On building automation system security

Abstract

Building Automation Systems (BASs) are seeing increased usage in modern society due to the plethora of benefits they provide such as automation for climate control, HVAC systems, entry systems, and lighting controls. Many BASs in use are outdated and suffer from numerous vulnerabilities that stem from the design of the underlying BAS protocol. In this paper, we provide a comprehensive, up-to-date survey on BASs and attacks against seven BAS protocols including BACnet, EnOcean, KNX, LonWorks, Modbus, ZigBee, and Z-Wave. Holistic studies of secure BAS protocols are also presented, covering BACnet Secure Connect, KNX Data Secure, KNX/IP Secure, ModBus/TCP Security, EnOcean High Security and Z-Wave Plus. LonWorks and ZigBee do not have security extensions. We point out how these security protocols improve the security of the BAS and what issues remain. A case study is provided which describes a real-world BAS and showcases its vulnerabilities as well as recommendations for improving the security of it. We seek to raise awareness to those in academia and industry as well as highlight open problems within BAS security.

Keywords

Building automation system / BAS protocols / Security / Attack

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Acknowledgments

This research was supported in part by US National Science Foundation awards (2325451, 1931871, and 1915780), and US Department of Energy Award (DE-EE0009152), and Anhui University of Technology, China (QD202368-DT2300002594). Any opinions, findings, conclusions, and recommendations in this paper are those of the authors and do not necessarily reflect the views of the funding agencies.

References

[1] I.B. de Brito, R.T. de Sousa Jr., Development of an open-source testbed based on the modbus protocol for cybersecurity analysis of nuclear power plants, Appl. Sci. 12 (15) (2022) 7942.

[2] N. Kraus, M. Viertel, O. Burgert, Control of KNX devices over IEEE 11073 service-oriented device connectivity, in: 2020 IEEE Conference on Industrial Cyberphysical Systems, Vol. 1, ICPS, IEEE, 2020.

[3] P. Amaro, R. Cortesão, J. Landeck, P. Santos, Implementing an advanced meter reading infrastructure using a z-wave compliant wireless sensor network, in:Proceedings of the 2011 3rd International Youth Conference on Energetics, IYCE, IEEE, 2011.

[4] I.-V. Sita, P. Dobra, KNX building automations interaction with city resources management system, Proc. Technol. 12 (2014).

[5] D.-F. Pang, S.-L. Lu, Q.-Y. Zhu, Design of intelligent home control system based on KNX/EIB bus network, in: 2014 International Conference on Wireless Communication and Sensor Network, IEEE, 2014.

[6] BACnet International, Research study indicates bacnet global market share over 60%, 2023, https://bacnet.org/press-releases/research-study-indicates-bacnet-global-market-share-over-60/.

[7] L. Mathews, Hackers use ddos attack to cut heat to apartments, 2021, "https://www.forbes.com/sites/leemathews/2016/11/07/ddos-attack-leaves-finnish-apartments-without-heat/?sh=7cfc8dfa1a09".

[8] Limes Security, KNXlock - An attack campaign against KNX-based building automation systems, 2021, "https://limessecurity.com/en/knxlock/".

[9] K.J. Higgins, Lights out: Cyberattacks shut down building automation systems, 2021, "https://www.darkreading.com/attacks-breaches/lights-out-cyberattacks-shut-down-building-automation-systems".

[10] T. Seals, China-backed APT pwns building automation systems with ProxyLogon, 2021, "https://www.darkreading.com/attacks-breaches/china-backed-apt-pwns-building-automation-proxylogon".

[11] W. Granzer, W. Kastner, G. Neugschwandtner, F. Praus, Security in networked building automation systems, in: 2006 IEEE International Workshop on Factory Communication Systems, IEEE, 2006.

[12] A. Antonini, A. Barenghi, G. Pelosi, S. Zonouz, Security challenges in building automation and SCADA, in: 2014 International Carnahan Conference on Security Technology, ICCST, IEEE, 2014.

