> 00:01:53,980
building automation control systems. Answer is, we use a high level of security. We are not

18
00:01:53,980 --> 00:02:00,660
because we had to. You see our office is located like on one of the top floors and we have an

19
00:02:00,660 --> 00:02:06,800
automated sun shading or sun blind systems. So the problem that we have there is this this

20
00:02:06,800 --> 00:02:13,520
those those shading system those blind systems are coupled are connected to a wind sensor and

21
00:02:13,520 --> 00:02:20,220
the issue is that this wind sensor is really really really sensitive. So what happens is when

22
00:02:20,220 --> 00:02:26,940
somebody literally farts in the second next building the sun blinds go up and sort of we

23
00:02:26,940 --> 00:02:31,060
could not work anymore we get blinded and that's how we decided we really got to look at building

24
00:02:31,060 --> 00:02:38,780
automation control and from there on sort of we we really expanded. So uh what is building

25
00:02:38,780 --> 00:02:44,180
automation control system uh actually about so as most of you probably haven't been exposed to

26
00:02:44,180 --> 00:02:50,060
those systems let's discuss the major use cases. The most common use case I guess these days is

27
00:02:50,220 --> 00:02:55,600
uh HVAC so controlling heating ventilation and air conditioning so especially in a venue like

28
00:02:55,600 --> 00:03:02,980
this one most probably you would not have like uh direct wiring uh from the temperature sensor to

29
00:03:02,980 --> 00:03:09,720
a controller uh anymore but maybe some type of bus system so there would be some type of

30
00:03:09,720 --> 00:03:14,220
network packet being sent from the uh temperature sensor to the controller. Controller would

31
00:03:14,220 --> 00:03:20,040
uh read it's logic okay what's the target temperature and then uh send a command or another uh

32
00:03:20,040 --> 00:03:26,520
uh bus probably to the actuator to either uh yeah turn on the heating or the air conditioning

33
00:03:26,520 --> 00:03:35,060
depending on uh depending on it's programming. Second area uh is uh lighting so probably if you

34
00:03:35,060 --> 00:03:40,680
you've noticed that you uh see a decline in like classical light switches they're being more and

35
00:03:40,680 --> 00:03:47,620
more replaced by presence or motion detectors uh which is the case in order to save energy uh so

36
00:03:47,620 --> 00:03:50,020
you don't just uh flip switches anymore uh you have to uh you have to uh you have to uh you have to

37
00:03:50,020 --> 00:03:54,840
uh depending on if somebody's in the room uh the system would decide whether to turn on the light

38
00:03:54,840 --> 00:04:00,120
or not and maybe based also on day time of course. Third common application area of building

39
00:04:00,120 --> 00:04:06,280
control systems uh is just energy management as such so uh of course it's possible to switch on

40
00:04:06,280 --> 00:04:13,500
specific devices at a specific point in time so maybe uh when there's cheap energy available via

41
00:04:13,500 --> 00:04:19,140
building automation control you uh could switch on specific devices which consume a lot of

42
00:04:19,140 --> 00:04:26,040
energy uh like uh like a washing machine or anything similar. And the last and I think one

43
00:04:26,040 --> 00:04:30,660
of the most interesting uh application areas of building automation control is physical

44
00:04:30,660 --> 00:04:36,420
access control. So instead of having like a physical key uh through uh a building automation

45
00:04:36,420 --> 00:04:49,120
controller you would be able to lock and unlock doors and also go into uh uh CCTV systems. So

46
00:04:49,120 --> 00:04:55,560
uh building automation controller. So as we know with great power that we have with building

47
00:04:55,560 --> 00:05:02,140
automation controllers there comes great responsibility. So thereby uh we also decided to

48
00:05:02,140 --> 00:05:06,940
look into the actual state of security functions and that's what I'm going to show on the next

49
00:05:06,940 --> 00:05:12,160
slide which really summarizes the state of native security functions in building automation.

50
00:05:14,080 --> 00:05:19,040
I'm really glad we talked about it, right? That's not a mistake by the way.

