On the security of security extensions for IP-based KNX networks

Abstract

The traditional areas of application for building automation systems (BAS) like heating, ventilation and air conditioning as well as lighting and shading are more and more extended by services requiring a more robust security infrastructure like alarm-and access control systems. Additionally, building automation networks get integrated into existing IP-based networks, or even communicate directly over the Internet. Therefore, the attack surface of BAS has increased dramatically. This requires a solid security architecture and a profound knowledge of possible attack vectors. This work reviews two security extensions for KNXnet/IP regarding their individual security properties. Thereby, it is pointed out that the current version of the draft specification, called KNXnet/IP Secure, lacks some relevant details and has certain limitations concerning the provided level of security.

The Security of Smart Buildings: a Systematic Literature Review

“…Several publications are fully dedicated to DoS attacks at the automation and management layers [26,27,28,29,10,16,17,11,30,22]. Two main type of DoS attacks can be conducted at this layer [26]: host-based and network-based.…”

“…In network-based DoS, the target is the network itself, where the attackers try to waste the network bandwidth up to completely interrupting the communication between the devices located in the affected segment. In terms of particular techniques to effectively launch a DoS, a prominent one was flooding [10], [28], [29], [27], [11]. In this type of DoS attacks, an attacker uses weaknesses of the network or service where they become so overwhelmed with requests that they can no longer process genuine connection requests.…”

“…Many of the reviewed papers, as stated in the general analysis, discuss vulnerabilities and attacks that can be made against protocols like BACnet, KNX, and LonWorks [33], [20], [31], [10], [27]. Examples of attacks include [10], which demonstrate a detection of Telnet brute force attacks and targeted attacks on building automation system networks, such as BACnet spoofing and Write-Property attack.…”

“…The former is similar to ARP spoofing, where compromised device generates fake I-Am-Router-To-Network messages of BACnet and forces other devices to send their messages via the device of an attacker. Whereas, the paper [27] discusses attacks made to KNX backbone network, such as tampering, ARP cache poisoning and replay attack.…”

An overview of wireless IoT protocol security in the smart home domain

“…Despite some time being in use, a detailed security analysis of the KNX Security extensions is still not available [34]. An earlier analysis of a draft state of KNXnet/IP Secure, however, found numerous attack vectors and security service shortcomings [35].…”