BMS is destroyed by "smart button"
About me I am working at • Specialize in ICS security of embedded devices • Dedicate a lot of time to programming industrial controllers for ICS • Took part in smart home development projects 2
Content • What is BMS • Introduction to KNX • Ideal world • Real world 3 BMS is destroyed by "smart button"
News about cyber attack on BMS 4 BMS is destroyed by "smart button"
What is BMS 5 BMS is destroyed by "smart button"
What is BMS B uilding M anagement S ystem - BMS Management level PLC / HMI Automation level Field level sensors actuators 6 BMS is destroyed by "smart button"
Main objectives of BMS Reduce power consumption Control operation of different systems Ensure visitors’ comfort 7 BMS is destroyed by "smart button"
Environment is BMS 8 BMS is destroyed by "smart button"
Environment of KNX Al Maktoum International Airport Welt Museum Wien Asia Square 9 BMS is destroyed by "smart button"
Environment of KNX Indoor presence detection Room Thermostat Heating, Ventilation and Air Conditioning …. Transponder reader 10 BMS is destroyed by "smart button"
Environment of KNX ABB KNX solutions for hotel applications 11 BMS is destroyed by "smart button"
Introduction to KNX 12
Physical communication media KNX - TP KNXnet/IP (Twisted pair) 9600 bit/s KNX - PL KNX - RF Power Line (PL110) 16384 bit/s 1200 bit/s 868 MHz 13 BMS is destroyed by "smart button"
KNX address space max 15 areas 1 area – max 15 lines 1 line – max 255 nodes 14 BMS is destroyed by "smart button"
KNX-TP frame 15 BMS is destroyed by "smart button"
KNX-TP frame Control byte 16 BMS is destroyed by "smart button"
KNX-TP frame Source address node line area 17 BMS is destroyed by "smart button"
KNX-TP frame Receiver address It depends on Group Address Style 18 BMS is destroyed by "smart button"
KNX-TP frame Receiver address It depends on Group Address Style 19 BMS is destroyed by "smart button"
KNX-TP frame NPCI 20 BMS is destroyed by "smart button"
KNX-TP frame TPCI / APCI 21 BMS is destroyed by "smart button"
KNX-TP frame 22 BMS is destroyed by "smart button"
KNXnet/IP frame 1 byte 1 byte 2 bytes 2 bytes Multicast @ 224.0.23.12:3671 23 BMS is destroyed by "smart button"
KNXnet/IP frame Second Control Byte In KNXnet/IP 24 BMS is destroyed by "smart button"
Ideal world 25
KNX Position Paper on Data Security and Privacy 26 BMS is destroyed by "smart button"
KNX Position Paper on Data Security and Privacy 27 BMS is destroyed by "smart button"
KNX Position Paper on Data Security and Privacy 1 2 ETS5 provides security connection HOWEVER … 28 BMS is destroyed by "smart button"
Real world 29
Expectations and reality ETS5 provides security connection 30 BMS is destroyed by "smart button"
Shodan, Censys , … 31 BMS is destroyed by "smart button"
How to connect to KNX TP stand-alone device “smart” transceiver (NCN5120 or E981.03) Design self-transceiver 32 BMS is destroyed by "smart button"
Tools to work with KNX ETS software Press button to switch “Program mode” Commit/configure node 33 BMS is destroyed by "smart button"
Tools to work with KNX pwnknx Ethernet (via IP gateway) Ethernet/Wi-Fi (based on esp32) connection KNX-TP (based on esp32) https://github.com/Xarlan/pwnknx 34 BMS is destroyed by "smart button"
Tools to work with KNX pwnknx • sniff To get information about number line, address format, which used • To find all nodes in a line, because ETS5 sometimes can’t display all scan of them • read Read configuration from node (APCI “memory read”) • write W rite configuration to node (APCI “memory write”) • set_key Set the authorization key (APCI “Escape” + extended APCI bits ) 35 BMS is destroyed by "smart button"
Attack to field level Connect anywhere to KNX TP 1 floor • Listen the traffic and slightly understand the type of devices 2 floor • Replay attack 3 floor Ethernet KNX-TP 36 BMS is destroyed by "smart button"
Attack to field level • Discover KNX-TP segment 1 floor • Manage nodes in current KNX-TP segment 2 floor 3 floor Lock Ethernet KNX-TP 37 BMS is destroyed by "smart button"