51
00:05:19,720 --> 00:05:25,980
So the the thing I really want to point out here is uh that many many building automation

52
00:05:25,980 --> 00:05:35,200
control protocols and and technologies that we use today do miss very uh very critical security

53
00:05:35,200 --> 00:05:41,920
functions uh and uh to to elaborate a little bit on this. If I'm possible uh if it's if it's

54
00:05:41,920 --> 00:05:48,280
possible for me to uh connect to a building automation control network uh and I know which

55
00:05:48,280 --> 00:05:55,440
protocol is uh is is being uh is being spoken on this uh on this network I can just set any

56
00:05:55,440 --> 00:06:02,260
command I want as long as it is sort of protocol conformant and the device that I target either

57
00:06:02,260 --> 00:06:08,840
if it's the controller or any type of sensor we'll actually accept my command and uh yeah do

58
00:06:08,840 --> 00:06:14,560
whatever I want from it because for instance there is no uh like embedded authentication maybe

59
00:06:14,560 --> 00:06:18,260
cryptographically supported authentication in those uh protocols. So that's another thing that's

60
00:06:18,260 --> 00:06:22,840
Why? Because those protocols were designed maybe in the late

61
00:06:22,840 --> 00:06:28,300
19s, early 2000s, where there still was the belief that those

62
00:06:28,300 --> 00:06:33,120
systems are closed networks, bus networks, which are not really

63
00:06:33,120 --> 00:06:37,640
interconnected, maybe not really routable networks on the way to

64
00:06:37,640 --> 00:06:41,020
the building automation control network. And therefore, the

65
00:06:41,020 --> 00:06:44,600
threat model was a different thing. Same issue, of course,

66
00:06:44,600 --> 00:06:49,720
leads to replay and spoofing so you can just capture existing

67
00:06:49,720 --> 00:06:53,500
network traffic and then replay it at a later point in time. Some

68
00:06:53,500 --> 00:06:55,840
of the protocols that you will see in building automation

69
00:06:55,840 --> 00:07:00,860
control are actually UDP based so replaying them is even easier

70
00:07:00,860 --> 00:07:05,940
because you do not need to go for the TCP 3-way handshake, so

71
00:07:05,940 --> 00:07:11,340
many of them are susceptible to replaying and spoofing. We did a

72
00:07:11,340 --> 00:07:14,580
number of assessments since then and we also like to

73
00:07:14,580 --> 00:07:23,520
found sort of yeah outdated and legacy software uh why is that the case? If you understand

74
00:07:23,520 --> 00:07:28,920
how those how the systems are being created it's sort of they are practically part of the

75
00:07:28,920 --> 00:07:34,400
building so at some point uh the property management company decides we need to have a new

76
00:07:34,400 --> 00:07:41,400
building so construction starts and at some point uh electrical engineers will come uh do the

77
00:07:41,400 --> 00:07:47,260
cabling put in the actual uh building automation controllers and also do the programming and

78
00:07:47,260 --> 00:07:53,840
from that point in time it sort of stays pretty much the same for the next 5, 10, uh 15 years.

79
00:07:53,980 --> 00:07:59,380
Why? Because those those systems are pretty much part of the building itself. It's not like uh

80
00:07:59,380 --> 00:08:06,420
it's not like in the IT world where you rip and replace your systems every 3 to 5 years. And

81
00:08:06,420 --> 00:08:11,320
of course those systems are quite robust and purpose built from the

82
00:08:11,320 --> 00:08:15,740
physical side but we found out if you look at them from the network side they are

83
00:08:15,740 --> 00:08:23,980
definitely more fragile. In order to give you an idea what attack scenarios uh might be out

84
00:08:23,980 --> 00:08:28,780
there so what an attacker might actually go for uh I'm going to present at least one attack

85
00:08:28,780 --> 00:08:36,520
scenario that we are not looking forward to so uh yeah more like a pro-blueprint. So one

86
00:08:36,520 --> 00:08:41,160
scenario in building automation control could actually mean uh you would try to go

87
00:08:41,320 --> 00:08:48,520
for a sort of uh targeted attack in in the sense of a physical compromise uh enter a building

88
00:08:48,520 --> 00:08:54,600
maybe some type of public building uh you have to find the appropriate entry point to the

89
00:08:54,600 --> 00:08:58,600
building automation control system and that's pretty straight forward some of them are quite

90
00:08:58,600 --> 00:09:04,480
easy to reach. For instance those uh motion and presence detectors they're usually easy to

91
00:09:04,480 --> 00:09:11,060
reach because they're being placed sort of at uh at that type of level so you can just uh uh uh uh

92
00:09:11,320 --> 00:09:17,340
approach one pull it off and then try to connect to the actual the actual building automation bus

93
00:09:17,340 --> 00:09:23,880
so this is an example of a uh KNX uh bus system so two wire bus that we were using there.

