Why cybercriminals are eyeing smart buildings

1 June 2019 Information Security, Security Services & Risk Management, Commercial (Industry)

In countries like the United States, the growth of smart buildings is estimated to reach 16.6% by 2020 compared to 2014, although this expansion is not limited to the US but rather is taking place on a global scale. This growth is largely due to the fact we live in a world increasingly permeated by technology, in which process automation and the search for energy efficiency contribute not only to sustainability, but also to cost reduction – a goal pursued in all industries, public and private alike. Naturally, the construction industry is no exception, says Carey van Vlaanderen, CEO at ESET South Africa.

Carey van Vlaanderen
Carey van Vlaanderen

Smart buildings use technology to control a wide range of variables within their respective environments with the aim of providing more comfort and contributing to the health and productivity of the people inside them. To do so, they use so-called Building Automation Systems (BAS). With the arrival of the Internet of Things (IoT), smart buildings have redefined themselves. With the information they obtain from smart sensors, their technological equipment is used to analyse, predict, diagnose and maintain the various environments within them, as well as to automate processes and monitor numerous operational variables in real time. Ambient temperature, lighting, security cameras, elevators, parking and water management are just some of the automatable services currently supported by the technology.

To put the possibilities of this smart infrastructure into perspective, is the example of a smart building in Las Vegas where, two years ago, they decided to install a sophisticated automation system to control the use of the air conditioning (keeping in mind Las Vegas has a hot desert climate and very little rain), so it is turned on only when there are people present. This decision led to a saving of US$2 million during the first year after the smart system was installed, due to the reduction in energy consumption achieved by automating the process. Marriott Hotels implemented a similar system across the entire chain that is expected to generate an estimated US$ 9.9 million in energy savings.

Another example of automation through smart devices is that of a supermarket in the United Kingdom. The store installed a smart system in its parking lot that generates a kinetic energy from the movement of cars passing through it, and then uses that energy to power the checkouts.

At first glance, we may not see any security risk in these smart buildings. It is likely, however, that at some point the entire smart network is connected to a single database, and that is where the risk is. Particularly if we consider that many IoT devices are manufactured by different suppliers, who may not have paid due attention to security considerations during their design and manufacturing process.

Possibility of a smart building being attacked

The risk of a security incident taking place in an intelligent building is linked to the motivations of cybercriminals, who mainly seek to achieve economic gain through their actions, as well as to impact and spread fear.

There are already some tools such as Shodan that allow anybody to discover vulnerable and/or unsecured IoT devices connected publicly to the internet. If you run a search using the tool, you can find thousands of building automation systems in its lists, complete with information that could be used by an attacker to compromise a device. In February 2019, around 35 000 building automation systems worldwide appeared in Shodan within public reach via the internet.

This means that someone could take control of a BAS after finding it through a search. If, for example, a criminal used Shodan for building automation systems to attack, they will find IP addresses. If they copy those IP addresses into the address bar of a web browser, in many cases this will bring up an interface for gaining access, where they need to enter a username and password. If the password is a default password of if it can be cracked easily through a brute force attack, the attacker will gain access to the system monitoring panel, which contains information similar to the companies located in the smart building.

Once the attackers have access to this public information and can monitor, for example, how the air conditioning works, they could make a phone call pretending to be from the maintenance company and say they are going to send a technician. At the same time, the attackers could request remote access, which would give them access to the server and allow them to control the building. Once they have control, they could alter the building’s heating or air conditioning or adjust the way any of the other automated systems operate and then demand payment of a ransom in using a system that allow them to remain anonymous, such as cryptocurrency, in exchange for not shutting the building down.

Cybercriminals are already carrying out such attacks when they have the opportunity. This kind of attack is siegeware, or “the code-enabled ability to make a credible extortion demand based on digitally impaired building functionality”.

Considerations to keep in mind

There are a number of security considerations and requirements to keep in mind:

• Review the devices’ security specifications and work on the basis of the ‘security by design’ concept.

• Set a suitable budget for security.

• Choose partners that have knowledge of security issues.

• Install software for managing vulnerabilities.

• Ensure cooperation between the different areas and/or departments.

For operational issues:

• Update the devices regularly.

• Implement a replacement plan for when devices’ support life cycles end.

• Exercise a precaution in respect of connected devices.

• Monitor connected devices.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...
Your Wi-Fi router is about to start watching you
News & Events Surveillance Security Services & Risk Management
Advanced algorithms are able to analyse your Wi-Fi signals and create a representation of your movements, turning your home's Wi-Fi into a motion detection and personal identification system.

Read more...
Fire safety in commercial kitchens
Technews Publishing Kestrel Distribution Products & Solutions Fire & Safety Commercial (Industry)
Fire safety in commercial kitchens is becoming increasingly critical. Defender is Europe’s first EN 17446:2021-approved kitchen hood fire suppression system and offers the indispensable safety measures required.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...
POPIA non-compliance puts municipalities at risk
Information Security Government and Parastatal (Industry)
Digital responsibility must go beyond POPIA compliance to recognising that privacy and service delivery are fundamentally linked. Despite this, only 51 out of 257 municipalities submitted their mandatory data protection and access to information reports in 2024.

Read more...
Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...
Most wanted malware
News & Events Information Security
Check Point Software Technologies unveiled its Global Threat Index for June 2025, highlighting a surge in new and evolving threats. Eight African countries are among the most targeted as malware leaders AsyncRAT and FakeUpdates expand.

Read more...
Welcome to the new cyber battleground
Information Security
The Iran-Israel conflict is rapidly redefining modern warfare, pushing the boundaries of cyber capabilities and creating a new, borderless digital battlefield. Fortinet’s CISO, Dr Carl Windsor, offers a critical, in-depth analysis of the escalating tactics and global implications in his latest report.

Read more...
African industries may overestimate cyber defences
Information Security
] A significant perception gap exists in security awareness training: 68% of leaders believe training is tailored to roles, yet only a third of employees feel adequately trained. Many organisations only conduct annual or biannual generic training that may not effectively change behaviour.

Read more...
SMARTpod talks to Sophos and Phishield
SMART Security Solutions Technews Publishing Sophos Videos Information Security News & Events
SMARTpod recently spoke with Pieter Nel, Sales Director for SADC at Sophos, and Sarel Lamprecht, MD at Phishield, about ransomware and their new cyber insurance partnership.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.