Posts

Your commercial office is the next Target for hackers – Part: 2

/0 Comments/in , , /by

What happens when hackers springboard from your building automation system to your tenants’ networks

By: Zach Denning

 

I’d like to preface this article by stating that during our research we reached out to every building owner that had vulnerabilities with details of information we discovered – All without cost to them and without the expectation of future work.

At no time did we attempt to login or ‘hack’ a building automation system – We simply tested these networks for vulnerabilities easily exploited by hackers.

It’s our initiative to secure sites where our HVAC Partners implement our software platform while educating owners of vulnerabilities relating to building automation.

 

In the last article  ‘Your building is the next Target for hackers’ we discussed how easy it is to penetrate building automation systems and even new ways to drop a virus payload to the network through open protocols like Bacnet IP.

We even found over +300 different buildings with the Bacnet IP port open to the Internet, screaming to get hacked.

Didn’t read it? No worries, this article is the one for you, as we explore what happens when your building becomes the target of a hacker!

Here are a few fun facts to peruse through if your building happens to become a hacker’s playground:

    • All of your files are now garbage: $80,000.00 in lost time/revenue per tenant

      A virus spreads throughout a network like cancer through a body, injecting its code into every file. If somebody attempts to wipe the virus they would have to clean every file.

      Virus removal is extremely time consuming and challenging as providers have to ensure complete removal or there’s a chance it will re-emerge at a later time.

    • You hire an IT security contractor to retrieve lost files: $30,000.00/month/tenant

      Unfortunately, cleaning files typically on retrieves 30% of files on average – Meaning the remaining files must be recreated from old archives – Because you’ve been backing up files for years…

    • You get sued: +$2M

      Every lease is different, but in some leases it’s the owner’s responsibility to maintain the building automation. When it becomes the spring-board for a major hack chances are you’re going to get sued.

      To make matters worse, your Internet Security Insurance Policy won’t cover anything because your existing security didn’t meet minimum requirements – Sorry!

    • You lose tenants: $90,000/lost tenant

      Unlike common HVAC issues and comfort calls, network breaches carry much more backlash that stretch the limits of your tenant relationships – Which makes sense figuring you may have cost them hundreds of thousands of dollars.

Half of those reading write off articles like this as a “doomsday” scare tactic – The remainder think it will never happen to them.

Our advice? Have someone on your staff or a provider search for your building automation system on the Internet and see what you find. If you happen to come across your IP-address you need to hire an IT provider to put your building automation system behind a secure firewall.

  • Total costs to secure your system: $4,000.00 – 5,000.00
  • Total costs if you get hacked: $500,000 – $3,000,000.00
May the odds ever be in your favor!

My name is Zach Denning and I’m the CEO and owner of EnerDapt, Inc. We’ve developed an HVAC AI software platform that strengthens relationships between service providers and property management, while reducing operating costs 18-22%.  You can reach me at zdenning@enerdapt.com or visit our website at www.enerdapt.com

Your commercial office is the next Target for hackers – Part: I

/0 Comments/in , /by

We researched how hackable building automation systems are in Sacramento and the results are surprising!

By: Zach Denning

 

I’d like to preface this article by stating that during our research we reached out to every building owner that had vulnerabilities with details of information we discovered – All without cost to them and without the expectation of future work.

At no time did we attempt to login or ‘hack’ a building automation system – We simply tested these networks for vulnerabilities easily exploited by hackers.

It’s our initiative to secure sites where our HVAC Partners implement our software platform while educating owners of vulnerabilities relating to building automation.

 

“My HVAC contractor told me that if he has remote access to our building service calls are half-priced. All we have to do is connect our building automation system to the Internet and we can save hundreds every month!”

And just like that your office building is now part of the ‘low-hanging fruit’ every hacker dreams of getting access to. But it’s just your HVAC system. All they can do is turn the temperature up and down, right? Wrong.

At least 65% of all building automation systems are connected into existing building infrastructures via hardwired, Ethernet connection. Unfortunately, most offices don’t properly segregate the building automation from the same network as their tenants (Typically done through a VLAN or virtual separation of physically connected networks) as it’s costly to setup and maintain.

Meaning a virus enters your network via the building automation and can jump or ‘springboard’ from tenant-to-tenant at will – Return vital information back to its host (Account numbers, logins, credit card numbers, etc.) like the Target hack. But you’ve been told your building automation is secure – You’re behind a firewall – It’s only Bacnet – This will never happen to you – Wrong!

We researched how secure building automation systems were in Sacramento and found –

 

  • There are +300-different building automation systems openly exposed to the Internet without a firewall.