94
00:09:24,980 --> 00:09:32,160
That's pretty much it. Rip out the plug connect two wires uh connect that to a uh KNX USB dongle

95
00:09:32,160 --> 00:09:36,800
and from that point in time you're pretty much with you're pretty much in the building automation

96
00:09:36,800 --> 00:09:41,300
control system and can do whatever you want. What this means is that uh when you're connecting to a

97
00:09:41,300 --> 00:09:45,760
it that you might want to do? Well if you think about the scenario that there is maybe a

98
00:09:45,760 --> 00:09:51,920
contract hacker being hired uh from a competing property management company you know a

99
00:09:51,920 --> 00:09:58,900
building where there's nice condominiums uh probably could uh enter the building connect to

100
00:09:58,900 --> 00:10:05,900
the network and then just trigger random alarms like fire alarms, gas alarms which uh yeah

101
00:10:05,900 --> 00:10:11,560
throw people out of their beds at random times in the morning. For instance through spoof

102
00:10:11,560 --> 00:10:18,380
messages, fake sensor readings anything's possible here from a technology uh perspective and if

103
00:10:18,380 --> 00:10:24,660
you do this uh quite often most probably people will start to leave uh this building um before

104
00:10:24,660 --> 00:10:31,140
they could not sleep anymore. So if you combine this type of attack uh maybe with a rogue

105
00:10:31,140 --> 00:10:35,880
device, something like a Raspberry Pi on a battery pack with 3G, you know you could

106
00:10:35,900 --> 00:10:41,320
uh as I said already it's possible to send spoofed messages. So at one point in time I would

107
00:10:41,320 --> 00:10:46,460
spoof maybe a temperature sensor, at another point I would spoof maybe a gas leak sensor. It

108
00:10:46,460 --> 00:10:53,280
would be really really difficult for uh the actual yeah operator of the building to find out

109
00:10:53,280 --> 00:11:00,740
what is the exact reason why those alarms are actually uh happening. So as this is a security

110
00:11:00,740 --> 00:11:05,040
conference I also would like to give you a little bit of information on how to approach uh

111
00:11:05,040 --> 00:11:05,880
those types of security concerns. So as this is a security conference I also would like to give

112
00:11:05,900 --> 00:11:08,360
you a little bit of further comments on the types of systems uh more from the security

113
00:11:08,360 --> 00:11:13,660
perspective uh so also to give you ideas for type of penetration testing or security testing

114
00:11:13,660 --> 00:11:19,420
tools existence out there already uh if you would like to explore uh... maybe your own

115
00:11:19,420 --> 00:11:24,360
home automation system. Uh... If you're into pentesting you know the very first step

116
00:11:24,360 --> 00:11:29,600
is always about information gathering, learning about the uh actual target. Uh the good news

117
00:11:29,600 --> 00:11:35,320
is, if for our good old friend NMAP there is already a significant amount of scripts out there

118
00:11:35,320 --> 00:11:39,820
map uh uh building automation systems. So if you're going for

119
00:11:39,820 --> 00:11:44,600
instance for KNX net IP which is a protocol that is highly uh or

120
00:11:44,600 --> 00:11:49,680
that is widely used throughout Europe and also uh Asia uh that

121
00:11:49,680 --> 00:11:53,720
type of uh plugin uh comes already uh with Nmap uh out of

122
00:11:53,720 --> 00:11:59,540
the box. If you are more into BACnet IP uh which is a standard

123
00:11:59,540 --> 00:12:03,020
that is widely used uh especially in the United States

124
00:12:03,020 --> 00:12:06,140
and also a little bit in in Europe, you would need to tap

125
00:12:06,140 --> 00:12:10,560
into project red point created by digital bond uh to get the

126
00:12:10,560 --> 00:12:14,860
actual uh fingerprinting uh script for Nmap down. There's

127
00:12:14,860 --> 00:12:19,980
another tool called uh HVAC scanner um it looks for specific

128
00:12:19,980 --> 00:12:24,900
uh building automation control devices from Honeywell and uh

129
00:12:24,900 --> 00:12:28,280
also Tridium Niagara controllers. It's not uh it's

130
00:12:28,280 --> 00:12:31,740
not working by uh by tapping into the real building

131
00:12:31,740 --> 00:12:33,000
automation control process. It's not working by uh by tapping

132
00:12:33,000 --> 00:12:36,080
into the protocols by instead looking at fingerprints of uh

133
00:12:36,080 --> 00:12:39,400
the web servers of those devices. So sort of the the um

134
00:12:39,400 --> 00:12:44,400
uh the the HMI type of systems. And finally some of the yeah

