Imagine you are the manager of a building and you get an anonymous text announcing hackers have accessed your building automation system. If you don’t pay a ransom they will close down the building.
This is not a hypothetical situation, according to Stephen Cobb, a security expert at ESET. The tenant in the building was a medical centre. When the property manager refused to pay the ransom, the building services were disrupted.
As buildings get smarter the risks around cyber security multiply and the scale of this problem could increase rapidly over the next few years. By 2024 the global market for smart buildings is estimated to be 10x larger than it was in 2016 as the internet of things (IoT) dominates the new plant and equipment being retrofitted into buildings. This has not gone unnoticed by hackers.
In January this year it was revealed a type of software used for access controls in buildings had 10 vulnerabilities. Security patches were not released quickly and they were adopted even slower. A wave of hacking incidents began where hackers used the system to install malware and then launch attacks on other targets.
On the hackers website White Rabbit there are several articles on building management systems (BMS) including one detailing 100 vulnerabilities in building management systems. BMS systems are also featured on Shodan, dubbed the scariest search engine in the world, which lets hackers find vulnerable devices in the world. In his blog Stephen Cobb outlines a search he did on Shodan in February last year where he found 35,000 vulnerable devices in buildings. This was up from 21,000 when he did a similar search in 2018.
But surely, you might ask, an ordinary office building in a town or city will not be worth hacking?
That is exactly what the owners of a four star hotel in the Austrian Alps thought - between 2016 and 2017 their access systems were targeted four times by hackers who managed to lock guests out of their rooms. They demanded, and were paid, bit-coin ransoms.
The problem is hackers are a diverse group of people ranging from suspected state sponsored hacking activity through to clever teenagers in their bedrooms. Their motivations range from wanting money, wanting to disrupt systems to just wanting to prove they can do it.
Neil Farnham-Smith, who conducts resero’s digital connectivity and cyber security audits of buildings and says all those he has audited so far are vulnerable to even the most unsophisticated of hacks.
“It sounds boring but I see so many buildings where there are loads of IoT devices that have not been updated since they were first installed. Similarly loads are still using the manufacturer’s set password. These are the first, and most basic, lines of defence against any attack.”
Neil takes an audit of all the software in a building including computer hardware and network connectivity. He looks to understand what is connected to what and its function. From this he compiles a schedule of IoT connected equipment and identifies all unsupported hardware, any software updates and whether there is a need for further specialist vulnerability testing.
This helps building owners understand the size of the cyber risk they might be facing and if more specialist support or intervention is required.
He warns that high profile tenants will increase the risk of cyberattacks.
Government departments and national organisations such as the NHS and global companies are often targeted by hackers. In 2017 a casino was hacked via an internet connected thermometer in a fishtank. A building where Google was a tenant in Australia was hacked by security researchers who were able to access the heating and ventilation systems as well as floor plans and alarm systems.
The problem according to Neil is an ever increasing number of smart BMS systems and IOT connected computers that are falling through the gap between mechanical and electrical contractors, who maintain building services, and an organisation’s IT department.
Each ‘smart’ system in a building is usually installed by a different contractor. They will often have a specialist knowledge of the mechanical or electrical engineering side of the equipment but not the software or computer hardware elements of it.
“They’re not skilled at networking. Many will just pop out to a PC retailer to buy a machine and switch it on. They’ll also use remote access software that isn’t licenced for commercial use which opens up the building to another risk that managers and owners will never be aware of,” Neil points out.
He says in most of the buildings he has audited so far there is no coherent approach to the ‘digital connectivity’ inside. This not only introduces risk but also increases costs.
“The levels of duplication and unnecessary connections I’m finding is staggering. A lease line is an internet connection with a contracted level of service and it is very expensive. In one building I found two leased lines next to each other, both barely utilised. One was solely used for guest wi-fi in the reception area - a normal broadband line would have been more than enough to support that. When you add up the contract charges there are some reasonably significant sums involved.”
Neil says conducting a simple audit on the digital connectivity of a building is a simple first step that will instantly show the scale of the risks involved or the level of duplication.
“Often it’s just a matter of having someone with specialist knowledge looking at the building. Many of the changes aren’t actually that difficult or expensive to resolve, it’s just that nobody knows what they’re looking at or what to do about it.”
Neil’s top four tips on improving the cyber security and digital connectivity of your building