Douglas McKee - HVACking: Understand the Delta Between Security and Reality

HVAC Security Failures

Douglas McKee (Lead Vulnerability Researcher, McAfee ATR) presents findings from a systematic assessment of enterprise HVAC and building automation systems (BAS), revealing severe security gaps that allow attackers to manipulate physical infrastructure.

BACnet and Modbus Exposure

Building automation protocols (BACnet, Modbus, LonWorks) were designed without authentication or encryption. McKee demonstrates scanning for internet-exposed BACnet/IP devices and enumerating available control points (temperature setpoints, damper positions, alarm states) with no credentials required.

Corporate Network Lateral Movement

In typical enterprise environments, HVAC controllers share network segments with IT infrastructure. McKee demonstrates pivoting from a compromised workstation to the BAS network and remotely controlling CRAC units in data centers — potentially causing thermal damage or triggering fire suppression systems.

Vendor Response

The talk covers disclosure efforts with major BAS vendors and the difficulty of patching legacy embedded controllers deployed in multi-decade building infrastructure.