135
00:12:44,400 --> 00:12:48,320
more common um professional security scanners like Nessus

136
00:12:48,320 --> 00:12:51,560
also have like rudimentary implementations of

137
00:12:51,560 --> 00:12:54,400
fingerprinting plugins for detecting building automation

138
00:12:54,400 --> 00:12:58,100
systems. But only only a small fraction actually is covered of

139
00:12:58,100 --> 00:13:02,940
the protocols out there. So if you're into pen testing uh and

140
00:13:03,000 --> 00:13:06,500
you would like to explore uh or actually abuse to a certain

141
00:13:06,500 --> 00:13:10,820
sense um a building automation system, you definitely would

142
00:13:10,820 --> 00:13:14,440
need to understand at some point a little bit more about the

143
00:13:14,440 --> 00:13:18,900
actual uh protocol. So uh we're going to talk about two

144
00:13:18,900 --> 00:13:23,020
protocols here. One is KNIX, the other one is uh BACnet which

145
00:13:23,020 --> 00:13:27,840
I'll cover later. So uh KNIX is a good example because it comes

146
00:13:27,840 --> 00:13:31,080
uh in different forms and types of and in in the sense of uh

147
00:13:31,080 --> 00:13:32,980
physical uh media. So uh KNIX is a good example because it comes

148
00:13:33,000 --> 00:13:33,680
in different forms and types of uh media that it supports.

149
00:13:33,860 --> 00:13:37,200
There's KNIX twisted pair. Remember the the the photo I

150
00:13:37,200 --> 00:13:41,260
had before the two wire bus. Uh there's KNIX RF radio

151
00:13:41,260 --> 00:13:44,380
frequency and of course uh luckily for us there's also

152
00:13:44,380 --> 00:13:49,640
KNIX net IP which defines uh how KNIX network protocol should

153
00:13:49,640 --> 00:13:53,080
be transmitted over a regular IP network. And of course there's

154
00:13:53,080 --> 00:13:57,820
also uh protocol converters out there which uh allow you to uh

155
00:13:57,820 --> 00:14:02,580
have a a KNIX net IP gateway in an IP network and behind that

156
00:14:02,580 --> 00:14:07,180
the regular uh KNIX bus. If you look at it from a service or

157
00:14:07,180 --> 00:14:09,800
functionality perspective you would have something like uh

158
00:14:09,800 --> 00:14:14,680
core services which uh within KNIX net IP for locating and

159
00:14:14,680 --> 00:14:18,700
identifying those types of devices as such. Uh you would

160
00:14:18,700 --> 00:14:21,680
have uh another group of services for actual configuration

161
00:14:21,680 --> 00:14:26,980
and device management. Then there's two types of I would say

162
00:14:26,980 --> 00:14:31,800
service groups uh for communication. One for tunneling,

163
00:14:31,800 --> 00:14:32,560
one for routing. And then there's a service group for uh

164
00:14:32,560 --> 00:14:35,880
routing. And finally the last group of services is actually

165
00:14:35,880 --> 00:14:41,940
there for uh remote diagnostic as well. So let's explore a

166
00:14:41,940 --> 00:14:45,040
little more the actual tooling options that you have out there.

167
00:14:45,320 --> 00:14:49,620
You know in my uh company back home we have a saying um there

168
00:14:49,620 --> 00:14:53,880
is no better hacking tool for industrial control systems than

169
00:14:53,880 --> 00:14:56,840
the original engineering software. So like the programming

170
00:14:56,840 --> 00:15:01,920
software. Uh and this is uh this is an example uh of that as

171
00:15:02,560 --> 00:15:05,380
what you see here is screenshots from the so called ETS, the

172
00:15:05,380 --> 00:15:08,700
engineering tool software that is being put out by the KNIX

173
00:15:08,700 --> 00:15:13,840
associations to program those types of devices. Uh so the the

174
00:15:13,840 --> 00:15:17,900
the origin original uh controls engineers and electrical

175
00:15:17,900 --> 00:15:20,480
engineers which build those systems use this software to

176
00:15:20,480 --> 00:15:24,640
program a specific building automation controller. But there

177
00:15:24,640 --> 00:15:27,040
are certain functionalities in there which I'd like to point

178
00:15:27,040 --> 00:15:30,720
out which are also interesting for uh pen testing and security

179
00:15:30,720 --> 00:15:32,540
purposes. The first one is uh the uh the uh the uh the uh the

180
00:15:32,560 --> 00:15:36,400
on the left side so called uh group monitoring. Uh group

