New attack against intelligent buildings that use KNX and Zigbee networks on show at #HITB2018AMS

A great many of us are living, staying or working in “smart” buildings, relying on automated processes to control things like heating, ventilation, air conditioning, lighting, security and other operation systems. We expect those systems to work without a glitch and withstand attacks but, unfortunately, the security of these systems is still far from perfect.

A group of researchers from Tencent Security Platform is getting ready to demonstrate just how imperfect it is at the Hack in the Box Conference next month. “The security of smart building equipment is not given enough attention at present. We would like to take this opportunity to make more people pay attention to the issue of safety of intelligent buildings, as personal security and privacy are at stake,” the team says.

Yong Yang, HuiYu Wu and YuXiang Li of the Tencent Blade Team have concentrated on probing KNX, a network communications protocol for building automation that is often used in large public places (stadiums, hotels, airports) and industrial facilities, and Zigbee, communication protocol widely used in home automation systems.

They’ve come up with a new attack method to take control of KNX network components and use that access to tamper with them. They validated the attack at a Marriott hotel, and succeeded in controlling the lighting, air conditioning, curtains and other equipment in the target hotel room.