Vulnerable Wireless Building Controls

Never-configured Wireless Building Controls (e.g. default credentials) leave room for malicious actors to access your Wireless Infrastructure. Many new pieces of equipment ship with two consoles: Ethernet and “Radio Ready” Consoles. You know about your Ethernet console, but is there another console on your equipment set up with default configuration? To learn more about discovering whether you have vulnerable wireless building controls operating in your environment, read our Bastille data sheets or request a Bastille demo.

Key Takeaways

• Wireless building control systems, lighting, HVAC, and power monitoring, often ship radio-enabled and unconfigured
• They frequently use protocols like Zigbee that are off the radar of IT teams focused on Wi-Fi
• Bastille has found data center chillers beaconing over Zigbee, looking for a partner to connect and configure
• Bridging an unvetted control-side protocol to the corporate network gives attackers a pivot past traditional defenses

Video Transcript

[MUSIC PLAYING] Hello, my name is Balint Seeber, and I'm the director of vulnerability research at Bastille. I'd like to talk to you about vulnerable wireless building control systems. These are systems that, generally, people don't interact with, and aren't actually aware they're operating in their building. So we're talking about lighting control systems, we're talking about HVAC, and other utility and power monitoring and control systems that essentially help modern buildings run.

Often, this new infrastructure comes radio-enabled, which means that they actually have a radio interface in the product, in the device, that will power up when you plug it in, and have it working within your infrastructure, which can often be critical. These radio devices often use protocols that won't commonly be on the radar of your IT professionals, so they might be looking at securing the Wi-Fi infrastructure.

But if there's some building control system that uses Zigbee, for instance, they might not be aware that it has not been configured, and needs to be configured so that it's actually completely secure, and you reduce your potential radio attack surface. There have been many examples that we've actually found, where there are chillers in data centers, for example, that are Zigbee enabled, and are our beaconing, looking for a partner to connect to and potentially configure the device.

So that's obviously something that you would not want to happen, at least not in an unauthorized fashion. Everything will be connected, especially through the internet. And as soon as you've got that notion of two different networks being bridged through some hub, there's the threat and the potential vulnerability, where if there's a protocol on the control side that has not been vetted, has not received the public scrutiny that other protocols have, there will be inevitable vulnerabilities. And we see this over and over again.

So an attacker would be able to then penetrate your internal corporate network, or your internal internet by actually pivoting from, say, the Zigbee network that's broadcasting from a chiller, or from an internet-enabled light bulb onto your corporate network. And that essentially bypasses all of the traditional security mechanisms that you have on your wired and wireless networks.

And this will continue to be a problem, as more and more products come onto the market that have not received the appropriate level of scrutiny as traditional security devices and networks have. Thanks very much for listening. If you'd like to learn more, please visit our website. [MUSIC PLAYING] PLAYING]