Characterizing Building Automation System Attacks and Attackers

A building automation system (BAS) is an instance of a cyber-physical-system (CPS) in control of building functionalities like lighting, ventilation, CCTVs, and access control. The amount of “smart” buildings has been growing over the years, introducing new technologies which are now being targeted by attackers. In this work, we present the first collection of publicly disclosed security incidents involving Building Automation Systems (BAS). We then provide a qualitative study of attackers targeting BAS and unveil their main characteristics and differences to traditional CPS attackers. We learn that, generally speaking, BAS attackers show a lower sophistication level and that most BAS attacks target the smart IoT components present in modern buildings. Further, access to the BAS is often not the attacker's final goal but "just" a mean to achieve their actual goal. Lastly, we do not observe any advanced, state-sponsored BAS attacks hinting that these play less of a role in BAS (compared to CPS).