Hacking buildings: Security flaws in embedded building control systems
summary
Finds the same systemic flaws over 11 years: unauthenticated plain‑text XML/HTTP, weak session IDs and ARP spoof knocks out controllers so server‑room HVAC fails, an auth bypass that lets a new user be created before login, and a UDP sync packet that UDP broadcast leaks credentials across all controllers. Fuzzing an embedded FTP service causes a buffer overflow that FTP buffer overflow triggers chain reaction to other units. Thousands of devices are exposed on Shodan — thousands exposed on Shodan — and many are already compromised by crypto‑mining or remote tampering.
AI-written summary · about
chapters (16)
- 0:00Building control hacks intro
- 1:25What is a BMS
- 3:11BMS security flaws over time
- 6:43Hacking IQ3 controller
- 9:14Authentication bypass flaws
- 11:47Buffer overflow attacks
- 13:15Why flaws still matter
- 15:20Finding exposed BMS devices
- 16:22Other vulnerable systems
- 17:27HVAC breaches in real world
- 18:30Vendor vs installer responsibility
- 19:14Toy and device security flaws
- 21:58Regulation and commercial pressure
- 23:24Smartwatch and IoT privacy
- 24:07US IoT security guidance
- 24:49Call for IoT regulation
related talks
37mI Own Your Building (Management System)
44mNight of the living vulnerabilities
39mNight of the living vulnerabilities
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
31mHacking Everything – The Dark Side of the Internet of Things
58mWhy Control System Cyber-Security Sucks…
39mVulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
45mOutside the box: pwning IoT devices through their applications