Hacking smart buildings

ZMsiXone · Sep 9, 2018

https://www.csoonline.com/article/3302367/security-infrastructure/hacking-smart-buildings.html

Forget about internet-connected toasters. Your "intelligent" office building is one giant, vulnerable IoT device.
... ... ...
Premise for a bad, low-budget Hollywood flick? More like a plausible scenario without adequate security mitigation. A new report from researchers at Edith Cowan University in Australia offers concrete recommendations on how to secure smart buildings.
Click to expand...

guest · Feb 20, 2019

Siegeware: When criminals take over your smart building
February 20, 2019
https://www.welivesecurity.com/2019/02/20/siegeware-when-criminals-take-over-your-smart-building/

“We have hacked all the control systems in your building at 400 Main Street and will close it down for three days if you not pay $50,000 in Bitcoin within 24 hours.”
The buildings all use something called a BAS or Building Automation System to remotely manage Heating, Air Conditioning, and Ventilation (HVAC), [...] and so on. As many as eight different systems may be remotely accessible.

Clearly, holding a building for ransom by leveraging its reliance upon software is now on the criminal agenda, part of the expanding arsenal of techniques for profiting from the abuse of technology.
To put it another way, siegeware is the code-enabled ability to make a credible extortion demand based on digitally impaired building functionality.

How widespread will the siegeware problem become in 2019? That will depend on several factors: how aggressively cases are investigated by law enforcement; how many victims refuse to pay; and how many targets of opportunity the bad actors can find.
Click to expand...

Right now, a criminal searching for a range of different BAS systems to target probably has close to 30,000 to choose from in the US alone.
Unless the defaults have been changed, and rate limiting on password attempts has been implemented, a motivated criminal will probably gain access.
Click to expand...

guest · Jun 6, 2019

A backdoor in Optergy tech could remotely shut down a smart building ‘with one click’
June 6, 2019
https://techcrunch.com/2019/06/06/optergy-backdoor-smart-building/

Homeland Security has given the maximum severity score for a vulnerability in a popular smart building automation system.
Optergy’s Proton allows building owners and managers to remotely monitor energy consumption and manage who can access the premises. The box is web-connected, and connects to other devices — like air conditioning and heating — in the building for real-time monitoring through a web interface.

Gjoko Krstic, a security researcher at Applied Risk who reported the vulnerabilities to Optergy, told TechCrunch that the bug was “very, very bad” and “easy to exploit.” According to Krstic, there are 50 buildings vulnerable at the time of writing.
By exploiting the vulnerability, it’s possible to “shut down a building with one click,” he said at his talk.

Optergy president Steve Guzelimian said the company fixed the issues but wouldn’t confirm how many devices were affected. The company says it serves more than 1,800 facilities.
Click to expand...

guest · Jun 12, 2019

Why cybercriminals are eyeing smart buildings
June 12, 2019
https://www.welivesecurity.com/2019/06/12/cybercriminals-eyeing-smart-buildings/

As part of the Segurinfo Argentina 2019 conference in Buenos Aires, ESET’s Global Security Evangelist Tony Anscombe gave a talk on smart buildings, in which he explained the security risks associated with intelligent buildings.

At first glance, we may not see any security risk in these smart buildings. It is likely, however, that at some point the entire smart network is connected to a single database, and that is where the risk is. Particularly if we consider that many IoT devices are manufactured by different suppliers, who may not have paid due attention to security considerations during their design and manufacturing process.

This means that someone could take control of a BAS after finding it through a search. If, for example, a criminal uses Shodan to search for building automation systems to attack, they will find IP addresses
Click to expand...

In conclusion, the low cost of IoT devices for buildings and the advances in technology for building automation systems is leading to changes with an impact on security.
As a result, the possibility of a cybercriminal launching a ransomware attack on a smart building is already a reality.
Click to expand...

Minimalist · Aug 13, 2019

HVACking: Remotely Exploiting Bugs in Building Control Systems

Security researchers have found a zero-day vulnerability in a popular building controller used for managing various systems, including HVAC (heating, ventilation, and air conditioning), alarms, or pressure level in controlled environments.
Click to expand...

https://www.bleepingcomputer.com/ne...-exploiting-bugs-in-building-control-systems/

guest · Aug 27, 2019

How smart buildings are the latest threat vector for cyberattacks
A rise in cyberattacks on smart buildings boosted the global IT/OT security market, reported a recent Frost & Sullivan report
August 27, 2019
https://www.techrepublic.com/articl...re-the-latest-threat-vector-for-cyberattacks/

As one of the top trends in 2019, smart city tech is sweeping the enterprise. Digitizing buildings is a major trend currently, however, this trend comes with a new security issues, according to Frost & Sullivan's IT/OT Security Convergence for Building Technologies report.

A smart building uses technology to create a safe and healthy environment for its occupants. It typically uses IT-aided intelligence, smart sensors and controls for real-time dissemination of operational information for predictive analytics and diagnostics to help manage the building and maintain it at optimal levels.
Smart buildings are essential to smart cities, but as the number of such buildings increase, so does the security risk.

Smart building technology is in its early stages of growth and adoption, leaving consumers unaware of the vast amount of security threats associated with the new tech, Krishnamoorthi said.
Click to expand...

guest · Feb 3, 2020

Hackers exploiting vulnerability in smart doors to launch DDoS attacks
February 3, 2020
https://www.hackread.com/hackers-exploiting-smart-doors-vulnerability-ddos-attacks/

Smart door and building access control systems are currently the top targets of hackers for launching distributed denial-of-service attacks or DDoS attacks, claims SonicWall.

According to the latest findings of the firewall company, attackers are primarily targeting a Nortek Security & Control (NSC) product called Linear eMerge E3, which is used in commercial environments such as corporate buildings, factories, and industrial parks to monitor the incoming and outgoiång visitors and employees.

However, the attacks against Smart door and building access control systems were first identified by a cyber-intelligence firm Bad Packets while the attacks were observed on 9th January, 2020. Since then, the number of attacks has increased as tens of thousands of devices are attacked per day in around 100 different countries. However, the majority of the affected users are located in the US.
Click to expand...

Log in or Sign up

Hacking smart buildings

ZMsiXone Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Log in or Sign up

Hacking smart buildings

ZMsiXone Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Useful Searches