Mixing industrial protocols with web application security

In this presentation at the DEF CON 27 IoT Village, Bertin Bervis demonstrates novel attack surfaces that emerge when combining modern web application vulnerabilities with legacy building automation protocols. He begins at 06:00 by challenging the assumption that operational technology networks and building controllers are insulated from web threats due to network air-gapping, showing how internal browsers can be leveraged as proxies to reach internal devices.

Bertin introduces the BACnet protocol architecture at 12:00, examining the BACnet Virtual Link Control (BVLC) and application layer frames used to control HVAC units, smart lighting, and building access points. At 18:00, he demonstrates how an attacker can craft raw binary BACnet packets using standard web technologies, such as Server-Side Request Forgery (SSRF) and malicious WebSockets executed in a victim's web browser, to bypass firewall and cross-origin boundaries.

At 24:00, Bertin details his testing methodology using real internet-connected building automation controllers. At 30:00, he demonstrates cross-protocol exploitation, where a malicious web page tricks an internal client into delivering BACnet commands to physical building hardware. He highlights command execution vulnerabilities at 36:00 and provides actionable defense-in-depth guidance for network engineers and building operators to isolate industrial protocols from web-facing client networks. (AI summary — Gemini Flash)