BACnet
¿Qué es BACnet?
BACnetA building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication.
BACnet (Building Automation and Control networks) is the dominant communications protocol in commercial building automation. It is standardized as ANSI/ASHRAE 135 and ISO 16484-5 and underlies HVAC, lighting, fire-alarm, energy-management, and access-control systems in office buildings, hospitals, schools, data centers, and large industrial campuses. BACnet defines a layered protocol with multiple data-link options (BACnet/IP over UDP/47808, BACnet MS/TP over RS-485, BACnet/SC over TLS, plus older Ethernet, ARCNET, and LonTalk variants) and an object-oriented model of services and objects (Analog Input/Output, Binary Input/Output, Schedule, Trend Log, etc.). Legacy BACnet/IP has essentially no authentication: any host on the BACnet network can issue Write Property requests, broadcast Who-Is and I-Am, or inject device-control messages. The newer BACnet Secure Connect (BACnet/SC, 2020) runs BACnet over TLS-secured WebSockets and is the recommended path forward. Real-world incidents (including a 2017 ransomware attack on a Finnish heating control system and the 2024 Lviv FrostyGoop case, conceptually similar) routinely abuse weak BACnet posture. Defensive practices include strict VLAN isolation of building-automation networks from IT and OT-NDR coverage tuned for BACnet anomalies.
● Ejemplos
- 01
A pen-tester maps a building's BACnet network with `Who-Is` discovery and demonstrates an unauthenticated `WriteProperty` overriding a chiller setpoint.
- 02
A retrofit project migrates the building's BACnet/IP backbone to BACnet/SC over TLS, with mutual certificate authentication between controllers.
● Preguntas frecuentes
¿Qué es BACnet?
A building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication. Pertenece a la categoría de OT / ICS / IoT en ciberseguridad.
¿Qué significa BACnet?
A building-automation and HVAC protocol standardized as ASHRAE 135 / ISO 16484-5 — widely deployed in HVAC, lighting, fire-alarm, and access-control systems in commercial buildings, historically with very weak authentication.
¿Cómo funciona BACnet?
BACnet (Building Automation and Control networks) is the dominant communications protocol in commercial building automation. It is standardized as ANSI/ASHRAE 135 and ISO 16484-5 and underlies HVAC, lighting, fire-alarm, energy-management, and access-control systems in office buildings, hospitals, schools, data centers, and large industrial campuses. BACnet defines a layered protocol with multiple data-link options (BACnet/IP over UDP/47808, BACnet MS/TP over RS-485, BACnet/SC over TLS, plus older Ethernet, ARCNET, and LonTalk variants) and an object-oriented model of services and objects (Analog Input/Output, Binary Input/Output, Schedule, Trend Log, etc.). Legacy BACnet/IP has essentially no authentication: any host on the BACnet network can issue Write Property requests, broadcast Who-Is and I-Am, or inject device-control messages. The newer BACnet Secure Connect (BACnet/SC, 2020) runs BACnet over TLS-secured WebSockets and is the recommended path forward. Real-world incidents (including a 2017 ransomware attack on a Finnish heating control system and the 2024 Lviv FrostyGoop case, conceptually similar) routinely abuse weak BACnet posture. Defensive practices include strict VLAN isolation of building-automation networks from IT and OT-NDR coverage tuned for BACnet anomalies.
¿Cómo defenderse de BACnet?
Las defensas contra BACnet combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para BACnet?
Nombres alternativos comunes: ASHRAE 135, Building Automation Network.
● Términos relacionados
- ot-iot№ 587
Sistema de Control Industrial (ICS)
Término que agrupa los sistemas que automatizan y supervisan procesos industriales, incluyendo SCADA, DCS, PLC, RTU y controladores de seguridad.
- ot-iot№ 854
Tecnología Operativa (OT)
Hardware y software que monitorizan y controlan procesos físicos, dispositivos e infraestructuras como fábricas, centrales eléctricas y servicios públicos.
- ot-iot№ 1083
SCADA
Sistemas de supervisión, control y adquisición de datos que recogen telemetría de dispositivos de campo remotos y permiten operar grandes procesos industriales.
- ot-iot№ 784
Modbus
Protocolo industrial sencillo y de especificación abierta para sondear registros y bobinas de PLC, RTU y dispositivos de campo, disponible en serie (RTU/ASCII) y TCP.
- ot-iot№ 294
Sistema Ciberfísico (CPS)
Sistema de ingeniería que integra sensores, actuadores y computación para monitorizar y controlar procesos físicos, con un acoplamiento estrecho entre lo digital y lo físico.
- ot-iot№ 615
Seguridad de IoT
Disciplina que protege dispositivos, pasarelas, redes y servicios en la nube del Internet de las Cosas frente a compromisos, dada su escala, recursos limitados y largo ciclo de vida.