Zero-Day Vulnerabilities Leave Smart Buildings Open to Cyber Attacks
A team of researchers discovered six zero-day vulnerabilities in protocols and individual components used in smart buildings. The flaws could be used to steal sensitive information, access or delete critical files, or perform malicious actions.
The glitches range from cross-site scripting (XSS), and path traversal, to arbitrary file deletion, and authentication bypass. They were found in building automation devices such as programmable logic controllers (PLCs) and gateway protocols.
Aggregated data from two search engines for discovering computer hardware connected to the internet shows that thousands of devices affected by these vulnerabilities are exposed online.
To demonstrate that the risks in modern smart buildings are real, the researchers built proof-of-concept malware that targeted surveillance, access control, and HVAC systems set up in a laboratory.
A typical Building Automation System (BAS) network is larger than this, though, and comprises a variety of systems, like elevators, access control systems, video surveillance, HVAC, lighting, fire alarms, or energy producing systems.
This type of infrastructure is present not only in residential and commercial buildings but also in hospitals, airports, stadiums, schools or data centers.
Following security assessment and penetration testing standards, members of the OT Research team at ForeScout started to evaluate their targets.
They found three XSS vulnerabilities in the Access Control PLC and the protocol gateway, a component that allows connections over a specific protocol. It can be used to inject malicious scripts into the web interface running on the vulnerable devices, giving an attacker access to cookies and session tokens.
The protocol gateway component was also affected by a path traversal and an arbitrary file deletion vulnerability, which provide access to files (system included) and directories present outside the root folder of the web app running on the affected device.
Another vulnerability unknown to the vendor before the researcher’s reporting was in the HVAC PLC – an authentication bypass that permits stealing user credentials, “including plaintext passwords.”
Two other issues, a buffer overflow and hardcoded password, were discovered in the Access Control PLC from June 2013. However, the vendor was aware of them ahead of ForeScout’s disclosure and had released a patch.
