BASICS BACnet is short for Building Automation and Control
Network BACnet developed started in 1985, was adopted by ASHRAE in
1995, and is now a major component of most Building Automation
systems. Basically, its a protocol used for control, monitoring,
and interoperability for automation systems used in buildings
BACnet controllers are basically PLCs, controlling HVAC, Lighting,
Security, and other systems you will find in large buildings BACnet
networks are complicated and strange for IT folks. More in a few.
Like nearly every ICS protocol, BACnet is also insecure by design
It supports encryption It does, 56-Bit DES. Is this really
encryption anymore? You can also set a password. Maybe. Kinda, its
like 6 characters with no logging, and doesnt protect against most
bacnet commands Basi.. Sknnnnzzzz.
Slide 4
WE APOLOGIZE FOR THE FAULT IN THE SUBTITLES.. THOSE RESPONSIBLE
HAVE BEEN SACKED
Slide 5
PRIOR ART @WarezJoe - ShmooCon 2013: How To Own A Building:
Exploiting the Physical World With Bacnet -
http://www.youtube.com/watch?v=d3jtmv6Y9ukhttp://www.youtube.com/watch?v=d3jtmv6Y9uk
Redpoint Bacnet Discovery NSE -
http://www.digitalbond.com/blog/2014/03/26/redpoint-discover-enumerate-
bacnet-devices/ Dis presentation needs more goats
Slide 6
A BACNET CONTROLLER Ethernet Port Universal Inputs RS485 Analog
Outputs Digital Inputs POWAH! RS232!
Slide 7
OTHER BACNET DEVICE I tells him to Pressy the butensies!! Press
them!!! He does not.
Slide 8
BACNET NETWORKS
Slide 9
BACNET OBJECTS
Slide 10
CHARACTERISTICS OF BACNET PACKETS ADD WIREHSHARK CAPTURE UDP
47808
Slide 11
WHAT YOU NEED TO COMMUNICATE You need: 1.An Instance ID An ID
that uniquely identifies a device 2.Network ID Think of it like a
subnet, allows separation of groups of devices 3.The Object A
Logical construct holding the data you want After that, you can
make a request to a Specific Device on a Specific Network.
Slide 12
CHARACTERISTICS OF BACNET PACKETS Object-Name Request Magic
Number 0x810A
Slide 13
CHARACTERISTICS OF BACNET PACKETS Magic Number 0x810A
Object-Name Response
Slide 14
INTERESTING THINGS TO DO WITH BACNET
REGISTER_FOREIGN_DEVICE()
Slide 15
FOREIGN DEVICE REGISTRATION
Slide 16
59 WILL GET YOU 505 Potential Issues: 1.Requires Spoofing
2.Requires ability to change port numbers.
Slide 17
LOTS OF BACNET ON THE NET
Slide 18
FOCUSED ON THE BACNET NETWORK This opinion is shortsighted.
Heres why.
Slide 19
CONCLUSION Why BACNET? Cause I work on Critical Infrastructure,
and its nice to pwn something that I dont get yelled at for owning.
Cause its interesting, and fun, and gets me some attention to
demonstrate I know what Im doing. Cause it can have some
interesting consequences for owners and others. Why not? Its still
ICS
Slide 20
QUESTIONS? Thanks, Mike Heh. Goatsies. Always End with
Goatsies.