    Of the 82 systems tested, we found 18 had default admin user credentials where there was an ability to login to the automation system and get full access to override the system, change setpoints, schedules, etc. More importantly, admin permissions included unrestricted access to the file transfer protocol features which is pivotal for – You guessed it – Uploading a virus!

  • 114-different building automation systems behind a secure firewall with the Bacnet IP port (UDP:47808) exposed.

    Despite being open to the Internet, the building automation systems at these sites were nested behind extremely capable firewalls. Unbeknownst to the building owner though, the HVAC contractor had accidently enabled the Bacnet IP traffic on their front-end hardware – Enabling full access to all control setpoints and the ability to springboard viruses onto their network.

Wait, I thought Bacnet IP could only be used for HVAC-related data? Wrong again.

Bacnet IP is a communication protocol built on the foundation of HVAC communications with one slight caveat – It allows for open file transfer! In developing our Bacnet driver, we discovered that most Bacnet IP-enabled devices will accept a file transferred from our IP-device if it matches a certain criterion of name, type, size, etc.

All a hacker has to do to upload a virus to your building is –

 

  • Scan the building automation system for file types
  • Create a new file with one of the discovered types and infect it with a virus payload
  • Send the file to the building automation device

 

Even when the device rejects the new file, the originator can keep changing file types until one is accepted (i.e. – configuration files, history files, etc.). From there the virus springboards to every connected device on its network – Infecting as many files as possible, collecting information and reporting everything back to the host.

So how do you prevent hackers from getting into your network?

Check out Part: II of this post next week to learn more and see how much it costs to not secure yourself!

 

 

My name is Zach Denning and I’m the CEO and owner of EnerDapt, Inc. We’ve developed an HVAC AI software platform that strengthens relationships between service providers and property management, while reducing operating costs 18-22%.  You can reach me at zdenning@enerdapt.com or visit our website at www.enerdapt.com

Your building is smart – And so are squirrels!

/1 Comment/in , /by

3-reasons why your building is dumber than you think and what you can do to fix it

 

By: Zach Denning

The biggest technological fallacy for the last 3-years in commercial buildings is how HVAC systems fit into the “Smart Buildings” bubble. HVAC and building automation manufacturers have plagued the market with overhyped marketing and underdelivered results on the foundation of buzzwords like “analytics,” “machine-learning” and “smart.”

So what is actually installed in your building and is it really “smart?”

Smart HVAC controllers/sensors: IQ Score – 5

The latest addition to the Smart Buildings market has been the insurgence of smart sensors and HVAC controllers – “IP-enabled” being the core-feature at the forefront of the movement. Because which IP-based devices aren’t smart, right?

Here’s a list of IP-enabled devices that are smarter “out-of-the-box” than their HVAC counterparts –

  • Smart diapers
  • Smart couch
  • Smart fridge

… I think you get the picture, but how is a smart diaper more intelligent than your IP-sensors?

Although IP-enabled devices aren’t exactly cutting-edge, the commercial HVAC market typically lags 8-10 years behind most technology-based industries. There are numerous documented issues surrounding IP in HVAC including security, installation, maintenance, etc. – All leading to it’s snail-paced entrance into the built environment.

Not to mention, there’s typically little monetary gain by adding IP-based technology in HVAC as any added value is underutilized by the corresponding software – Which is heavily customized by the installing contractor and relatively unusable/unserviceable post-install without serious re-development.

Equipment manufacturers have also leveraged into Smart Buildings by pre-packaging equipment with new onboard sensors and controllers – Each offering new insight into equipment operation and servicing. Unfortunately, analyzing one element in a complex, multi-tiered system lacks the value generation necessary to overcome the added investment.

Imagine paying an extra for $500.00 for a smart steering wheel versus a fully autonomous car – I’d rather have one comprehensive solution than an alarm when I’m not at ‘ten-and-two.’

Building automation systems: IQ Score – 25

In recent years, many articles have cited onsite engineers noting the only difference between pneumatic, air-controlled HVAC systems and electronic systems is, well, air – Despite the fact that pneumatic technology is +50 years old.

Even worse, the same staff didn’t see a difference between building automation and a time clock – So where’s the intelligence?

Digging deeper, engineers have exposed the ability to remotely access their HVAC as justification to upgrade from older pneumatic systems. Not a bad start, although it’s the equivalent of using IBM’s new Q quantum computers to surf the web – I don’t see anyone paying $1,000/sec to stream NetFlix anytime soon!

Most building automation installations utilize less than 8% of the total system capacity necessary to maximize operational efficiency. Even worse, capacity is often eroded by nearly 40% annually through third-party interaction and modification.

Ultimately, your brand new $5.00/sq. ft. “smart” building automation system has less intelligence than the RainBird irrigation system you installed in your backyard – Three years from now it’ll be comparable to a simple light-switch!

