BMS is destroyed by "smart button"
summary
Claim: a device attached to KNX twisted pair — for example an ESP32 or a cheap serial transceiver — gives full field-side access allowing replay and DoS against actuators and sensors, reading traffic and stealing group/IP router settings. KNX topology supports up to 15 areas × 15 lines × 255 nodes; some IP routers accept 69-byte frames and pad <16-byte packets, and automation stations expose HTTP/FTP with default credentials and hard‑coded keys. An attacker can change node configuration, unlock doors, shut heating, and perform firmware update via KNX-TP to pivot into corporate networks because firmware lacks integrity checks.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04What is BMS
- 9:06Security flaws in KNX
- 12:45Attacking KNX networks
- 16:43Penetrating corporate networks
- 18:09Automation station vulnerabilities
- 21:30Default credentials risks
- 24:18Conclusions and improvements
- 25:51Q&A
related talks
46mD1T2 - Pwning KNX & ZigBee Networks
26mHacking buildings: Security flaws in embedded building control systems
40mSmart IoT: IoT Botnet Attacks on Power Grids Exploiting Their Weak Points
21mIndustrial IoT security issues and countermeasures
39mChoo Choo, Network Train - The One to Rule Your Perimeter
21mLearn How to Control Every Room at a Luxury Hotel Remotely
37mI Own Your Building (Management System)
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT