Over 2,000 unprotected building automation systems found in Finland
The Finnish Communication Regulatory Authority has been mapping unprotected automation systems from networks in Finland. The 2018 results match those from previous years, with over 2,000 vulnerable systems being discovered.
Discovery of the unprotected systems were done in February and May. All of the findings were reported to the owners and maintainers of the systems. The reason for the activity is to collect statistics to create an image of what is security level of the automation systems is in Finland
Around 20 of the unprotected systems were industrial automation systems, comprising of a total of 300 individual devices. Building automation was the largest group with over 2,000 vulnerable devices found during the scanning. The numbers are close to the 2017 results.
Building automation systems' doors wide open
The most critical finding was a single automation device in the food industry. The situation was remedied swiftly after FICORA contacted the company. In general the responsiveness of industrial companies to discovered vulnerabilities was swift and responsible.
From the results it is apparent that building automation systems do not receive the attention they need. There is a large number of home and building automation systems vulnerable for access through the internet. These systems often manage heating and other core functions.
Building automation systems make for an interesting target for attackers as was discovered when heating was turned off in several buildings by an attack during the winter of 2016:
A Distributed Denial of Service (DDoS) attack halted heating distribution at least in two properties in the city of Lappeenranta, located in eastern Finland. In both of the events the attacks disabled the computers that were controlling heating in the buildings.
- DDoS attack halts heating in Finland amidst winter
FICORA reminds the real estate industry to pay special attention to building automation system security. Professionals managing the physical safety and maintenance of buildings, are in key position to maintain and inform inhabitant's of cyber security issues.
More details are available in the complete report (in Finnish): Suojaamattomia automaatiolaitteita suomalaisissa verkoissa 2018
Source: Tuhansia automaatiolaitteita suojaamattomina suomalaisissa verkoissa