BACnet
What is BACnet?
BACnetA building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication.
BACnet (Building Automation and Control networks) is the dominant communications protocol in commercial building automation. It is standardized as ANSI/ASHRAE 135 and ISO 16484-5 and underlies HVAC, lighting, fire-alarm, energy-management, and access-control systems in office buildings, hospitals, schools, data centers, and large industrial campuses. BACnet defines a layered protocol with multiple data-link options (BACnet/IP over UDP/47808, BACnet MS/TP over RS-485, BACnet/SC over TLS, plus older Ethernet, ARCNET, and LonTalk variants) and an object-oriented model of services and objects (Analog Input/Output, Binary Input/Output, Schedule, Trend Log, etc.). Legacy BACnet/IP has essentially no authentication: any host on the BACnet network can issue Write Property requests, broadcast Who-Is and I-Am, or inject device-control messages. The newer BACnet Secure Connect (BACnet/SC, 2020) runs BACnet over TLS-secured WebSockets and is the recommended path forward. Real-world incidents (including a 2017 ransomware attack on a Finnish heating control system and the 2024 Lviv FrostyGoop case, conceptually similar) routinely abuse weak BACnet posture. Defensive practices include strict VLAN isolation of building-automation networks from IT and OT-NDR coverage tuned for BACnet anomalies.
● Examples
- 01
A pen-tester maps a building's BACnet network with `Who-Is` discovery and demonstrates an unauthenticated `WriteProperty` overriding a chiller setpoint.
- 02
A retrofit project migrates the building's BACnet/IP backbone to BACnet/SC over TLS, with mutual certificate authentication between controllers.
● Frequently asked questions
What is BACnet?
A building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication. It belongs to the OT / ICS / IoT category of cybersecurity.
What does BACnet mean?
A building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication.
How does BACnet work?
BACnet (Building Automation and Control networks) is the dominant communications protocol in commercial building automation. It is standardized as ANSI/ASHRAE 135 and ISO 16484-5 and underlies HVAC, lighting, fire-alarm, energy-management, and access-control systems in office buildings, hospitals, schools, data centers, and large industrial campuses. BACnet defines a layered protocol with multiple data-link options (BACnet/IP over UDP/47808, BACnet MS/TP over RS-485, BACnet/SC over TLS, plus older Ethernet, ARCNET, and LonTalk variants) and an object-oriented model of services and objects (Analog Input/Output, Binary Input/Output, Schedule, Trend Log, etc.). Legacy BACnet/IP has essentially no authentication: any host on the BACnet network can issue Write Property requests, broadcast Who-Is and I-Am, or inject device-control messages. The newer BACnet Secure Connect (BACnet/SC, 2020) runs BACnet over TLS-secured WebSockets and is the recommended path forward. Real-world incidents (including a 2017 ransomware attack on a Finnish heating control system and the 2024 Lviv FrostyGoop case, conceptually similar) routinely abuse weak BACnet posture. Defensive practices include strict VLAN isolation of building-automation networks from IT and OT-NDR coverage tuned for BACnet anomalies.
How do you defend against BACnet?
Defences for BACnet typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for BACnet?
Common alternative names include: ASHRAE 135, Building Automation Network.
● Related terms
- ot-iot№ 587
Industrial Control System (ICS)
An umbrella term for systems that automate and supervise industrial processes, including SCADA, DCS, PLCs, RTUs, and safety controllers.
- ot-iot№ 854
Operational Technology (OT)
Hardware and software that monitor and control physical processes, devices, and infrastructure such as factories, power plants, and utilities.
- ot-iot№ 1083
SCADA
Supervisory Control and Data Acquisition systems that gather telemetry from remote field devices and let operators monitor and command large industrial processes.
- ot-iot№ 784
Modbus
A simple, openly documented industrial protocol for polling registers and coils on PLCs, RTUs, and field devices, available over serial (RTU/ASCII) and TCP.
- ot-iot№ 294
Cyber-Physical System (CPS)
An engineered system that integrates sensors, actuators, and computation to monitor and control physical processes, where digital and physical layers are tightly coupled.
- ot-iot№ 615
IoT Security
The discipline of protecting Internet-of-Things devices, gateways, networks, and cloud services from compromise, given their scale, constrained resources, and long lifetimes.