[13] M.A.B. Karnain, Z.B. Zakaria, A review on ZigBee security enhancement in smart home environment, in: 2015 2nd International Conference on Information Science and Security, ICISS, IEEE, 2015, pp. 1-4.

[14] T. Mundt, P. Wickboldt, Security in building automation systems-a first analysis, in: 2016 International Conference on Cyber Security and Protection of Digital Services, Cyber Security, IEEE, 2016.

[15] A. Humayed, J. Lin, F. Li, B. Luo, Cyber-physical systems security—A survey, IEEE Internet Things J. 4 (6) (2017) 1802-1831.

[16] R. Krejčí, O. Hujňák, M. Švepeš, Security survey of the IoT wireless protocols, in: 2017 25th Telecommunication Forum, TELFOR, IEEE, 2017.

[17] D. Celebucki, M.A. Lin, S. Graham, A security evaluation of popular internet of things protocols for manufacturers, in: 2018 IEEE International Conference on Consumer Electronics, ICCE, IEEE, 2018.

[18] D. Mocrii, Y. Chen, P. Musilek, IoT-based smart homes: A review of system architecture, software, communications, privacy and security, Internet Things 1 (2018).

[19] P. Ciholas, A. Lennie, P. Sadigova, J.M. Such, The security of smart buildings: A systematic literature review, 2019, arXiv preprint arXiv: 1901.05837.

[20] L. Li, P. Podder, E. Hoque, A formal security analysis of ZigBee (1.0 and 3.0),in:Proceedings of the 7th Symposium on Hot Topics in the Science of Security, 2020, pp. 1-11.

[21] E. Lee, Y.-D. Seo, S.-R. Oh, Y.-G. Kim, A survey on standards for interoperability and security in the internet of things, IEEE Commun. Surv. Tutor. 23 (2) (2021) 1020-1047.

[22] V. Graveto, T. Cruz, P. Simöes, Security of building automation and control systems: Survey and future research directions, Comput. Secur. 112 (2022) 102527.

[23] L.P. Rondon, L. Babun, A. Aris, K. Akkaya, A.S. Uluagac, Survey on enterprise internet-of-things systems E-IoT: A security perspective, Ad Hoc Netw. 125 (2022) 102728, [Online]. Available: https://www.sciencedirect.com/science/article/pii/S1570870521002171.

[24] H.M. Rouzbahani, H. Karimipour, E. Fraser, A. Dehghantanha, E. Duncan, A. Green, C. Russell, Communication layer security in smart farming: A survey on wireless technologies, 2022, arXiv preprint arXiv:2203.06013.

[25] G. Li, L. Ren, Y. Fu, Z. Yang, V. Adetola, J. Wen, Q. Zhu, T. Wu, K.S. Candan, Z. O’Neill, A critical review of cyber-physical security for building automation systems, Annu. Rev. Control (2023).

[26] Siemens, Desigo CC - better. Of course, 2024, https://www.siemens.com/global/en/products/buildings/automation/desigo/building-management/desigo-cc.html.

[27] ASHRAE Special Publications, ANSI/ASHRAE Standard 135-2020, Rep. Tech., ASHRAE, 2020.

[28] KNX Standard Specifications, 2.1 ed., KNX, 2013.

[29] Introduction to the LonWorks System, 1.0 ed., Echelon Corporation, 1999.

[30] Modbus Application Protocol Specification, Modbus Organization, 2012, v1.1b3.

[31] ZigBee Alliance, ZigBee Specification, ZigBee, 2015, 05-3474-21.[On-line]. Available: https://zigbeealliance.org/wp-content/uploads/2019/11/docs-05-3474-21-0csg-zigbee-specification.pdf.

[32] Z-Wave Device Class Specification, Z-Wave Alliance, Beaverton, United States, 2021.

[33] EnOcean Sustainable IoT, Radio technology, 2021, https://www.enocean.com/en/technology/radio-technology/.

[34] M. Zeng, A review of smart buildings protocol and systems with a consideration of security and energy awareness, in: 13th International Green and Sustainable Computing Conference, IGSC, IEEE, 2022.