Attack to field level • Use APCI “Read memory” to get info 1 floor IP 192.168.1.222 Mask 255.255.255.255 Gateway 2 floor 192.168.1.1 Status router Lock or Unlock … 3 floor Lock Ethernet KNX-TP 38 BMS is destroyed by "smart button"
Attack to field level 1 floor • Use APCI “Write memory” to change 2 floor the configuration node or IP router 3 floor Lock Ethernet KNX-TP 39 BMS is destroyed by "smart button"
Attack to field level 1 floor • Use APCI “Write memory” to change 2 floor the configuration node or IP router 3 floor Unlock Ethernet KNX-TP 40 BMS is destroyed by "smart button"
Attack to field level 1 floor • Discover and manage all nodes in 2 floor KNX-TP & KNXnet/IP 3 floor Unlock Ethernet KNX-TP 41 BMS is destroyed by "smart button"
Attack to field level • APCI “User Message” we can to send up to 69 bytes, not 15 bytes, some router can transfer 69 bytes form knx-tp to KNXnetIP • Padding for Ethernet frame for some KNX IP router don’t forget about 42 BMS is destroyed by "smart button"
Attack to field level • No needed to switch to “program mode” in ETS5 you need switch to “program mode” to change configuration of node in real life – use APCI “memory read/write” without “key authorization” • APCI “Escape” + Key authorization use to “memory access- protection” However, some nodes can confirm that the authorization key was changed, but in reality nothing happened!!! 43 BMS is destroyed by "smart button"
Update firmware via KNX-TP KNXnet/IP KNX-TP 44 BMS is destroyed by "smart button"
Update firmware via KNX-TP KNXnet/IP KNX-TP 45 BMS is destroyed by "smart button"
Update firmware via KNX-TP KNXnet/IP KNX-TP 46 BMS is destroyed by "smart button"
Update firmware via KNX-TP KNXnet/IP KNX-TP 47 BMS is destroyed by "smart button"
Update firmware via KNX-TP How to update firmware on IP router from field side ? Use APCI “User Message” • to read firmware: • to write firmware: APCI = 0x2C0 (User Message) APCI = 0x2C2 (User Memory Write) Data = [0xXX, …, 0xXX] Data = [0xXX, …, 0xXX] where where 0xXX – the part of firmware 0xXX – the part of firmware 48 BMS is destroyed by "smart button"
Update firmware How to get control over the device Connect to the Ethernet Run “vendor name” Update Tool Update 49 BMS is destroyed by "smart button"
Inside the IP router Possible MCU: Possible OS: • • ATmega128 Nut/OS • Linux • AT91SAM9G20 • • NXP LPC2366 Custom firmware Possible transceiver: • FZE1066 • EIB-TP-UART-IC • E981.03 50 BMS is destroyed by "smart button"
Attack to Automation level Linx 150 programmable automation stations program connectivity functions to concurrently integrate: CEA ‐ 709 (LonMark Systems); • • BACnet; • KNX; • Modbus; M ‐ Bus • 51 BMS is destroyed by "smart button"
External interfaces Linx 150 microSD Manual control USB Ethernet 52 BMS is destroyed by "smart button"
Connecting to the Linx 150 Linx 150 Serial 38,400 bps / 8 data bits / no parity / 1 stop bit / no handshake Manual Ethernet • http web server • ftp • ssh • … 53 BMS is destroyed by "smart button"
Manual connection You can do anything!!! 54 BMS is destroyed by "smart button"
HTTP web Linx 150 A lot of information for guest 55 BMS is destroyed by "smart button"
HTTP web Linx 150 Account: admin Password : loytec4u Don’t forget, that the communication happens via HTTP, FTP 56 BMS is destroyed by "smart button"
HTTP web Linx 150 min: 1 symbol max: 15 symbols 57 BMS is destroyed by "smart button"
Bruteforce Analyze /etc/init.d/S35firewall and other network settings rules in iptables NOT fail2ban sshguard if you miss - engage in brute force 58 BMS is destroyed by "smart button"
Step aside 59 BMS is destroyed by "smart button"
Inside firmware image Linx 150 linx_at91_6_4_6_20190213_1030.dl Download from official web site https://www.loytec.com/de/support/download/linx-150 60 BMS is destroyed by "smart button"
Inside firmware image Linx 150 linx_at91_6_4_6_20190213_1030.dl A lot of Debian package + Loytec package 61 BMS is destroyed by "smart button"
Recommend
More recommend