181
00:15:36,400 --> 00:15:39,700
monitoring is really the equivalent of sort of uh packet

182
00:15:39,700 --> 00:15:43,400
sniffing uh like you would do with Wireshark. But here we do

183
00:15:43,400 --> 00:15:47,360
not have uh a an ethernet or even IP based network. It's like

184
00:15:47,360 --> 00:15:51,240
a two wire bus. But uh the the principle is the same. Basically

185
00:15:51,240 --> 00:15:55,040
I'm I'm sniffing the two wire bus and I'm building up a list of

186
00:15:55,040 --> 00:15:58,680
packets that I see here. Uh you see here different uh source

187
00:15:58,680 --> 00:16:02,180
addresses which for for KNIX may be something like

188
00:16:02,560 --> 00:16:07,380
1.14.12. And on the right side you would see destination

189
00:16:07,380 --> 00:16:11,800
addresses and if I look there uh if I look into that for uh for

190
00:16:11,800 --> 00:16:15,660
maybe several minutes I will see probably lots and lots of uh

191
00:16:15,660 --> 00:16:20,660
addresses on the uh source side but only few addresses on the

192
00:16:20,660 --> 00:16:23,280
destination sides and the the the few addresses on the

193
00:16:23,280 --> 00:16:27,040
destination side are of course the actual control controllers

194
00:16:27,040 --> 00:16:30,060
where the different sensors report to. So that's the

195
00:16:30,060 --> 00:16:31,960
equivalent of passive information

196
00:16:31,960 --> 00:16:35,800
gathering in a KNIX network. I would like to point out one uh

197
00:16:35,800 --> 00:16:38,200
functionality which I found quite interesting. They

198
00:16:38,200 --> 00:16:42,060
intentionally built in also the function called replay

199
00:16:42,780 --> 00:16:46,580
telegrams. So most probably that was included for uh

200
00:16:46,580 --> 00:16:50,020
debugging uh the controls uh the the building automation

201
00:16:50,020 --> 00:16:53,980
control system. But for security uh purposes of course this uh

202
00:16:53,980 --> 00:16:58,300
this could be a a valid attack tool. On the right side you see

203
00:16:58,300 --> 00:17:01,800
the equivalent of uh an active uh information gathering

204
00:17:01,960 --> 00:17:07,320
attempt, a so called line scan. So uh with that I can I can do

205
00:17:07,320 --> 00:17:11,260
pretty much the same I would do maybe in a uh class C network. So

206
00:17:11,260 --> 00:17:14,900
scan the available address space and see which addresses are

207
00:17:14,900 --> 00:17:18,020
already taken. So pretty straight forward and you can

208
00:17:18,020 --> 00:17:23,660
download the ETS uh just from the KNIX associations website. If

209
00:17:23,660 --> 00:17:27,080
you're not not that into uh using graphical user interface

210
00:17:27,080 --> 00:17:29,760
tools, if you're more into command line tools this uh next

211
00:17:29,760 --> 00:17:31,940
tool I'd like to recommend is called KNIXMap. This is a very

212
00:17:31,960 --> 00:17:34,440
popular app created by uh a bunch of German security

213
00:17:34,440 --> 00:17:39,300
researchers. It has uh the same functionalities for passive and

214
00:17:39,300 --> 00:17:43,160
active information gathering. It also uh has a little more

215
00:17:43,160 --> 00:17:46,220
functionality like allows you to brute force the so called bus

216
00:17:46,220 --> 00:17:51,140
coupling unit key which is just a 32 bit key so it's really

217
00:17:51,140 --> 00:17:56,140
feasible to brute force it for specific configurations. If you

218
00:17:56,140 --> 00:18:00,560
actually would like to change uh the behavior of the uh building

219
00:18:00,560 --> 00:18:01,840
automation control you would

220
00:18:01,840 --> 00:18:05,640
want to make use of group messaging or APCI functions. So

221
00:18:05,640 --> 00:18:09,700
for instance sending something like turn off everything like a

222
00:18:09,700 --> 00:18:13,100
wild card uh that's what it would go for with group

223
00:18:13,100 --> 00:18:17,000
messaging and APCI functions in principle mean uh something like

224
00:18:17,000 --> 00:18:20,420
uh reading or writing memory of a specific controller, restarting

225
00:18:20,420 --> 00:18:24,280
a device, whatever you want to do with a with one specific type

226
00:18:24,280 --> 00:18:28,600
of device. Second protocol that I'd like to uh present is

227
00:18:28,600 --> 00:18:31,680
BACnet IP so building automation control network