[35] T. Yimer, E. Smith, P. Harvey, M. Tienteu, K. Kornegay, Error correction attacks on BACnet MS/tp, in: 2022 IEEE International Symposium on Hardware Oriented Security and Trust, HOST, 2022, pp. 77-80.

[36] D.G. Holmberg, 2003, [Online]. Available: https://search.proquest.com/openview/11de4f48550d34fec12de2d8aab2a273/1?pq-origsite=gscholar&cbl=41118.

[37] D. Schneider, W. Przybilla, ERNW newsletter 49/August 2015, 2015, https://ernw.de/download/ERNW_Newsletter_49_SecurityOfHomeAutomationSystems_signed.pdf.

[38] C. Schwaiger, A. Treytl, Smart card based security for fieldbus systems, in: EFTA 2003. 2003 IEEE Conference on Emerging Technologies and Factory Automation. Proceedings (Cat. No.03TH8696), vol. 1, 2003, pp. 398-406.

[39] D.-G. Akestoridis, P. Tague, HiveGuard: A network security monitoring architecture for Zigbee networks, in: 2021 IEEE Conference on Communications and Network Security, CNS, IEEE, 2021.

[40] S. Khanji, F. Iqbal, P. Hung, ZigBee security vulnerabilities: Exploration and evaluating, in: 2019 10th International Conference on Information and Communication Systems, ICICS, IEEE, 2019.

[41] O. Olawumi, K. Haataja, M. Asikainen, N. Vidgren, P. Toivanen, Three practical attacks against ZigBee security: Attack scenario definitions, practical experiments, countermeasures, and lessons learned, in: 2014 14th International Conference on Hybrid Intelligent Systems, IEEE, 2014, 2014, pp. 199-206.

[42] X. Cao, D.M. Shila, Y. Cheng, Z. Yang, Y. Zhou, J. Chen, Ghost-in-Zigbee: Energy depletion attack on Zigbee-based wireless networks, IEEE Internet Things J. 3 (5) (2016) 816-829.

[43] J. Ďurech, M. Franeková, Security attacks to ZigBee technology and their practical realization, in: 2014 IEEE 12th International Symposium on Applied Machine Intelligence and Informatics, SAMI, IEEE, 2014, pp. 345-349.

[44] P. Radmand, M. Domingo, J. Singh, J. Arnedo, A. Talevski, S. Petersen, S. Carlsen, ZigBee/ZigBee PRO security assessment based on compromised cryptographic keys, in: 2010 International Conference on P2P, Parallel, Grid, Cloud and Internet Computing, IEEE, 2010, pp. 465-470.

[45] W. Razouk, G.V. Crosby, A. Sekkaki, New security approach for ZigBee weaknesses, Procedia Comput. Sci. 37 (2014) 376-381.

[46] G. Kambourakis, C. Kolias, D. Geneiatakis, G. Karopoulos, G.M. Makrakis, I. Kounelis, A state-of-the-art review on the security of mainstream IoT wireless PAN protocol stacks, Symmetry 12 (4) (2020) 579.

[47] C.W. Badenhop, S.R. Graham, B.E. Mullins, L.O. Mailloux, Looking under the hood of Z-wave: Volatile memory introspection for the ZW0301 transceiver, ACM Trans. Cyber-Phys. Syst. 3 (2) (2018).

[48] C.W. Badenhop, B.W. Ramsey, B.E. Mullins, L.O. Mailloux, Extraction and analysis of non-volatile memory of the ZW0301 module, a Z-wave transceiver, Digit. Investig. 17 (2016).

[49] K. Kim, K. Cho, J. Lim, Y.H. Jung, M.S. Sung, S.B. Kim, H.K. Kim, What’s your protocol: Vulnerabilities and security threats related to Z-Wave protocol, Pervasive Mob. Comput. 66 (2020) 101211.

[50] D.G. Holmberg, Bacnet wide area network security threat assessment, 2003, [Online]. Available: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=916765.

