Penetration Testing on the IoT Front Lines

Hackers in the Heating Ducts

Every respectable action movie hero in recent decades has snuck into at least one building through a ventilation shaft. Today’s hackers know it’s still a go-to move. 

In fact, one of cybersecurity’s historic wake-up calls was the 2014 theft of more than 110 million credit card records from retail titan Target. Nearly every consumer heard about that one. But many people don’t know that the hackers’ path into the system ran through the contractor handling Target’s HVAC (heating, ventilation, and air conditioning) system. After using a phishing scheme to dupe one of the contractor’s employees, hackers got a login credential for Target’s network and went hunting for valuable records. 

Since then, the growing ubiquity of the Internet of Things (IoT), has added dozens of devices with their own IP addresses to most building control systems. That makes physical plants target-rich environments for hackers seeking their own Target-style conquest—and it turns the company handling your office’s thermostat into a frontline cyber defender. 

That’s a familiar position for Baker Group, which has established itself as a leader in installing and servicing some of the Midwest’s most advanced building systems. Founded in 1963 as a plumbing company and now based in the Des Moines suburb of Ankeny, Baker Group has grown to more than 650 employees focused on the design, installation and servicing of commercial, industrial and institutional building systems. Teams within the company specialize in HVAC, electrical, plumbing, security systems, facility maintenance and operations and more. 

'You Can't Ignore It'

When Blake Brown, Baker Group’s IT director, started looking for a vendor to perform a vulnerability scan and penetration test, his own understanding of the ever-growing threat landscape delivered plenty of motivation. But the company’s vendors and customers added their own urgency by stepping up their requirements for cybersecurity validation. “I saw this was going to become more frequent,” Brown says. 

The devastating brand implications of a potential breach like Target’s also pushed the vulnerability scan/pen test to the top of the priority list. The 2020 IBM Cost of a Data Breach Report shows that lost business accounts for nearly 40% of the cost of a security incident. Brown knew that number would be even more significant if a breach hit a company known for installing security systems. 

“We have a lot of clients where we manage their networks connected to the internet,” Brown says. “Looking at past history with other breaches that were related to mechanical contractors, it can turn into quite a negative PR event for us. That was a major driving force behind it. You can’t ignore it.” 

When it came to choosing a vendor for the tests, Brown says, “HBS was a pretty easy choice.” The companies first teamed up on a 2019 presentation where HBS leaders showed Baker Group customers how easy it was to hack proximity card readers and other security systems. “We knew a lot of that,” Brown says, “but it still was an eye opener.” After checking references and finding HBS’s pricing competitive, Baker Group scheduled their tests. 

In the first stage,  Jason Moulder, an Offensive Security Certified Professional, ran an automated vulnerability scan on dozens of Baker Group IP addresses. “We’re trying to identify low-hanging fruit in an environment,” Jason says. “We’re looking for known vulnerabilities, the installation of patches from Microsoft and others, etc. We’re making sure they’re following that process.” 

Then comes the pen test. Jason says, “That’s the manual process of looking for ways we can make the system better,” with a focus on three key factors: People, process and technology (known as PPT). 

Reacting to the Results

When the results came in, Brown says he was pleasantly surprised by two things. First, the test revealed fewer vulnerabilities than he expected. Second, HBS’s list of recommended next steps positioned Brown’s team to quickly address the shortcomings.