Experts explained how to hack a building controller widely adopted in Russia

A researcher discovered critical flaws that can be exploited by remote attackers to hack a building controller popular in Russia.

A researcher has identified critical vulnerabilities that can allegedly be exploited to remotely hack a building controller predominantly used by organizations in Russia.

Researcher Jose Bertin discovered critical flaws affecting a controller made by Russian company Tekon Avtomatika which is widely used by organizations in Russia.

Tekon Avtomatika is an equipment supplier company dispatching elevators and buildings, water and heat metering.

Querying the Shodan search engine, Bertin discovered more than 117 devices connected to the internet located in Russia that are running with default credentials. The expert explained that anyone can access the Internet-facing systems and perform changes and actions as “admin” only.

The expert found the default credentials (default credentials are admin:secret) in manuals firmware and software for its building controller models.

The researchers demonstrated that using default credentials could gain admin privileges to the user interface of the Tekon building controller. The was also able to execute code with root privileges by abusing a feature implemented by the vendor to allow users to upload their custom LUA scripts “plugins” through a section of the UI.

Upon clicking the “Save/Load” button, the uploaded code will be executed.

The researcher created a proof-of-concept (PoC) script that allowed him to obtain root privileges and take complete control of the targeted device and potentially cause significant disruption.

The expert published a blog post that describes a step by step procedure to achieve remote code execution with root privileges.

“Well i got RCE and privilege escalation from an admin user to root , now we can do whatever, more critically those devices can be shut down at once the 100 creating an impact in russian scada systems , remotely.” wrote the expert. “From this point now we can create custom cgi files and call them from cgi/bin path and do whatever.”

Bertin told SecurityWeek that he did not contact the vendor before publicly disclosing the issues.

Clearly, the public disclosure of the post could allow threat actors to use the procedure to take over the building controller devices and conduct malicious activities, including sabotage.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Building Controller)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.