BACnet Security Issues and How to Mitigate Cyber Risks

BACnet is a commonly used protocol for building automation and operational technology (OT) systems, and is used to establish communication between various devices in a network. Because BACnet-based building systems were originally deployed in isolated (air-gapped) environments, BACnet was not designed with security. Therefore, millions of BACnet devices are lacking common security mechanisms such as user authorization, device authentication, and data encryption. This makes BACnet devices inherently unsecure and vulnerable to attacks.

BACnet Security Issues and Vulnerabilities

Here are several security issues associated with BACnet (most apply to BACnet/IP and BACnet MS/TP):

Lack of Authentication: BACnet lacks strong authentication mechanisms, allowing unauthorized access to devices and systems. This can lead to unauthorized control or manipulation of critical infrastructure.

Lack of Encryption: BACnet lacks encryption, meaning that data transmitted over the network is vulnerable to eavesdropping and interception. Attackers can gain access to sensitive information and potentially manipulate or disrupt the control system.

Default Configurations: Many BACnet devices are shipped with default configurations and default passwords that are well-known and easily exploitable. Failure to change these defaults increases the risk of unauthorized access.

Lack of Authorization: BACnet devices often lack granular authorization mechanisms, making it difficult to control and restrict access to specific functions or objects. This can result in unauthorized manipulation or disruption of building operation.

Vulnerable Firmware: BACnet devices may run outdated or vulnerable firmware versions, exposing them to known security vulnerabilities. Without regular firmware updates and security patches, these devices remain at risk.

Lack of Logging and Monitoring: BACnet devices may not provide sufficient logging and monitoring capabilities. This makes it difficult to detect and respond to suspicious activities, such as unauthorized access attempts or unusual data patterns.

Denial of Service (DoS) Attacks: BACnet implementations can be vulnerable to DoS attacks, where an attacker floods the target device or network with excessive requests, rendering it unresponsive and disrupting building operations.

Man-in-the-Middle Attacks: In the absence of encryption or weak authentication, BACnet communications can be intercepted by attackers who position themselves between the communicating devices. This allows them to manipulate or eavesdrop on the data flow.

Protocol Vulnerabilities: BACnet may have inherent vulnerabilities in its design and implementation, such as buffer overflows or input validation issues. Exploiting these vulnerabilities can lead to remote code execution or system crashes.

Command Injection: BACnet devices may be vulnerable to command injection attacks. If input validation is not properly implemented, an attacker can inject malicious commands into the device, leading to unauthorized control or manipulation of the system.

Replay Attacks: BACnet communications may lack mechanisms to prevent replay attacks. Attackers can capture and replay legitimate network traffic to perform unauthorized actions, impersonate valid users, or disrupt system operations.

Insecure Remote Access: BACnet devices often provide remote access capabilities without adequate security measures. Weak or unsecured remote access mechanisms can be exploited by attackers to gain unauthorized access to the devices or network.

Insider Threats: Insider threats pose a significant risk in BACnet environments. Unauthorized or disgruntled employees with access to the system can misuse their privileges to sabotage operations, steal sensitive data, or cause disruptions.

Physical Security: BACnet devices are often deployed in areas that are susceptible to physical security breaches. Unauthorized physical access to devices can allow attackers to tamper with the equipment, extract sensitive information, connect to the building network, or disrupt operations.

Lack of Security Awareness: Insufficient security awareness among system administrators, operators, and employees can lead to inadvertent security breaches. Lack of knowledge about security best practices, such as password hygiene or social engineering, can result in successful attacks.

Vendor-specific Vulnerabilities: BACnet devices from different vendors may have their own unique vulnerabilities. These vulnerabilities can stem from implementation flaws, insecure default settings, or inadequate testing and quality assurance processes.

Lack of Network Segregation: Inadequate network segregation between BACnet devices and other network segments can increase the attack surface. A compromised device or network segment can potentially impact other critical systems or expose them to additional vulnerabilities.

Supply Chain Attacks: BACnet devices may be susceptible to supply chain attacks, where attackers compromise the devices or their firmware during manufacturing, distribution, or software updates. This can introduce backdoors or other malicious functionalities into the devices.

Mitigating BACnet Security Risks

It is important to address these security issues by implementing best practices, such as:

• regular security assessments
• strong authentication
• encryption
• regular firmware updates
• access controls
• employee training
• continuous monitoring

Segmenting the building automation network from the IT network is also recommended, and BACnet/SC is available for new deployments. There are still risks even with these actions, and always weaknesses when it comes to employees continually following procedures and best practices.

Zero Trust for BACnet Security

One way to overcome these risks is to have automatic, device-level protection providing security 24×7 and stopping cyberattacks before they happen. Veridify’s DOME platform can prevent most of the above attack vectors.

DOME has the following capabilities:

• Real-time protection that blocks communication from unauthorized devices
• Device authentication with a NIST-compliant, Zero Trust framework
• Protection for existing BACnet/IP and BACnet MS/TP devices
• Enables existing BACnet/IP devices to participate in a BACnet/SC domain
• Automates BACnet SC certificate management, enabling frequent updating of certificates
• Creates secure communication tunnels between devices and encrypts all traffic

Learn more about DOME for Building Automation and Smart Building

Contact Us  |  Request a Demo

—
Blog Post Summary – All of our posts listed on one page back through 2019

See the slides below for additional information about DOME and Cybersecurity for Building Controls and Smart Buildings.