[51] M. Bashendy, S. Eltanbouly, A. Tantawy, A. Erradi, Design and implementation of cyber-physical attacks on modbus/tcp protocol, in:World Congress on Industrial Control Systems Security, WCICSS, 2020.

[52] P. Morgner, S. Mattejat, Z. Benenson, C. Müller, F. Armknecht, Insecure to the touch: Attacking ZigBee 3.0 via touchlink commissioning,in:Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2017, pp. 230-240.

[53] C. Vacherot, Sneak into buildings with KNXnet/IP, in: Sneak Into Buildings with KNXnet/IP, 2020.

[54] X. Wang, S. Hao, Don’t kick over the beehive: Attacks and security analysis on Zigbee,in:Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2857-2870.

[55] C.K. Nkuba, S. Kim, S. Dietrich, H. Lee, Riding the IoT wave with VFuzz: Discovering security flaws in smart homes, IEEE Access 10 (2021).

[56] J.L. Hall, A Practical Wireless Exploitation Framework for Z Wave Networks, Tech. Rep., AIR FORCE INSTITUTE OF TECHNOLOGY WRIGHT-PATTERSON AFB OH WRIGHT-PATTERSON ..., 2016.

[57] J. Kaur, J. Tonejc, S. Wendzel, M. Meier, Securing BACnet’s pitfalls, in:ICT Systems Security and Privacy Protection: 30th IFIP TC 11 International Conference, SEC 2015, Hamburg, Germany, May 26-28, 2015, Proceedings 30, Springer, 2015, pp. 616-629.

[58] K. Lamshöft, J. Dittmann, Assessment of hidden channel attacks: Targetting modbus/tcp, IFAC-PapersOnLine 53 (2) (2020) 11100-11107.

[59] M. Qianqian, B. Kejin, Security analysis for wireless networks based on ZigBee, in: 2009 International Forum on Information Technology and Applications, vol. 1, IEEE, 2009, pp. 158-160.

[60] M. Ibrahim, I. Nabulsi, Security analysis of smart home systems applying attack graph, in: 2021 Fifth World Conference on Smart Trends in Systems Security and Sustainability (WorldS4), IEEE, 2021.

[61] W. Granzer, F. Praus, W. Kastner, Security in building automation systems, Ind. Electron., IEEE Trans. 57 (2010) 3622-3630.

[62] X. Fan, F. Susan, W. Long, S. Li, Security analysis of Zigbee, MWR InfoSecurity 2017 (2017) 1-18.

[63] B. Yang, Study on security of wireless sensor network based on ZigBee standard, in: 2009 International Conference on Computational Intelligence and Security, vol. 2, IEEE, 2009, pp. 426-430.

[64] D.-G. Akestoridis, M. Harishankar, M. Weber, P. Tague, Zigator: Analyzing the security of zigbee-enabled smart homes,in:Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2020, pp. 77-88.

[65] N. Boucif, F. Golchert, A. Siemer, P. Felke, F. Gosewehr, Crushing the wave-new Z-wave vulnerabilities exposed, 2020, arXiv preprint arXiv: 2001.08497.

[66] D. Cheng, P. Felke, F. Gosewehr, Y. Peng, S0-no-more: A Z-wave NonceGet denial of service attack utilizing included but offline nodeids, 2022, arXiv preprint arXiv:2205.00781.

[67] M. Cash, C. Morales-Gonzalez, S. Wang, X. Jin, A. Parlato, J. Zhu, Q.Z. Sun, X. Fu, On false data injection attack against building automation systems, in: 2023 International Conference on Computing, Networking and Communications, ICNC, IEEE, 2023, pp. 35-41.

[68] A. Camek, F. Hölzl, D. Bytschkow, Providing security to a smart grid prosumer system based on a service oriented architecture in an office environment, in: 2013 IEEE PES Innovative Smart Grid Technologies Conference, ISGT, IEEE, 2013, pp. 1-7.

