McAfee warns of serious security flaw in building controller

guest · Aug 9, 2019

McAfee warns of serious security flaw in building controller
Security researchers have demonstrated how simple flaws in building controllers could allow malicious actors to manipulate control systems with devastating effect
August 9, 2019
https://www.computerweekly.com/news...-serious-security-flaw-in-building-controller

McAfee researchers have demonstrated how a vulnerability in a commonly used industrial control system from Delta Controls could allow malicious actors to take complete control of the operating system.
Successful exploitation of the flaw could enable attackers to manipulate control systems in boiler rooms, temperature controls for critical systems and more, the researchers said, urging building management teams to ensure potentially vulnerable systems are patched up to date.
eBMGR lets attackers in
However, from a cyber attacker’s point of view, the eBMGR is a potential single point of failure attached to a network, according to Mark Bereza, a security researcher at McAfee Advanced Threat Research.

Under testing, McAfee researchers discovered the buffer overflow vulnerability, a “seemingly innocuous mistake” that rendered the eBMGR “vulnerable to our carefully crafted network attack, which allows a hacker on the same network to gain complete control of the device’s operating system”, he wrote in a blog post.
Click to expand...

guest · Aug 13, 2019

BACnet IoT building automation devices vulnerable to attack
August 13, 2019
https://www.computerweekly.com/news...lding-automation-devices-vulnerable-to-attack

An independent security researcher has highlighted another vulnerability in building control systems that could be exploited by cyber attackers and has not been patched by manufacturers.

The focus of the latest research is the BACnet data communication protocol for building automation and control networks that is widely used in internet-connected devices in industrial and commercial properties.
The vulnerability can be used to modify the web application code by injecting JavaScript code in the Bacnet device, abusing the read/write properties from the Bacnet protocol itself, he told attendees of the IoT Village at the DEF CON security conference in Las Vegas.

“It opens a new door for remote attacks without touching or interacting with the web application in those devices. The attacker only needs an insecure building automation protocol to modify the data.”
Click to expand...

Log in or Sign up

McAfee warns of serious security flaw in building controller

guest Guest

guest Guest

Log in or Sign up

McAfee warns of serious security flaw in building controller

guest Guest

guest Guest

Useful Searches