228
00:18:31,840 --> 00:18:35,340
uh it's another uh what I would call manufacturer independent

229
00:18:35,920 --> 00:18:39,780
standard so it defines for each device a standard set of objects

230
00:18:39,780 --> 00:18:43,940
and the each object has uh properties and services. Some of

231
00:18:43,940 --> 00:18:47,500
those services uh are mandatory like the read property service

232
00:18:47,500 --> 00:18:51,460
and again for your convenience we've sort of grouped the uh

233
00:18:51,460 --> 00:18:56,840
BACnet IP service into different yeah uh logical groups, alarm and

234
00:18:56,840 --> 00:19:00,160
event services for actually finding out if something what's

235
00:19:00,160 --> 00:19:01,820
going on within the BACnet network. So it's uh uh it's a

236
00:19:01,840 --> 00:19:05,940
separate network. Uh there's also uh file access and virtual

237
00:19:05,940 --> 00:19:10,300
terminal services so I'm not talking about FTP or Telnet here

238
00:19:10,600 --> 00:19:15,940
but really more about the uh BACnet equivalent of those uh of

239
00:19:15,940 --> 00:19:18,920
those functions so you really see BACnet is sort of a a

240
00:19:18,920 --> 00:19:22,800
complex protocol uh and it's really powerful in in the sense

241
00:19:22,800 --> 00:19:28,000
that it allows uh file access and also terminal services. Uh

242
00:19:28,000 --> 00:19:31,540
manipulating objects is possible of course reading,

243
00:19:31,540 --> 00:19:36,880
writing, modifying properties and there's special messages for remote device management.

244
00:19:38,140 --> 00:19:44,100
There's one specific function that we really love uh and it's called BACnet IP broadcast

245
00:19:44,100 --> 00:19:51,060
management devices BBMD and foreign device registration. That uh function within BACnet is

246
00:19:51,060 --> 00:19:56,700
really excellent for pen testing because it actually allows you to breach uh a building

247
00:19:56,700 --> 00:20:02,500
automation control network from the inside- on the inside although you cannot really reach it

248
00:20:02,500 --> 00:20:07,740
from the outside. Uh what do I mean by this? Imagine there is a scenario where uh there's a

249
00:20:07,740 --> 00:20:16,120
BACnet device um and an internal uh private network that for maintenance purposes uh for

250
00:20:16,120 --> 00:20:21,980
service purposes also has maybe something like a port forwarding uh from the internet

251
00:20:21,980 --> 00:20:26,680
activated. So the BACnet IP port would be reachable from the internet. So the BACnet IP

252
00:20:26,680 --> 00:20:31,300
port would be reachable from the internet uh by port forwarding. If this device uh supports

253
00:20:31,300 --> 00:20:37,940
this BBMD function uh what I would be able to do is I could come from the outside register

254
00:20:37,940 --> 00:20:42,840
through this foreign device registration function and from that point in time on I would be

255
00:20:42,840 --> 00:20:51,080
able to talk to all the internal uh other BACnet systems as if I were as if as if I was on

256
00:20:51,080 --> 00:20:56,520
the on the um internal network side. So even if you did your network security right even if

257
00:20:56,680 --> 00:21:01,440
there's no routing available you would be able to compromise the building automation control

258
00:21:01,440 --> 00:21:08,060
uh network through that function. Is that an issue? A practical issue? Unfortunately yes uh we

259
00:21:08,060 --> 00:21:17,320
have found nearly 3000 systems uh BACnet systems in the US alone which expose this dangerous um uh

260
00:21:17,320 --> 00:21:23,860
BBMD function. If you look at it more on a global perspective it's like 15,000 uh devices out

261
00:21:23,860 --> 00:21:26,660
there which support this function and you see it down here. So if you look at it more in a global

262
00:21:26,660 --> 00:21:32,820
context it's it's a good example. So I intentionally blacked out the the the full uh public IP

263
00:21:32,820 --> 00:21:41,820
address something ending with dot 12447808 is the actual uh BACnet port. If I would connect uh to

264
00:21:41,820 --> 00:21:49,980
the system uh and use the BBMD function I would be able to talk to 192.168.3.2 although they are

265
00:21:49,980 --> 00:21:56,560
not reachable from the internet through routing. So pretty pretty dangerous and by the way uh on this uh on the screen

266
00:21:56,660 --> 00:22:02,140
you also see that it's not only smart home or home automation systems that are on the

267
00:22:02,140 --> 00:22:09,200
internet with uh with BACnet. Uh the top most screen shot or top most system here uh on

