「英中对照」网络安全厂商Armis Labs称传统BACnet协议令楼宇自控、暖通等系统易遭黑客攻击

Dive Brief:Dive 简报：

• Almost three-quarters of facilities have the kind of building automation system that has been targeted in ransomware attacks, an analysis by cybersecurity company Armis Labs says. 近四分之三的设施都配备了已成为勒索软件攻击目标的那类楼宇自动化系统，网络安全公司 Armis Labs 的一项分析称。
• The high percentage stems in part from the legacy BACnet standard that most building systems use, the company says. The standard was introduced in the 1990s without security protocols because the systems at the time weren’t network connected.该公司称，这一高比例在一定程度上源于大多数楼宇系统所采用的传统 BACnet 标准。该标准于 20 世纪 90 年代推出，当时并未包含安全协议，因为当时的系统尚未联网。
• The open communication standard is now an organizational vulnerability that bad actors can exploit, the company says. It pointed to a hack in August of Shared Health, the largest hospital in Manitoba, Canada, in which hackers seized control of the facility’s elevators, HVAC monitoring system and security office, affecting its ability to issue access badges. “Attackers have worked out that they do not need to encrypt data” for ransom, the company says, “when they can seize badges, pressure the building relationships that clinical work depends on, and put operating-room climate on the table.”     该公司表示，这种开放通信标准如今已成为恶意行为者可利用的组织级漏洞。该公司提到了今年8月 Shared Health 遭遇的黑客攻击，它是加拿大曼尼托巴省最大的医院。攻击中，黑客夺取了该设施电梯、HVAC 监控系统和安保办公室的控制权，影响了其发放门禁卡的能力。该公司表示：“攻击者已经明白，若能夺取门禁卡、对临床工作依赖的楼宇联动关系施压，并把手术室环境作为要挟，他们就无需为勒索而加密数据。”    

Dive Insight:Dive 洞察：

There isn’t widespread targeting of building systems, but as hackers become more familiar with their vulnerabilities, facility managers can expect to see them increase, Troy Cruzen, virtual chief information security officer at Fortified Health Security, told Facilities Dive last year. Fortified Health Security 的虚拟首席信息安全官 Troy Cruzen 去年告诉 Facilities Dive，楼宇系统目前尚未成为广泛攻击目标，但随着黑客对其漏洞愈发熟悉，设施管理人员预计此类攻击将会增加。 

These systems “were just designed to provide HVAC capabilities,” said Cruzen, whose company specializes in hardening healthcare facility systems. “That’s just the reality of hackers. They can leverage those vulnerabilities and make it a bigger deal than they were designed to be.”  这些系统“不过是为提供 HVAC 功能而设计的，”Cruzen 说，其公司专门从事医疗设施系统加固。“黑客的现实就是如此。他们会利用这些漏洞，使其严重程度超出这些系统的设计预期。”  

The use of AI is accelerating hackers’ learning curve, says the analysis from Armis, which workflow automation company ServiceNow acquired earlier this year. Armis 的分析称，AI 的使用正在加快黑客的学习进程；工作流自动化公司 ServiceNow 今年早些时候收购了该公司. 

“AI-accelerated vulnerability research is shortening the time between a flaw being found and weaponized,” Armis says. “AI 加速的漏洞研究正在缩短漏洞从被发现到被武器化之间的时间，”Armis 表示。 

Meanwhile, patching vulnerabilities remains slow because of the role of HVAC and other systems in building operations. “Critical infrastructure cannot simply be taken offline,” the company says. “The remediation backlog grows faster than teams can clear it.”同时，由于 HVAC 及其他系统在楼宇运营中的作用，漏洞修补仍然缓慢。公司表示：“关键基础设施不能简单下线。”“修复积压的增长速度快于团队的清理速度。”

Armis says 73% of organizations have at least one known exploited vulnerability in their building systems, and that exposure is likely to grow because 91% of the systems organizations are using communicate over insecure protocols, including BACnet. Other legacy protocols are KNX, which is used mainly in Europe, and Modbus. Armis 表示，73% 的组织在其楼宇系统中至少存在一个已知被利用漏洞，而且暴露范围可能会扩大，因为各组织正在使用的系统中有 91% 通过不安全协议通信，包括 BACnet。其他遗留协议包括主要用于欧洲的 KNX 以及 Modbus。 

Hackers exploited KNX vulnerabilities in 2021 when they locked out office operators in Germany from their building systems. The hack left most of the building devices inaccessible, affecting lighting, motion detectors and shutter controllers. “The attackers turned the system’s own security feature against it, wiping devices and locking them,” Armis says. 2021 年，黑客利用 KNX 漏洞，将德国的办公场所运营商锁定在其楼宇系统之外。此次攻击导致大多数楼宇设备无法访问，影响照明、运动探测器和百叶窗控制器。Armis 表示：“攻击者反过来利用系统自身的安全功能，擦除设备并将其锁定。” 

HVAC systems, chilled water plants, fire and life safety devices and elevators, among other systems today, are designed to be integrated into the organization’s network, but the systems generally remain built on vulnerable protocols, Armis says. Armis 表示，如今，HVAC 系统、冷冻水站、消防与生命安全设备、电梯以及其他系统在设计上均可集成到组织网络中，但这些系统通常仍基于易受攻击的协议构建。 

The “installed base” of the systems “carries decades of insecure-by-design technology now exposed to a faster, more automated threat landscape,” the company says. 公司表示，这些系统的“装机基数”“承载着数十年在设计上不安全的技术，如今暴露在变化更快、自动化程度更高的威胁环境中”。 

The company calls for organizations to treat the security of building automation systems as a business continuity problem, not a technology problem, and concentrate security responsibility into one hand, rather than having facilities manage security of building systems while IT manages security of information systems.   公司呼吁各组织将楼宇自动化系统安全视为业务连续性问题，而非技术问题，并将安全责任集中到一方，而不是由设施部门管理楼宇系统安全、IT 部门管理信息系统安全。   

“The organizations handling this well … classified building automation as a business continuity system, gave it a named owner instead of leaving it between facilities, IT, and the integrator, and held it to the same standard as the clinical, trading, or production systems it quietly keeps running,” Armis says. “The goal is not a perfect posture. It is a shrinking attack surface and uninterrupted uptime.”Armis 表示：“处理得当的组织……将楼宇自动化归类为业务连续性系统，为其指定明确负责人，而不是让责任悬在设施、IT 和集成商之间，并以与其默默保障运行的临床、交易或生产系统相同的标准要求它。目标不是完美的安全姿态，而是缩小攻击面并实现不间断运行。”