HVACking: The difference Between Security and Reality

In this talk at the DEF CON 27 ICS Village, Douglas McKee from McAfee ATR shares his research uncovering critical vulnerabilities in commercial building automation and HVAC management systems. He introduces the investigation into Delta Controls ORCAview BACnet controllers at 04:00, walking through how he identified a remote heap-based memory corruption vulnerability in the device's network stack. He details the challenge of exploiting constrained microcontroller memory and executing arbitrary shellcode on embedded architectures.

Douglas explains how building automation systems rely on the BACnet protocol at 08:00, detailing how broadcast UDP restrictions were circumvented to make the attack routeable and exploitable across the public internet. At 12:00, he presents a firmware function hooking technique that enables an attacker to manipulate low-level input/output (I/O) control registers directly in microcontroller memory, establishing persistent, stealthy control over heating, ventilation, and cooling hardware.

At 16:00, Douglas outlines the severe real-world ramifications of compromised HVAC systems in sensitive environments such as hospitals, laboratories, and mission-critical data centers. He concludes with a live demonstration at 20:00, illustrating an attacker secretly altering physical temperature setpoints while tampering with the operator GUI to display normal operating conditions. At 24:00, he provides defensive recommendations for isolating building automation networks and preventing unauthorized protocol access. (AI summary — Gemini Flash)