Exposed Data Centers - Bypass IT Security, Crank Up the Heat

The talk starts from a public list of about 1,200 US data centers that a news outlet had left in a cloud storage bucket. The researchers expanded it with a proximity method they call geostalking, querying Shodan for internet-facing devices near each facility. They focused on building automation such as HVAC and fire systems, and on power-supply controllers. They did not scan or touch the devices themselves, relying only on data Shodan already held.

After filtering out honeypots, hosting-provider addresses and banners that did not match their protocols, the set narrowed to about 6,300 high-confidence exposed systems across 1,063 data centers. BACnet made up most of the findings, followed by Niagara Fox. Many devices ran protocols never meant for the open internet, and about 15 percent had a CVSS score of 9.0 or higher. The presenters stressed that location data is approximate and that the results are hypotheses, not verified intrusions. They also sketched an attack path: reconnaissance, initial access, mapping which controls run cooling and power, then disabling alarms or pushing temperatures up to damage hardware.

The main takeaway is that building automation often sits outside the Purdue model and outside the security team's control, particularly for tenants. Organizations should look for their own exposed controllers, remove unnecessary internet access, and bring OT governance into the same policies that cover IT.