BMS is destroyed by "smart button" About me I am working at - - PowerPoint PPT Presentation

▶
bms is destroyed
SMART_READER_LITE
LIVE PREVIEW

BMS is destroyed by "smart button" About me I am working at - - PowerPoint PPT Presentation

Apr 25, 2023 27 likes •758 views

BMS is destroyed by "smart button" About me I am working at Specialize in ICS security of embedded devices Dedicate a lot of time to programming industrial controllers for ICS Took part in smart home development projects 2

slide-1
SLIDE 1

BMS is destroyed by "smart button"

slide-2
SLIDE 2

2 About me

  • Specialize in ICS security of embedded devices
  • Dedicate a lot of time to programming industrial controllers for ICS
  • Took part in smart home development projects

I am working at

slide-3
SLIDE 3

BMS is destroyed by "smart button" 3 Content

  • What is BMS
  • Introduction to KNX
  • Ideal world
  • Real world
slide-4
SLIDE 4

BMS is destroyed by "smart button" 4 News about cyber attack on BMS

slide-5
SLIDE 5

BMS is destroyed by "smart button" 5

What is BMS

slide-6
SLIDE 6

BMS is destroyed by "smart button" 6 What is BMS

Automation level Management level Field level

Building Management System - BMS

sensors actuators PLC / HMI

slide-7
SLIDE 7

BMS is destroyed by "smart button" 7 Main objectives of BMS

Reduce power consumption Control operation of different systems Ensure visitors’ comfort

slide-8
SLIDE 8

BMS is destroyed by "smart button" 8 Environment is BMS

slide-9
SLIDE 9

BMS is destroyed by "smart button" 9 Environment of KNX

Al Maktoum International Airport Asia Square Welt Museum Wien

slide-10
SLIDE 10

BMS is destroyed by "smart button" 10

Heating, Ventilation and Air Conditioning

Environment of KNX

Room Thermostat Transponder reader …. Indoor presence detection

slide-11
SLIDE 11

BMS is destroyed by "smart button" 11 Environment of KNX

ABB KNX solutions for hotel applications

slide-12
SLIDE 12

12

Introduction to KNX

slide-13
SLIDE 13

BMS is destroyed by "smart button" 13

KNXnet/IP KNX - TP

(Twisted pair) 9600 bit/s

KNX - RF KNX - PL

Power Line (PL110)

Physical communication media

16384 bit/s 868 MHz 1200 bit/s

slide-14
SLIDE 14

BMS is destroyed by "smart button" 14 KNX address space

max 15 areas 1 area – max 15 lines 1 line – max 255 nodes

slide-15
SLIDE 15

BMS is destroyed by "smart button" 15 KNX-TP frame

slide-16
SLIDE 16

BMS is destroyed by "smart button" 16 KNX-TP frame

Control byte

slide-17
SLIDE 17

BMS is destroyed by "smart button" 17

Source address

area line node

KNX-TP frame

slide-18
SLIDE 18

BMS is destroyed by "smart button" 18

Receiver address It depends on Group Address Style

KNX-TP frame

slide-19
SLIDE 19

BMS is destroyed by "smart button" 19

Receiver address It depends on Group Address Style

KNX-TP frame

slide-20
SLIDE 20

BMS is destroyed by "smart button" 20

NPCI

KNX-TP frame

slide-21
SLIDE 21

BMS is destroyed by "smart button" 21

TPCI / APCI

KNX-TP frame

slide-22
SLIDE 22

BMS is destroyed by "smart button" 22 KNX-TP frame

slide-23
SLIDE 23

BMS is destroyed by "smart button" 23

Multicast @ 224.0.23.12:3671

1 byte 1 byte 2 bytes 2 bytes

KNXnet/IP frame

slide-24
SLIDE 24

BMS is destroyed by "smart button" 24 Second Control Byte In KNXnet/IP KNXnet/IP frame

slide-25
SLIDE 25

25

Ideal world

slide-26
SLIDE 26

BMS is destroyed by "smart button" 26 KNX Position Paper on Data Security and Privacy

slide-27
SLIDE 27

BMS is destroyed by "smart button" 27 KNX Position Paper on Data Security and Privacy

slide-28
SLIDE 28

BMS is destroyed by "smart button" 28 KNX Position Paper on Data Security and Privacy

1 2

ETS5 provides security connection HOWEVER …

slide-29
SLIDE 29

29

Real world

slide-30
SLIDE 30

BMS is destroyed by "smart button" 30 Expectations and reality

ETS5 provides security connection

slide-31
SLIDE 31

BMS is destroyed by "smart button" 31 Shodan, Censys, …

slide-32
SLIDE 32

BMS is destroyed by "smart button" 32

stand-alone device “smart” transceiver (NCN5120 or E981.03)