268
00:22:09,200 --> 00:22:15,500
Shodan is from some type of city parkway access. So there's different types of systems that

269
00:22:15,500 --> 00:22:24,780
you actually see that are connected through BACnet. As we did with KNX uh if you want to

270
00:22:24,780 --> 00:22:32,580
actually uh talk to specific BACnet devices or um yeah abuse specific protocol functions uh

271
00:22:32,580 --> 00:22:37,840
maybe in a penetration test for one of your clients. Again there's different functions uh you

272
00:22:37,840 --> 00:22:42,180
should know uh again in different groups. For information gathering you most probably would

273
00:22:42,180 --> 00:22:48,340
use something like read property. I mentioned the read foreign device table. Uh if you call the

274
00:22:48,340 --> 00:22:54,380
initial uh routing table service uh you would get a list of the devices routing table itself

275
00:22:54,380 --> 00:23:00,420
back. If you are more into spoofing again register foreign device or just I am or I'm router

276
00:23:00,420 --> 00:23:06,340
to network functions are the thing to go for. If you would like to create something like a

277
00:23:06,340 --> 00:23:11,520
denial of service you could just do this by a large number of who is requests or maybe uh

278
00:23:11,520 --> 00:23:17,840
signaling uh the the that uh a specific network cannot be reached through router busy to

279
00:23:17,840 --> 00:23:24,240
network uh services. Maybe you could try to create a routing loop through the initialized

280
00:23:24,380 --> 00:23:30,420
routing table or just send devices constantly into reboots through the reinitialized device

281
00:23:30,420 --> 00:23:35,880
command. That's what I have on the next slide. And therefore uh declining uh declining uh

282
00:23:35,880 --> 00:23:41,680
regular service to all the other clients. So here on the top left we have our alleged uh

283
00:23:41,680 --> 00:23:48,080
building automation controller server. On the right side we have our uh Mr Evil which is

284
00:23:48,520 --> 00:23:54,360
technically just another BACnet uh client which requests our server to reinitialize the

285
00:23:54,380 --> 00:23:58,960
device constantly. So basically we're sending a reinitialized command every 10 seconds which

286
00:23:58,960 --> 00:24:05,180
means that the other alleged clients cannot connect or cannot do anything with it anymore. With

287
00:24:05,180 --> 00:24:11,280
our tests we found out that some of the devices out there um do require uh passwords or may

288
00:24:11,280 --> 00:24:16,860
require passwords uh depending on on on vendor to actually uh call this function or to execute

289
00:24:16,860 --> 00:24:22,360
this function. Well guess what uh you will find the password in most cases in the vendors

290
00:24:22,360 --> 00:24:24,360
actual manual. Uh it's uh it's uh it's uh it's uh it's uh it's uh it's uh it's uh it's uh it's uh

291
00:24:24,380 --> 00:24:33,840
in this case the password was Jesus. So thanks Jesus for helping us. Uh I also mentioned

292
00:24:33,840 --> 00:24:40,360
before that those systems tend to be quite robust uh on the physical side but not so robust on

293
00:24:40,360 --> 00:24:48,480
the uh network side. So what we created is just a very very rudimentary uh BACnet IP fuzzer

294
00:24:48,480 --> 00:24:54,200
using uh SCAPI. Uh so what we did the very first layer uh we typed into

295
00:24:54,200 --> 00:25:00,400
was NPDU and APDU fuzzing and you see down there uh within the the very first seconds we

296
00:25:00,400 --> 00:25:06,160
received already a number of uh segmentation faults. So this is a screenshot uh from I think

297
00:25:06,160 --> 00:25:12,520
the most widely used open source implementation uh of BACnet available on SourceForge. I

298
00:25:12,520 --> 00:25:17,400
really hope that there's not too many devices out there which which uh rely on on on this

299
00:25:17,400 --> 00:25:23,880
protocol stack in that state uh because of the stability issues. Uh as this uh uh this vulnerability

300
00:25:24,200 --> 00:25:32,340
at least today is still a zero day uh um uh it hasn't been fixed yet at this point. So as

301
00:25:32,340 --> 00:25:37,440
you've seen building automation control is pretty powerful uh pretty interesting and it's

302
00:25:37,440 --> 00:25:45,680
quite widely deployed. Question is how how how can we fix this uh how can we improve the uh

303
00:25:45,680 --> 00:25:53,760
the overall situations. So in my opinion this is quite typical. It's on the one hand a

