Smart Buildings are the new target for cybercriminals
Juan Manuel Harán, Security Editor at ESET, who also writes for company’s official blog welivesecurity.com looks at the key security challenges facing intelligent buildings.
As part of the Segurinfo Argentina 2019 conference in Buenos Aires, ESET’s Global Security Evangelist Tony Anscombe gave a talk on smart buildings, in which he explained the security risks associated with intelligent buildings. Let’s cut to the nitty-gritty of his interesting talk.
In countries like the United States, the growth of smart buildings is estimated to reach 16.6% by 2020 compared to 2014, although this expansion is not limited to the US but rather is taking place on a global scale. This growth is largely due to the fact we live in a world increasingly permeated by technology, in which process automation and the search for energy efficiency contribute not only to sustainability, but also to cost reduction – a goal pursued in all industries, public and private sector alike. Naturally, the construction industry is no exception.
Smart buildings use technology to control a wide range of variables within their respective environments with the aim of providing more comfort and contributing to the health and productivity of the people inside them. To do so, they use so-called Building Automation Systems (BAS). With the arrival of the Internet of Things (IoT), smart buildings have redefined themselves. With the information they obtain from smart sensors, their technological equipment is used to analyze, predict, diagnose and maintain the various environments within them, as well as to automate processes and monitor numerous operational variables in real time. Ambient temperature, lighting, security cameras, elevators, parking and water management are just some of the automatable services currently supported by the technology.
To put the possibilities of this smart infrastructure into perspective, Tony gave the example of a hotel in Las Vegas where, two years ago, they decided to install a sophisticated automation system to control the use of the air conditioning (keeping in mind that Las Vegas has a hot desert climate and very little rain), so it is turned on only when there are people present. This decision led to savings of US$2 million during the first year after the smart system was installed, due to the reduction in energy consumption achieved by automating the process. Marriott Hotels implemented a similar system across the entire chain that is expected to generate an estimated US$9.9 million in energy savings.
Another example of automation through smart devices that Tony mentioned was that of a supermarket in the United Kingdom. The store installed a smart system in its parking lot that generates kinetic energy from the movement of cars passing through it, and then uses that energy to power the checkouts.
At first glance, we may not see any security risk in these smart buildings. It is likely, however, that at some point the entire smart network is connected to a single database, and that is where the risk is. Particularly if we consider that many IoT devices are manufactured by different suppliers, who may not have paid due attention to security considerations during their design and manufacturing process. And while many of us might think we will never live in a building like this, Tony noted that “it is likely that many of the people who do not live in a building with these features will do so at some point,” since the market for smart buildings that use the IoT is rapidly growing.
Probability of a smart building being attacked
The risk of a security incident taking place in an intelligent building is linked to the motivations of cybercriminals, who mainly seek to achieve economic gain through their actions, as well as make an impact and spread fear.
There are already some tools such as Shodan that allow anybody to discover vulnerable and/or unsecured IoT devices connected publicly to the internet. As Tony explained, if you run a search using this tool, you can find thousands of building automation systems in its lists, complete with information that could be used by an attacker to compromise a device. In February 2019, around 35,000 building automation systems worldwide appeared in Shodan within public reach via the internet.
This means that someone could take control of a BAS after finding it through a search. If, for example, a criminal uses Shodan to search for building automation systems to attack, they will find IP addresses.
If they copy those IP addresses into the address bar of a web browser, in many cases this will bring up an interface for gaining access, where they need to enter a username and password. If the password is a default password or if it can be cracked easily through a brute force attack, the attacker will gain access to the system monitoring panel, which contains information similar to the details visible to the companies located in the smart building.
Once the attackers have access to this public information and can monitor, for example, how the air conditioning works, they could make a phone call pretending to be from the maintenance company and say they are going to send a technician because they noticed the fans are running at maximum capacity. At the same time, the attackers could request remote access, which would give them access to the server and allow them to control the building. Once they have control, they could alter the building’s heating or air conditioning systems, or adjust the way any of the other automated systems operate, and then demand payment of a ransom in using a system that allows them to remain anonymous, such as cryptocurrency, in exchange for not shutting the building down.
Siegeware: A very real threat
In an article that walks us through the details of a cyberattack against a smart building, ESET’s Senior Security Researcher Stephen Cobb noted that this kind of attack is not an isolated event. After he asked the authorities for assistance following one such incident, to his surprise they told him that “they had already seen this before”. In other words, cybercriminals are already carrying out such attacks when they have the opportunity. Stephen succinctly describes this kind of attack as siegeware, or “the code-enabled ability to make a credible extortion demand based on digitally impaired building functionality”.
In conclusion, the low cost of IoT devices for buildings and the advances in technology for building automation systems is leading to changes with an impact on security. This drive toward automation and the use of smart devices to gather data – in order to give a building’s users more comfort and to make more efficient use of resources such as energy – is also leading to increased security risks. As a result, the possibility of a cybercriminal launching a ransomware attack on a smart building is already a reality.
