Identifying unsecured building automation installations

Abstract

Building automation systems rely more and more on IP-based communication, which allows easier management, maintenance and, in general, interaction with other domains. When the connection to the Internet comes into play, security mechanisms need to be deployed to prevent attacks on these systems. Based on a worldwide scan of IPv4 addresses, this paper illustrates that security awareness is unfortunately still neglected. Thousands of building automation systems are directly connected to the Internet, allowing unauthenticated and unauthorized access to their underlying datapoints.