November 2018 ASOS summery below.
- Total Hosts with 47808 Exposed – 18,270
- Total BACnet Hosts – 12,934
- Total Unknown / Suspected BACnet – 1,915
- Total Unknown – 5,336
- Total Number of Vendors – 109
BACnet ASOS Report- November 2018
BACnet ASOS Report- October 2018
October 2018 ASOS summery below.
- Total Hosts with 47808 Exposed – 17,802
- Total BACnet Hosts – 12,361
- Total Unknown / Suspected BACnet- 1,869
- Total Unknown – 3,572
- Total Number of Vendors – 109
BACnet – As Seen on Shodan
Ever wonder how many BACnet systems are exposed on the internet? This is an ongoing project to analyze BACnet hosts found in the Shodan database. Each month, results from Shodan hosts with port 47808 will be analyzed. Monthly reports will analyze results by vendor, device model and location.
Monthly Reports
Never Expose BACnet to the Public Internet
While the BACnet standard allowed for some basic level of security, nothing on the market today supports it. I’m told the BTL testing labs have also never certified a device supporting this to date. If someone can discover a device, they can start commanding objects and changing settings with freely available BACnet tools.
Results of exposing devices could range from annoying to real damage. Turning the heat off in during a winter holiday weekend, to downloading corrupt firmware / program files bricking devices.
If remote access is required its extremely important to either use VPNs or more secure protocols to transit the public internet.
Report Details
Shodan’s report contains the IP address, banner, timestamp, host name, and location based on the IP address. For BACnet hosts that respond, the banner will contain the instance, object name, device location, vendor name, BDT table, application / firmware version, device model and name.
Our scripts parse Shodan’s banners to do some basic classification on the host. Hosts that responded with valid responses are considered BACnet devices. Unknown hosts are hosts that either have invalid BACnet responses, BACnet error messages, or empty banners. Hosts that reply with a BACnet error message are considered Unknown / Suspected BACnet devices.
After classifying the hosts, they are sorted and the occurrence each vendor and device model is calculated. Since some control vendors have identity crises requiring additional filtering. Honeywell for example uses “Honeywell”, “Honeywell International, Inc” and “Honeywell International Inc.”. Vendor names reduced to alpha numeric characters with spaces removed when calculating vendor totals. Additional rules look for the first occurrence of a vendor known to use multiple different names and all further occurrences of any variation are counted together.
Additional BACnet Security Research
- BACnet WAN Security Threat Assessment
- Public BACnet Devices for DDOS
- Analysis of Security Issues in Building Automation Systems
Public BACnet Scanning
There are several other actors constantly scanning the internet for BACnet devices. Using honeypots we regularly see scans from the following organizations as well as other unidentified sources.
BACnet ASOS Report- September 2018
September 2018 ASOS summery below.
- Total Hosts with 47808 Exposed – 17,322
- Total BACnet Hosts – 11,914
- Total Unknown / Suspected BACnet- 1,822
- Total Unknown – 3,586
- Total Number of Vendors -108
BACnet ASOS Report- August 2018
Augest 2018 ASOS summery below.
- Total Hosts with 47808 Exposed – 14,757
- Total BACnet Hosts – 11,487
- Total Unknown / Suspected BACnet – 1,790
- Total Unknown – 1,477
- Total Number of Vendors – 115
BACnet ASOS Report- July 2018
July 2018 ASOS summery below.
- Total Hosts with 47808 Exposed – 14,434
- Total BACnet Hosts – 11,304
- Total Unknown / Suspected BACnet – 1,772
- Total Unknown – 1,358
- Total Number of Vendors – 112
