{"id":20206,"date":"2017-01-06T15:00:00","date_gmt":"2017-01-06T15:00:00","guid":{"rendered":"http:\/\/architizer.wpengine.com\/hacking-architecture\/"},"modified":"2022-05-31T07:46:30","modified_gmt":"2022-05-31T11:46:30","slug":"hacking-architecture","status":"publish","type":"post","link":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/","title":{"rendered":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure"},"content":{"rendered":"

One of the most disregarded happenings in the world of architecture today is that computer networks controlling the buildings and infrastructure architects design are regularly being hacked. This tends to go under-reported, because it often involves private companies concerned for their public images, and untreated, because these systems are coordinated by various parties that have never been responsible for cyber security.<\/p>\n

An equally underutilized circumstance is that architects and planners tend to occupy the prime communicating position on building projects, coming into direct or indirect contact with nearly everyone involved. As such, they should familiarize themselves with this realm of knowledge and treat it with equal regard to areas such as structural or mechanical engineering.<\/p>\n

\n\t\n\t\n<\/div>\n\n

Via BBC<\/a><\/i><\/p>\n

Building automation systems, which control such things as heating and air conditioning, fire alarms and sprinklers, door locks and security cameras, tend to be some of the weakest and least secured computer systems in any given network. The 2013 hack of the retailer Target, for example, in which the credit and debit card information of some 40 million people was stolen, was launched<\/a> through the company\u2019s heating, ventilation and air conditioning control system.<\/p>\n

\u201cThe 2013 hack of the retailer Target was launched through the company\u2019s HVAC control system.\u201d<\/p><\/blockquote>\n

This illustrates why building systems are typically exploited: They\u2019re a weak point through which hackers can jump to an organization\u2019s other systems, like those containing financial data. But as automated buildings become more proliferous and more sophisticated, the range of possible attacks becomes more nefarious. Losing control of the temperature in a hospital or nursing home could be life-threatening; starting a fire by remotely overheating equipment in a building where the fire alarms and sprinklers are intentionally disabled could be catastrophic.<\/p>\n

These issues aren\u2019t limited to buildings, as recent hacks have also included the Ukrainian power grid<\/a>, a small dam<\/a> in New York and various transportation systems. San Francisco\u2019s BART system has been hacked multiple times, most recently<\/a> resulting in free rides being given away over Thanksgiving weekend. In that case, only administrative computers were hacked (the ticket-taking machines were intentionally shut down as a precaution), but one doesn\u2019t need too wild an imagination to fear what might happen in a system where automated train controls are compromised.<\/p>\n

More significant than potential terrorist acts, though, is the prospect that a transportation system could simply be shut down. Consider the implications if New York City\u2019s five and a half million daily subway riders were unable to get around, crippling the economy of a city with a disproportionately large effect on the gross domestic product of the entire world.<\/p>\n

\n\t\n\t\n<\/div>\n\n

A typical Smart Building setup; via Motherboard<\/a><\/i><\/p>\n

The first step in preventing such problems is to understand, at least on a general level, how these systems work. In the case of buildings, the setup is relatively simple: Physical components that control building systems (a thermostat controlling HVAC, for example) can be accessed remotely by the building\u2019s operators because they\u2019re connected to the internet. In a recent security exercise<\/a>, for instance, IBM hackers gained access to a large corporation\u2019s building systems through a single Wireless Access Point \u2014 a piece of equipment found in most people\u2019s living rooms \u2014 and could subsequently control the temperature, fire suppression and security systems in all that company\u2019s buildings across North America.<\/p>\n

\u201cMany of these remote connections have no security features to prevent someone else from accessing them.\u201d<\/p><\/blockquote>\n

Because the vulnerabilities of such systems tend to be overlooked (manufacturers may think that responsibility falls on the IT department, IT may feel it\u2019s out of their purview, etc.) many of these remote connections have no security features to prevent someone else from accessing them. Even when these connections are secured, there tends to be unconsidered weak spots, such as the Wireless Access Point in the IBM exercise, which was guarded with a password stored in an unencrypted list the hackers easily found.<\/p>\n