304
00:25:54,200 --> 00:25:59,820
technology issue but on the second hand it's also a people and and knowledge issue. What do I

305
00:25:59,820 --> 00:26:06,600
mean by this? So the technology issue really is that um at least the current generation of

306
00:26:06,600 --> 00:26:13,780
building automation control systems still lacks this um secure by the security by design or

307
00:26:13,780 --> 00:26:23,120
security uh or secure by design approach that uh we've had in general IT for 15 years now that has

308
00:26:23,120 --> 00:26:30,420
started in generic industrial control systems um I would say to a fair amount thanks to

309
00:26:30,420 --> 00:26:36,540
Stuxnet uh but at least uh is not the case uh in at least for for the building automation

310
00:26:36,540 --> 00:26:42,620
control uh sector. Why do I also claim that this is part of a a knowledge problem or

311
00:26:42,620 --> 00:26:49,740
people problem? Well the industry associations behind those technologies like uh Ahray or the

312
00:26:49,740 --> 00:26:56,360
the KNIX association responsible for those protocols at some point they recognized already

313
00:26:56,360 --> 00:27:01,020
that there is maybe security issues out there that need to be addressed. So they put out

314
00:27:01,620 --> 00:27:08,200
guidelines and recommendations how to well counter those risks, how to mitigate at least some

315
00:27:08,200 --> 00:27:16,300
of them, how to retrofit security because you cannot entirely change it at this point in time

316
00:27:16,300 --> 00:27:23,780
at least. If the guidelines actually would have been or would be adhered to then most probably

317
00:27:23,780 --> 00:27:33,140
we wouldn't see 3,000 systems in the US that expose this BBMND function or 15,000 worldwide. We

318
00:27:33,140 --> 00:27:39,880
also did a I would say small survey among billing automation integrators so those guys

319
00:27:39,880 --> 00:27:46,220
responsible for for creating and billing those systems. We did this in Europe for case

320
00:27:46,300 --> 00:27:54,000
of KNIX based system operators and integrators and I think just a very very small fraction

321
00:27:54,000 --> 00:28:00,180
actually had the idea that what they are doing has a has a dedicated security responsibility.

322
00:28:00,620 --> 00:28:06,280
Why? Because the majority of people who creates those billing automation control systems are

323
00:28:06,840 --> 00:28:11,820
electrical engineers, they're automation engineers, they're controls engineers and not

324
00:28:11,820 --> 00:28:16,280
security people. However the world of course from a technology perspective had had a lot of

325
00:28:16,280 --> 00:28:23,280
changes. There is KNIX net IP, there is BAC net IP uh and therefore uh security should be

326
00:28:23,280 --> 00:28:28,820
addressed uh to a to a to a certain extent. So from a general perspective there is holistic

327
00:28:28,820 --> 00:28:34,300
measures something like applying a proposed network architectures trying to reduce uh

328
00:28:34,300 --> 00:28:41,140
external access points so it's not as easy to just pull down maybe a uh presence detector and

329
00:28:41,140 --> 00:28:46,100
connecting it. Maybe also increase monitoring so that's like uh holistic measures,

330
00:28:46,100 --> 00:28:51,760
and of course for each protocol there is different uh possibilities out there to deploy security

331
00:28:51,760 --> 00:29:00,660
proxies uh or just restrict communication paths maybe something like uh uh line address

332
00:29:00,660 --> 00:29:10,700
filters for instance with the uh KNIX protocol. Is that everything? Uh unfortunately or

333
00:29:10,700 --> 00:29:16,080
fortunately not so what we really did is we looked at 2 specific protocols, the 18 Ouais we

334
00:29:16,100 --> 00:29:22,200
uh knixnet IP and BACnet IP because those systems are really widely deployed throughout

335
00:29:22,200 --> 00:29:27,260
different regions in the world. But there's many other technologies out there or protocols

336
00:29:27,260 --> 00:29:33,340
within building automation control systems that are definitely worthwhile to be explored. So

337
00:29:33,620 --> 00:29:38,860
uh I really hope you got an impression and you got an interest into uh looking into building

338
00:29:38,860 --> 00:29:45,660
automation control systems. If you have any questions that's the end of my presentation. Uh

339
00:29:45,660 --> 00:29:51,480
I'm glad you were here and uh I really would like to invite you to come over to the ICS

340
00:29:51,480 --> 00:29:55,680
Village. We have just great systems over there. If you have any questions I'll be happy to

341
00:29:55,680 --> 00:29:58,800
answer them just in the second next room over there. Thank you.