-: Premise system vulnerabilities. 2 2
In this lesson, we are going to talk about premise systems. 3 3
Now, what is a premise system? 4 4
Well, a premise system is a system used 5 5
for building automation and physical access security, 6 6
and these are a different type of network as well. 7 7
Oftentimes, you'll have this as a third network 8 8
in your organization. 9 9
When you're dealing with this and you go 10 10
to your front door or your building 11 11
and you try to get in and use your card and your pin, 12 12
that has to go through some kind 13 13
of an access control system. 14 14
That is a premise system, right? 15 15
That is physical access security. 16 16
If I look at the security cameras, 17 17
those are part of your premise system as well. 18 18
Now, when we deal with a premise system, 19 19
a lot of these system designs are going to allow 20 20
for monitoring to be available 21 21
across the corporate data network 22 22
or even directly from the internet. 23 23
And this is really great from a monitoring perspective, 24 24
it makes it really easy for us. 25 25
But this is also dangerous, right? 26 26
Because when we have a connection 27 27
to the corporate data network, that means 28 28
that somebody can hack into your premise network, 29 29
they can cross over into your data network. 30 30
And if you connect directly to the internet, 31 31
that might give them a way in into that premise network. 32 32
So these are things you have to think about 33 33
when you're dealing with security. 34 34
Now, in addition to this, 35 35
we also have building automation systems. 36 36
Now, building automation systems, 37 37
they have components and protocols 38 38
that facilitate the centralized configuration 39 39
and monitoring of your different mechanical 40 40
and electrical systems within offices or data centers. 41 41
Now, oftentimes you're not going to be controlling 42 42
the actual power generation, right, 43 43
that would be ICS and SCADA. 44 44
But you are going to have other ways to look at the information 45 45
inside your building through these automation systems. 46 46
For instance, at our offices, 47 47
we have a battery backup system. 48 48
This is a whole building system so that if we lose power, 49 49
we have that battery that can kick in 50 50
and support us for about 24 hours. 51 51
Now we have the ability to log into 52 52
that battery remotely over the internet 53 53
so we can see exactly how much battery is left, 54 54
how quickly our burn rate is, and things of that nature. 55 55
If you're in a bigger building, you might have elevators 56 56
and you want to be able to figure out 57 57
where the elevator is at any given time. 58 58
If you've watched any spy movie, 59 59
I'm sure you've seen the idea 60 60
of building automation systems 61 61
where they turn on and off the ACs, 62 62
or they turn on and off the elevators, 63 63
or turn on and off the lights to a particular floor. 64 64
That's what a building automation system really is. 65 65
Now, when you start dealing 66 66
with all these building automation systems, 67 67
they have lots of different parts 68 68
that could bring up vulnerabilities to your network. 69 69
So again, I like to keep these 70 70
as their own segment and network. 71 71
But when we start talking about these vulnerabilities, 72 72
we have things like the process 73 73
and memory vulnerabilities inside the PLCs, 74 74
because these building automations are going to use PLCs. 75 75
If you're going to control elevators and lighting 76 76
and water and fire mains and power, 77 77
all of those things do have PLCs 78 78
that you can control within your building. 79 79
Then we have to think about 80 80
how we're going to keep our credentials safe, 81 81
because oftentimes these things 82 82
have poor security management. 83 83
A lot of times people write their code 84 84
with plain text credentials or keys 85 85
inside the application code. 86 86
That way they'll say, my password is password, 87 87
and they'll put it right in the code, 88 88
and that could be exploited by an attacker. 89 89
Another thing I often see occur is code injections 90 90
against the web user interface. 91 91
A lot of these building automation systems, 92 92
the way that they are monitored is through a web interface, 93 93
whether locally or over the internet. 94 94
So if there is a web interface presented 95 95
that means an attacker could access that 96 96
and then do a code injection doing something 97 97
like an XML injection, an SQL injection, 98 98
a cross-site scripting injection, something like that. 99 99
And so you got to keep that in mind. 100 100
This is an area that could allow for somebody 101 101
to get into that network and then control your building. 102 102
Now, one of the things that we really have to worry about 103 103
with these premise systems and building automation systems, 104 104
is that they can be used 105 105
to create a denial of service condition in the real world. 106 106
Now, what do I mean by that? 107 107
Well, let's say I got a hold 108 108
of your building automation system 109 109
and I was able to do a code injection 110 110
and take access over it. 111 111
I could create a denial of service condition for you 112 112
that could affect your entire building 113 113
by turning off your HVAC, which is your air conditioner. 114 114
And if you have a server farm 115 115
and I take away your air conditioner, 116 116
that can overheat the systems and cause them to shut down. 117 117
Now, I have caused an electronic attack against your servers 118 118
by doing a physical attack by taking away your cooling. 119 119
These are the things you have to think about. 120 120
Another reason to worry about these systems 121 121
is often they're not well secured. 122 122
If you think back to 2015, 123 123
there was a big case of this in the news with Target. 124 124
Target is a big retail chain in the United States 125 125
and they actually had one of their contractors 126 126
who ran their HVAC systems, 127 127
their systems had gotten hacked 128 128
and somebody went through their systems 129 129
through the HVAC at the Target stores, 130 130
and then down into the point of sale systems, 131 131
the cash registers, and started collecting credit card data. 132 132
This was a huge breach and it was a huge black eye 133 133
for the corporation. 134 134
So remember, these building automation systems 135 135
could be used as an intrusion vector 136 136
as somebody who wants to pivot from that 137 137
into a more dangerous attack against your corporate network. 138 138
So you have to make sure the right protection's in place. 139 139
Now, the final thing I want to talk about 140 140
in this lesson is the idea of PACS, 141 141
which is the physical access control system. 142 142
Now, the physical access control system is all 143 143
of the components and protocols 144 144
that facilitate the centralized configuration monitoring 145 145
of security mechanisms within offices and data centers. 146 146
So when we start talking about all those security cameras 147 147
and the access control to badge in and badge out 148 148
of your building, 149 149
that is all part of your physical access control systems. 150 150
Now, PACS can either be implemented 151 151
as part of your building automation system 152 152
or as part of a separate system. 153 153
Either way will work. 154 154
It just depends on how your contractor sets it up 155 155
or how your organization sets it up. 156 156
Now, one word of warning here, PACS are often installed 157 157
and maintained by a third party external supplier. 158 158
And because of that, a lot of times people will omit that 159 159
from their risk analysis or their vulnerability assessments. 160 160
So as you're starting to think about your networks 161 161
and you think, okay, I've got this Windows Network here, 162 162
I've got this server farm here, 163 163
I might have this OT over here. 164 164
They don't think about the building network itself 165 165
because it's some third party contract. 166 166
So that's okay if you're going to exclude it from your scope 167 167
if you have that in writing that 168 168
that is part of their responsibilities. 169 169
And they would probably have some kind of requirement 170 170
to give you every quarter, every six months, every year, 171 171
some kind of a vulnerability statement 172 172
of what the network looks like. 173 173
Because again, you can outsource the task 174 174
but you can't outsource the responsibility. 175 175
If their network is tied to your network in any way 176 176
and there's a vulnerability on their network, 177 177
that means the attacker could get 178 178
from them to you just like they did with Target. 179 179
So keep that in mind.