Experts explained how to hack a building controller widely adopted in Russia

A researcher discovered critical flaws that can be exploited by remote attackers to hack a building controller popular in Russia.

A researcher has identified critical vulnerabilities that can allegedly be exploited to remotely hack a building controller predominantly used by organizations in Russia.

Researcher Jose Bertin discovered critical flaws affecting a controller made by Russian company Tekon Avtomatika which is widely used by organizations in Russia.

Tekon Avtomatika is an equipment supplier company dispatching elevators and buildings, water and heat metering.

Querying the Shodan search engine, Bertin discovered more than 117 devices connected to the internet located in Russia that are running with default credentials. The expert explained that anyone can access the Internet-facing systems and perform changes and actions as “admin” only.

The expert found the default credentials (default credentials are admin:secret) in manuals firmware and software for its building controller models.

The researchers demonstrated that using default credentials could gain admin privileges to the user interface of the Tekon building controller. The was also able to execute code with root privileges by abusing a feature implemented by the vendor to allow users to upload their custom LUA scripts “plugins” through a section of the UI.

Upon clicking the “Save/Load” button, the uploaded code will be executed.

The researcher created a proof-of-concept (PoC) script that allowed him to obtain root privileges and take complete control of the targeted device and potentially cause significant disruption.

The expert published a blog post that describes a step by step procedure to achieve remote code execution with root privileges.

“Well i got RCE and privilege escalation from an admin user to root , now we can do whatever, more critically those devices can be shut down at once the 100 creating an impact in russian scada systems , remotely.” wrote the expert. “From this point now we can create custom cgi files and call them from cgi/bin path and do whatever.”

Bertin told SecurityWeek that he did not contact the vendor before publicly disclosing the issues.

Clearly, the public disclosure of the post could allow threat actors to use the procedure to take over the building controller devices and conduct malicious activities, including sabotage.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Building Controller)