[69] J. Molina, Learn how to control every room at a luxury hotel remotely: The dangers of insecure home automation deployment, Black Hat USA (2014).

[70] L. Rajesh, P. Satyanarayana, Detection and blocking of replay, false command, and false access injection commands in scada systems with modbus protocol, Secur. Commun. Netw. 2021 (2021).

[71] W. Alsabbagh, S. Amogbonjaye, D. Urrego, P. Langendörfer, A stealthy false command injection attack on Modbus based SCADA systems, in: 2023 IEEE 20th Consumer Communications & Networking Conference, CCNC, IEEE, 2023, pp. 1-9.

[72] J. Wright,Killerbee: Practical Zigbee exploitation framework,in:11th ToorCon Conference, San Diego, vol. 67, 2009.

[73] C.W. Badenhop, A Multifaceted Security Evaluation of Z Wave, a Proprietary Implementation of the Internet of Things, Tech. Rep., AIR FORCE INSTITUTE OF TECHNOLOGY WRIGHT-PATTERSON AFB OH WRIGHT-PATTERSON ..., 2017.

[74] B. Fouladi, S. Ghanoun, Security evaluation of the Z-Wave wireless protocol, Black hat USA 24 (2013) 1-2.

[75] V. Graveto, T. Cruz, P. Simöes, Security of building automation and control systems: Survey and future research directions, Comput. Secur 112 (2022) 102527, [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167404821003515.

[76] T. Feng, Y. Wu, Formal security analysis and improvement based on LonTalk authentication protocol, Secur. Commun. Netw. 2022 (2022) 8104884, http://dx.doi.org/10.1155/2022/8104884.

[77] C. Parian, T. Guldimann, S. Bhatia, Fooling the master: Exploiting weaknesses in the modbus protocol, Procedia Comput. Sci. 171 (2020) 2453-2458.

[78] N. Hussein, A. Nhlabatsi, Living in the dark: MQTT-based exploitation of IoT security vulnerabilities in ZigBee networks for smart lighting control, IoT 3 (4) (2022) 450-472.

[79] C.W. Badenhop, S.R. Graham, B.W. Ramsey, B.E. Mullins, L.O. Mailloux, The Z-Wave routing protocol and its security implications, Comput. Secur. 68 (2017) 112-129.

[80] F. Praus, W. Kastner, Identifying unsecured building automation installations, in: Proceedings of the 2014 IEEE Emerging Technology and Factory Automation, ETFA, IEEE, 2014.

[81] O. Gasser, Q. Scheitle, B. Rudolph, C. Denis, N. Schricker, G. Carle, The amplification threat posed by publicly reachable BACnet devices, J. Cyber Secur. Mobil. 6 (1) (2017) 77-104, [Online]. Available: https://journals.riverpublishers.com/index.php/JCSANDM/article/view/5227.

[82] M. Cash, S. Wang, B. Pearson, Q. Zhou, X. Fu, On automating bacnet device discovery and property identification, in: ICC 2021-IEEE International Conference on Communications, IEEE, 2021, pp. 1-6.

[83] H. Ochiai, M.D. Hossain, P. Chirupphapa, Y. Kadobayashi, H. Esaki, Modbus/RS-485 attack detection on communication signals with machine learning, IEEE Commun. Mag (2023).

[84] T. Zillner, S. Strobl, ZigBee exploited: The good, the bad and the ugly, 2015, Black Hat-2015, Available online: https://www.blackhat.com/docs/us-15/materials/us-15-Zillner-ZigBee-Exploited-the-Good-the-Bad-and-the-Ugly.pdf. (Accessed 21 March 2018).

[85] S.S. Rana, M.A. Halim, M.H. Kabir, Design and implementation of a security improvement framework of Zigbee network for intelligent monitoring in IoT platform, Appl. Sci. 8 (11) (2018) 2305.

[86] V. Merdis, Wireless Communication Protocols for Home Automation Exploring The Security and Privacy Aspects of Smart Home IoT Devices Communicating Over the Z-Wave Protocol (Master’s thesis), University of Twente, 2019.

