How to Hack a ‘Smart’ Building

Wednesday, March 28, 2018 @ 03:03 PM gHale

Building automation is a great frontier for hackers wanting to get into a facility and wreak havoc.

With today’s technology, there is no doubt there are those living, staying or working in smart buildings that rely on automated processes to control heating, ventilation, air conditioning, lighting, security and other operation systems.

IT Pros Aware of IoT attacks, But That is It
Energy Suffers Most ICS Malware Attacks: Report
Incident Response Plans Still Lacking: Study
Attacks Hike with Geopolitical Events: Report

Users expect those systems to work with no problem whatsoever, but what comes into play is the security of these systems is still far from perfect.

Along those lines, a group of researchers from Tencent Security Platform will show imperfections at the Hack in the Box Conference next month.

Yong Yang, HuiYu Wu and YuXiang Li of the Tencent Blade Team have concentrated on probing KNX, a network communications protocol for building automation that is often used in large public places (stadiums, hotels, airports) and industrial facilities, and Zigbee, communication protocol widely used in home automation systems.

“We found a new attack method where we can modify the KNX / IP router configuration and without affecting the normal use of the entire original KNX network equipment,” the researchers said in a post. “The attack allows us to eavesdrop on KNX network traffic, or directly denied service to the entire network.”

They’ve come up with a new attack method to take control of KNX network components and use that access to tamper with them.

With the development Internet-of-Things, ZigBee is a major communication protocol widely used in home automation systems, the teams said.

In order to allow users to more easily extend the ZigBee devices, manufacturers have taken a compatible approach to allow devices connect between different vendors. Additionally, high market competitiveness leads to short development cycle, pushing aside security requirements. Indeed, the ZigBee 3.0 standard includes stronger security with encryption, however, many manufacturers do not use this standard.

“We will show the security results of multiple real-world ZigBee devices manufacturers,” the team said. “We will also demo an attack using only an official and cheap mainstream device and show that taking over a full ZigBee network is possible.”

Leave a Reply

You must be logged in to post a comment.