BACnet Security: Building Automation Attack Surface

BACnet (Building Automation and Control Network) is the ASHRAE 135 standard for HVAC, lighting control, fire safety, access control, and energy management systems. It operates primarily as BACnet/IP (UDP port 47808) and BACnet MS/TP (RS-485 serial). Building control systems — often dismissed as low-risk — are increasingly targeted because they share networks with IT infrastructure and can provide physical access to facilities.

BACnet Object Model

BACnet uses an object-oriented data model. Every controllable element is a BACnet object with properties. Key services allow reading and writing these objects:

A Who-Is broadcast on UDP 47808 returns I-Am responses from every BACnet device on the subnet — a complete device inventory with no authentication required. ReadProperty and WriteProperty services in base BACnet/IP also require no credentials.

Security Vulnerabilities

• Unauthenticated object access — any IP host on the BACnet subnet can read and write all objects
• Device discovery via broadcast — Who-Is floods the network with I-Am responses, mapping the entire BAS topology
• Physical safety impact — writing to HVAC temperature setpoints, fire suppression enable/disable, or access control door commands has direct physical effects
• IT network convergence — many building systems share IT VLANs or have internet-exposed BACnet controllers for remote management
• Vendor backdoors — many BACnet controllers have undocumented vendor-specific services with hardcoded credentials

BACnet/SC (Secure Connect, 2020)

ASHRAE 135-2020 Addendum bj introduced BACnet/SC — a WebSocket-based transport with TLS 1.3 and X.509 certificate authentication. BACnet/SC uses a hub-and-spoke topology with a central BACnet/SC Hub. Every device authenticates with an Operational Certificate before establishing a connection. The Hub validates certificates and maintains routing tables.

Defences