How to connect to KNX TP

Design self-transceiver

slide-33
SLIDE 33

BMS is destroyed by "smart button" 33

ETS software

Tools to work with KNX

Press button to switch “Program mode” Commit/configure node

slide-34
SLIDE 34

BMS is destroyed by "smart button" 34 Tools to work with KNX

https://github.com/Xarlan/pwnknx

pwnknx

connection Ethernet (via IP gateway) Ethernet/Wi-Fi (based on esp32) KNX-TP (based on esp32)

slide-35
SLIDE 35

BMS is destroyed by "smart button" 35 Tools to work with KNX

To get information about number line, address format, which used

  • sniff
  • scan

To find all nodes in a line, because ETS5 sometimes can’t display all

  • f them
  • read

Read configuration from node (APCI “memory read”)

  • write

Write configuration to node (APCI “memory write”)

  • set_key Set the authorization key (APCI “Escape” + extended APCI bits )

pwnknx

slide-36
SLIDE 36

BMS is destroyed by "smart button" 36

1 floor

Attack to field level

2 floor 3 floor

Connect anywhere to KNX TP

  • Listen the traffic and slightly

understand the type of devices

  • Replay attack

Ethernet KNX-TP

slide-37
SLIDE 37

BMS is destroyed by "smart button" 37

1 floor

Attack to field level

2 floor 3 floor

  • Discover KNX-TP segment
  • Manage nodes in current KNX-TP segment

Lock

Ethernet KNX-TP

slide-38
SLIDE 38

BMS is destroyed by "smart button" 38

1 floor

Attack to field level

2 floor 3 floor

  • Use APCI “Read memory” to get info

Lock

IP 192.168.1.222

Mask

255.255.255.255

Gateway

192.168.1.1

Status router

Lock or Unlock

…

Ethernet KNX-TP

slide-39
SLIDE 39

BMS is destroyed by "smart button" 39

1 floor

Attack to field level

2 floor 3 floor

  • Use APCI “Write memory” to change

the configuration node or IP router

Lock

Ethernet KNX-TP

slide-40
SLIDE 40

BMS is destroyed by "smart button" 40

Unlock

1 floor

Attack to field level

2 floor 3 floor

  • Use APCI “Write memory” to change

the configuration node or IP router

Ethernet KNX-TP

slide-41
SLIDE 41

BMS is destroyed by "smart button" 41

Unlock

Ethernet KNX-TP

1 floor

Attack to field level

2 floor 3 floor

  • Discover and manage all nodes in

KNX-TP & KNXnet/IP

slide-42
SLIDE 42

BMS is destroyed by "smart button" 42 Attack to field level

  • APCI “User Message”

we can to send up to 69 bytes, not 15 bytes, some router can transfer 69 bytes form knx-tp to KNXnetIP for some KNX IP router don’t forget about

  • Padding for Ethernet frame
slide-43
SLIDE 43

BMS is destroyed by "smart button" 43 Attack to field level

  • No needed to switch to “program mode”

in ETS5 you need switch to “program mode” to change configuration of node in real life – use APCI “memory read/write” without “key authorization”

  • APCI “Escape” + Key authorization

use to “memory access-protection” However, some nodes can confirm that the authorization key was changed,

but in reality nothing happened!!!

slide-44
SLIDE 44

BMS is destroyed by "smart button" 44

KNX-TP KNXnet/IP

Update firmware via KNX-TP

slide-45
SLIDE 45

BMS is destroyed by "smart button" 45

KNX-TP KNXnet/IP

Update firmware via KNX-TP

slide-46
SLIDE 46

BMS is destroyed by "smart button" 46

KNX-TP KNXnet/IP

Update firmware via KNX-TP

slide-47
SLIDE 47

BMS is destroyed by "smart button" 47

KNX-TP KNXnet/IP

Update firmware via KNX-TP

slide-48
SLIDE 48

BMS is destroyed by "smart button" 48

Use APCI “User Message”

  • to read firmware:

APCI = 0x2C0 (User Message) Data = [0xXX, …, 0xXX] where 0xXX – the part of firmware

  • to write firmware:

APCI = 0x2C2 (User Memory Write) Data = [0xXX, …, 0xXX] where 0xXX – the part of firmware

Update firmware via KNX-TP

How to update firmware on IP router from field side ?

slide-49
SLIDE 49

BMS is destroyed by "smart button" 49 Update firmware

How to get control over the device Connect to the Ethernet Run “vendor name” Update Tool Update

slide-50
SLIDE 50

BMS is destroyed by "smart button" 50 Inside the IP router

Possible MCU:

  • ATmega128
  • AT91SAM9G20
  • NXP LPC2366

Possible OS:

  • Nut/OS
  • Linux
  • Custom firmware

Possible transceiver:

  • FZE1066
  • EIB-TP-UART-IC
  • E981.03
slide-51
SLIDE 51

BMS is destroyed by "smart button" 51

Linx 150

  • programmable automation stations

Attack to Automation level

  • program connectivity functions to

concurrently integrate:

