{"id":310,"date":"2021-05-25T11:46:14","date_gmt":"2021-05-25T08:46:14","guid":{"rendered":"https:\/\/zerontek.com\/zt\/?p=310"},"modified":"2022-06-30T17:27:28","modified_gmt":"2022-06-30T14:27:28","slug":"wireshark-bacnet-security-analysis","status":"publish","type":"post","link":"https:\/\/zerontek.com\/zt\/2021\/05\/25\/wireshark-bacnet-security-analysis\/","title":{"rendered":"Wireshark: BACnet security analysis"},"content":{"rendered":"\n

BACnet (Building Automation and Control Networking Protocol) is an ICS protocol, developed by ASHRAE (American Society of Heating,Refrigerating and Air Conditioning Engineers). Like most ICS protocols, BACnet suffers from design vulnerabilities [source 3] such as poor implementation, lack of encryption and ability to load files (firmware) into BACnet devices making it open to various attacks [source 2] such as network mapping and Dos attacks (abusing broadcast messages)…etc. BACnet devices can be found in online search engines such as Shodan<\/a> , just type “port:47808” or “bacnet” in Shodan’s search bar. BACnet Firewall Router (BFR)<\/a> is an open source technology that can help secure this protocol against network mapping and Dos and spoofing [Source 2] and and its ability to filter BACnet packets. In this article I have assembled a list of filters and messages that can help you towards securing your network and assets if you are using BACnet protocol.<\/p>\n\n\n\n

BACnet traffic analysis helps in understanding BACnet normal and abnormal behavior in your network. It’s also useful to develop firewall\/IDS\/IPS rules and most importantly monitoring operation (see 1st table) and security messages (see 2nd table). BACnet traffic can be analyzed using tools such as Wireshark. I mentioned in my article “Wireshark filters for ICS protocols<\/a>“that BACnet is supported by Wireshark. Check out the Wireshark filters for BACnet here<\/a>. To get started quickly, here are the common filters to use in Wireshark that can aid you with your investigation:<\/p>\n\n\n\n

<\/p>\n\n\n\n

bvlc || bacnet || bacapp<\/td>BACnet packets<\/td><\/tr>
bacnet<\/td>BACnet NPDU packets<\/td><\/tr>
bacnet.mesgtyp<\/td>BACnet Network Layer (router) packets<\/td><\/tr>
bvlc<\/td>BACnet\/IP packets<\/td><\/tr>
bvlc.function == 0x0b<\/td>BACnet\/IP Broadcast packets<\/td><\/tr>
bacapp<\/td>BACnet APDU packets<\/td><\/tr>
bacapp.confirmed_service == 12<\/td>BACnet ReadProperty packets<\/td><\/tr>
bacapp.confirmed_service == 15<\/td>BACnet WriteProperty packets<\/td><\/tr>
bacapp.unconfirmed_service == 0<\/td>BACnet I-Am packets<\/td><\/tr>
bacapp.unconfirmed_service == 8<\/td>BACnet WhoIs packets<\/td><\/tr>
bacapp.unconfirmed_service == 2<\/td>BACnet UnconfirmedCOVNotification packets<\/td><\/tr><\/tbody><\/table>
Source: 1<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"
BACnet WhoIs packets<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"
I-Am-Router-To-Network (0x01)<\/figcaption><\/figure>\n\n\n
\n
\"\"
Who-Is-Router-To-Network (0x00)<\/figcaption><\/figure>\n<\/div>\n\n\n

So, what are the BACnet security messages that are worth watching in your network traffic ? . They can be found using this filter: bacnet.mesgtyp<\/span><\/strong> and see the below table for those messages’ codes. Just look for the message inside the “Network Layer Message Type” section.<\/p>\n\n\n\n

0x0A<\/td>Challenge-Request<\/td><\/tr>
0x0B<\/td>Security-Payload<\/td><\/tr>
0x0C<\/td>Security-Response<\/td><\/tr>
0x0D<\/td>Request-Key-Update<\/td><\/tr>
0x0E<\/td>Update-Key-Set<\/td><\/tr>
0x0F<\/td>Update-Distribution-Key<\/td><\/tr>
0x10<\/td>Request-Master-Key<\/td><\/tr>
0x11<\/td>Set-Master-Key<\/td><\/tr><\/tbody><\/table>
source: 2<\/figcaption><\/figure>\n\n\n\n

References:<\/p>\n\n\n\n

  1. Analyzing BACnet<\/a><\/li>
  2. Securing BACnet\u2019s Pitfalls<\/a><\/li>
  3. HOW IS BACNET VULNERABLE?<\/a><\/li><\/ol>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    BACnet (Building Automation and Control Networking Protocol) is an ICS protocol, developed by ASHRAE (American Society of Heating,Refrigerating and Air Conditioning Engineers). Like most ICS protocols, BACnet suffers from design vulnerabilities [source 3] such as poor implementation, lack of encryption and ability to load files (firmware) into BACnet devices making it open to various attacks […]<\/p>\n","protected":false},"author":2,"featured_media":355,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30,161,4,45,3,46,48,23,5,32,49],"tags":[50,55,7,54,42,6,52,44,53,56,47,20,43,27,51],"class_list":["post-310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-asset-identification","category-bacnet","category-cyber-security","category-ics-protocols","category-ics-security","category-ics-tools","category-ot-security","category-shodan","category-vendors","category-vulnerability-assessment","category-wireshark","tag-bacnet","tag-bacnet-filters","tag-cyber-security","tag-firewall-rules","tag-ics-protocols","tag-ics-security","tag-ics-security-consultant","tag-ics-tools","tag-ids-rules","tag-ips","tag-ot-security","tag-shodan","tag-wireshark","tag-zerontek","tag-51"],"_links":{"self":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/comments?post=310"}],"version-history":[{"count":41,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/310\/revisions"}],"predecessor-version":[{"id":827,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/310\/revisions\/827"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media\/355"}],"wp:attachment":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media?parent=310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/categories?post=310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/tags?post=310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}