Analytic software platforms: IQ Score – 35

“Analytics” and “machine-learning” have gained the most notoriety as buzzwords in the HVAC Smart Building space. New platforms emerge monthly that promise to solve all your HVAC problems and alleviate tenant complaints – Of course they’re smart, right?

We’ve collectively seen five-different analytics platforms installed in three-different market verticals with zero end user engagement or measurable outcomes – Equating to an extra 25-30% in upfront building automation capital requirements and no monetary gains – How could this happen?

Analytics platform developers constantly market the ability to implement cutting-edge, machine-learning algorithms capable of driving massive savings. I have the ability to become an astronaut. It may require 10-years of strenuous physical and mental development, coupled with a 1% chance of success – But who’s to say I don’t have the ability!

Furthermore, most platform developers rely on partner channels to develop and implement algorithms designed to drive actionable intelligence to end users. Unfortunately, 75% of all partners don’t employ software developers and rarely have the knowledge to implement anything beyond real-time alarms – Equivalent to the tire pressure alarms in your car.

Even in the most advanced implementations, HVAC analytics software deliver little actionable intelligence designed for financial decision-makers. It’s one thing to find a broken part- It’s quite another to validate that incident to a non-technical decision maker.

When’s the last time you rushed to a mechanic when your check engine light went off? Now imagine your check engine light –

  • Told you the problem was your air filter
  • Was costing you $25.00/month in gas
  • Was only $50.00 to replace

Oh, and here’s a local certified mechanic that specializes in Hondas less than 2-miles away – That’s true actionable, financial intelligence your system lacks!

Maybe you choose to ignore the check engine light, but not without significant guilt. Moral of the story, all intelligence isn’t created equal and your platform probably lacks any.

How to avoid the pitfalls of “smart” building technology!

If you consider your building “smart” and it falls under any of these categories, there’s still hope to increase its IQ. Next time you invest in building technology answer these simple questions –

  • How does this technology drive my bottom line and does the installer have proven results in a similar application?
  • How do you plan on maintaining the technology post-installation? In house? Outsourced?
  • Can the technology communicate actionable intelligence across my entire corporate hierarchy? Can the CFO glean valuable HVAC investment insights? Will your engineers know when and where components are failing?

The high-tech landscape of the HVAC market is evolving – Unfortunately marketing has a big head-start on actual technology!

 

My name is Zach Denning and I’m the CEO and owner of EnerDapt, Inc. We’ve developed an HVAC AI software platform that strengthens relationships between service providers and property management, while reducing operating costs 18-22%.  You can reach me at zdenning@enerdapt.com or visit our website at www.enerdapt.com

Energy Savings – Your Next Blind Investment!

/0 Comments/in /by

 

Blind investments into energy

Would you make an investment without a guarantee? Why are building energy projects any different?

Minimize investment losses with OCMS

By: Zach Denning

 

You build your team of industry experts – All-star contractor, the best energy firm and your aggressive utility rep. Everybody working together to get the highest Return on Investment (ROI) coupled with the latest utility rebates for your latest energy investment. The project looks like a winner – 1 1/2 year payback and your utility covering 50% of the total project costs courtesy of your team’s ingenuity. What could possibly go wrong?

Six months post-project and you get an energy report that doesn’t make sense – You’re $15k off from the projected energy savings! What could it be? You invested hundreds into advanced energy dashboarding and cutting edge monitoring, so how did this happen? You put your team into motion and after several meetings and thousands in consultations they find the culprit is a few failed parts on retrofitted units. Crisis averted! Or was it?

Lost energy, emergency repairs, and consulting fees have cost you tens of thousands of dollars for what could have been an easy fix. Introducing Operating Cost Management Systems (OCMS) – Your insurance policy for energy investments! These systems are capable of finding and quantifying issues before they impact your savings – Turning emergency maintenance costs into planned, strategic investments.

By predicting and quantifying potential failures in your building your able to proactively reconcile these issues and understand how your savings are affected; Giving you complete financial visibility into your operating costs and the tools to properly manage your energy investment. Utilize these systems in your next energy project to reduce your risks and gain valuable financial insight in how your building operates!

 

My name is Zach Denning and I’m the CEO and owner of EnerDapt, Inc. We’re an HVAC engineering firm that utilizes cloud-baesd technology to bridge the technical and financial gaps commonly found in HVAC management strategies. Our OCMS EnerVise platform keeps customers knowledgeable about their building from life-cycle costs to forecasted maintenance, upgrades, andequipment replacements.   You can reach me at zdenning@enerdapt.com or visit our website at www.enerdapt.com

OCMS; Building Operating Cost Management