  • CEA‐709 (LonMark Systems);
  • BACnet;
  • KNX;
  • Modbus;
  • M‐Bus
slide-52
SLIDE 52

BMS is destroyed by "smart button" 52

Manual control

External interfaces

USB Ethernet microSD

Linx 150

slide-53
SLIDE 53

BMS is destroyed by "smart button" 53

Serial 38,400 bps / 8 data bits / no parity / 1 stop bit / no handshake

Connecting to the Linx 150

Manual Ethernet

  • http web server
  • ftp
  • ssh
  • …

Linx 150

slide-54
SLIDE 54

BMS is destroyed by "smart button" 54 Manual connection

You can do anything!!!

slide-55
SLIDE 55

BMS is destroyed by "smart button" 55 HTTP web

A lot of information for guest

Linx 150

slide-56
SLIDE 56

BMS is destroyed by "smart button" 56 HTTP web

Account: admin Password: loytec4u

Linx 150

Don’t forget, that the communication happens via HTTP, FTP

slide-57
SLIDE 57

BMS is destroyed by "smart button" 57

Linx 150 min: 1 symbol max: 15 symbols

HTTP web

slide-58
SLIDE 58

BMS is destroyed by "smart button" 58

Analyze /etc/init.d/S35firewall and other network settings

Bruteforce

rules in iptables fail2ban sshguard NOT if you miss - engage in brute force

slide-59
SLIDE 59

BMS is destroyed by "smart button" 59 Step aside

slide-60
SLIDE 60

BMS is destroyed by "smart button" 60 Inside firmware image

linx_at91_6_4_6_20190213_1030.dl https://www.loytec.com/de/support/download/linx-150 Download from official web site Linx 150

slide-61
SLIDE 61

BMS is destroyed by "smart button" 61 Inside firmware image

linx_at91_6_4_6_20190213_1030.dl A lot of Debian package + Loytec package Linx 150

slide-62
SLIDE 62

BMS is destroyed by "smart button" 62

CVE-2019-xxxx

Inside firmware image

CVE-2018-15599 dropbear_2018.76-1 CVE-2017-1000368 CVE-2017-1000367 sudo_1.8.19p2-1 CVE-2017-7418 proftpd_1.3.5d-1 Linux Kernel 3.18.45 CVE-2018-xxxx

slide-63
SLIDE 63

BMS is destroyed by "smart button" 63 Inside firmware image

File doesn’t stripped Stack may be executable

slide-64
SLIDE 64

BMS is destroyed by "smart button" 64 Inside firmware image

Hardcoded password and user /usr/bin/linx_at91_primary.exe

slide-65
SLIDE 65

BMS is destroyed by "smart button" 65 Inside firmware image

Function “firmware_update_from_file” no checking of integrity and authenticity

slide-66
SLIDE 66

BMS is destroyed by "smart button" 66 Inside firmware image

/var/lib/opcua/certificatestore/server/private /etc/lighttpd/ssl/

Private key

The same “Private Key” for different version of firmware Perhaps the same “Private Key” for different devices

slide-67
SLIDE 67

BMS is destroyed by "smart button" 67 Inside firmware image

What is it Linx 153 firmware ??? Linx 153 firmware Some new specific package for Linx 153 Old packages from Linx 150 with older version for example “proftpd”

slide-68
SLIDE 68

BMS is destroyed by "smart button" 68 Additional info

  • “Learn how to control every room at a luxury hotel remotely: the

dangers of insecure home automation deployment.” by Jesus Molina

  • “Security for KNXnet/IP” by Daniel Lechner, Wolfgang Granzer,

Wolfgang Kastner

  • Hacking Intelligent Buildings: Pwning KNX & ZigBee Networks

https://conference.hitb.org/hitbsecconf2018ams/sessions/hacking-intelligent-buildings-pwning-knx-zigbee-networks/

slide-69
SLIDE 69

69

Conclusion

slide-70
SLIDE 70

BMS is destroyed by "smart button" 70

  • DoS for any node in KNX network
  • Opportunity to manage any device in KNX
  • Change router configuration
  • Update firmware for some node via knx-tp
  • No checks are present in during update
  • Using not secure protocols (http, ftp) to communicate with Linx 150
  • Using old packages in Linx 150
slide-71
SLIDE 71

BMS is destroyed by "smart button" 71

  • KNX Position Paper on Data Security and Privacy
slide-72
SLIDE 72

BMS is destroyed by "smart button" 72

Gratitude

  • Dimitrii Viktorov, CTO, SENSORMATICA LLC

@KanIkFFdoen

https://sensormatica.ru

  • Kees Jongenburger
slide-73
SLIDE 73

egor21@gmail.com

73

@Xarlan