[87] J.D. Fuller, B.W. Ramsey, Rogue Z-wave controllers: A persistent attack channel, in: 2015 IEEE 40th Local Computer Networks Conference Workshops, LCN Workshops, IEEE, 2015, pp. 734-741.

[88] L. Rouch, J. François, F. Beck, A. Lahmadi, A universal controller to take over a z-wave network, in: Black Hat Europe, 2017.

[89] A. Antonini, F. Maggi, S. Zanero, A practical attack against a knx-based building automation system, in: 2nd International Symposium for ICS & SCADA Cyber Security Research 2014, ICS-CSR 2014 2, 2014.

[90] K. Hofer-Schmitz, A formal analysis of EnOcean’s teach-in and authentication, in:Proceedings of the 16th International Conference on Availability, Reliability and Security, 2021, pp. 1-8.

[91] Y. Wu, T. Feng, An anonymous authentication and key update mechanism for IoT devices based on EnOcean protocol, Sensors 22 (17) (2022) 6713.

[92] T. Oluwafemi, T. Kohno, S. Gupta, S. Patel, Experimental security analyses of {Non- Networked} compact fluorescent lamps: A case study of home automation security, in: LASER, 2013.

[93] K. Jonas, B. Vogl, M. Rademacher, Security Mechanisms of Wireless Building Automation Systems, Dean Prof. Dr. Wolfgang Heiden, 2017.

[94] N. Tsalis, G. Stergiopoulos, E. Bitsikas, D. Gritzalis, T.K. Apostolopoulos, Side channel attacks over encrypted TCP/IP modbus reveal functionality leaks, in: ICETE (2), 2018, pp. 219-229.

[95] J.-C. Liou, S. Jain, S.R. Singh, D. Taksinwarajan, S. Seneviratne, Side-channel information leaks of Z-wave smart home IoT devices: Demo abstract,in:Proceedings of the 18th Conference on Embedded Networked Sensor Systems, 2020.

[96] KNX, KNX ets, 2022, https://www.knx.org/knx-en/for-professionals/software/ets-professional/.

[97] Y. Liu, Z. Pang, G. Dán, D. Lan, S. Gong, A taxonomy for the security assessment of IP-based building automation systems: The case of thread, IEEE Trans. Ind. Inform. 14 (9) (2018).

[98] L.N. Whitehurst, T.R. Andel, J.T. McDonald, Exploring security in ZigBee networks, in:Proceedings of the 9th Annual Cyber and Information Security Research Conference, 2014, pp. 25-28.

[99] Application Note 158/13 v02 KNX Data Security, 2.1 ed., KNX, 2013.

[100] CISA, KNX protocol, 2023, https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01.

[101] Application Note 159/13 v04 KNXnet/IP Secure, 2.1 ed., KNX, 2013.

[102] KNX, KNX IP secure becomes world’s first vendor-independent security standard for building automation as EN ISO 22510, 2020, https://www.knxtoday.com/2020/02/15234/knx%2Dip%2Dsecure%2Dbecomes%2Dworlds%2Dfirst%2Dvendor%2Dindependent%2Dsecurity%2Dstandard%2Dfor%2Dbuilding%2Dautomation%2Das%2Den%2Diso%2D22510.html.

[103] MODBUS/TCP Security, v21 ed., MODBUS, 2018.

[104] Security of EnOcean Radio Networks, v2.5 ed., EnOcean Alliance, 2018.

[105] EnOcean Alliance, Security of EnOcean radio networks, 2023, https://www.enocean-alliance.org/wp-content/uploads/2023/04/Security_of_EnOcean_Radio_Networks_v3.01.pdf.

[106] C.S. Alliance, ZigBee Pro Specification, 05-3474-23, Connectivity Standard Alliance, 2023.

[107] Z-Wave Plus v2 Device Type Specification, Z-Wave Alliance, Beaverton, United States, 2021.

[108] Calimero, Calimero project, 2022, https://github.com/calimero-project.