Systems controlling heavy infrastructure are often more complex than off-the-shelf building automation systems. They also tend to be proprietary and customized, so it\u2019s difficult to make generalizations about them, but recent hacking instances illustrate some interesting details. The most documented of these is Stuxnet<\/a>, in which the centrifuges of nuclear equipment in Iran were purportedly caused to spin themselves into destruction by a worm planted in the the systems of consultant companies that unknowingly carried it into otherwise secure facilities on USB drives.<\/p>\n

In this case, the Stuxnet worm illustrates a program\u2019s ability to remain inert and undetected in a system for years, allowing hackers ample time to observe unintelligible processes whose functions can, over time, be deduced by experts. As such, a sophisticated team of hackers and engineers could combine their knowledge to make educated guesses about exactly what equipment is being controlled by lines of code they can see in a network\u2019s everyday functioning, then manipulate it in ways they know would cause damage.<\/p>\n

\n\t\n\t\n<\/div>\n\n

The Bowman Avenue Dam, in Rye Brook, N.Y., was hacked in 2013; via Port Chester Patch<\/a><\/i><\/p>\n

\u201cIt is important that architects educate themselves about how a building\u2019s operation will matter in a more connected future \u2014 because that future is arriving quickly.\u201d<\/p><\/blockquote>\n

What can be done about this? The most effective answer lies in the problem: a lack of awareness about these vulnerabilities. Automated building systems control equipment that works in essentially the same way since well before the digital revolution. This equipment is engineered, designed, manufactured and installed by a chain of people who likely have no knowledge, expertise or training in cyber security.<\/p>\n

The good news is that an architect (in close quarters with a construction contractor or manager) is typically the conduit through which all these parties communicate with each other. Thus, if architects were to treat knowledge of these weaknesses the same way they treat knowledge of the building equipment that contains them, they could help spread that awareness to everyone involved in a project \u2014 a vital first step in making safeguards against hacking a standard practice.<\/p>\n

It\u2019s most likely that the security of building and infrastructure controls will eventually fall to the responsibility of a single-source expert, in much the same way that structural or mechanical engineering is handled today. But that is a nascent field, and when it does take on a greater role in building projects, architects and planners will undoubtedly be tasked with coordinating that person\u2019s involvement, as well. In the meantime, it is important that architects educate themselves as much as possible about how a building\u2019s operation will matter in a more connected future \u2014 because that future is arriving quickly.<\/p>\n

Top image via Security Intelligence<\/a><\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

One of the most disregarded happenings in the world of architecture today is that computer networks controlling the buildings and infrastructure architects design are regularly being hacked. This tends to go under-reported, because it often involves private companies concerned for their public images, and untreated, because these systems are coordinated by various parties that have…<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"architizer_featured_type":"projects","architizer_featured_image":"1885677","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2,6],"tags":[25],"architizer_project":[],"architizer_brand":[],"architizer_firm":[],"architizer_product":[],"class_list":["post-20206","post","type-post","status-publish","format-standard","hentry","category-practice","category-tools","tag-tech"],"acf":[],"yoast_head":"\nHacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal\" \/>\n<meta property=\"og:description\" content=\"One of the most disregarded happenings in the world of architecture today is that computer networks controlling the buildings and infrastructure architects design are regularly being hacked. This tends to go under-reported, because it often involves private companies concerned for their public images, and untreated, because these systems are coordinated by various parties that have…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\" \/>\n<meta property=\"og:site_name\" content=\"Journal\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Architizer\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-01-06T15:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-05-31T11:46:30+00:00\" \/>\n<meta name=\"author\" content=\"Ross Brady\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Architizer\" \/>\n<meta name=\"twitter:site\" content=\"@Architizer\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ross Brady\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\"},\"author\":{\"name\":\"Ross Brady\",\"@id\":\"https:\/\/architizer.com\/blog\/#\/schema\/person\/9d33afb51562d725f03bf42ac60f8fa6\"},\"headline\":\"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure\",\"datePublished\":\"2017-01-06T15:00:00+00:00\",\"dateModified\":\"2022-05-31T11:46:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\"},\"wordCount\":1139,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/architizer.com\/blog\/#organization\"},\"keywords\":[\"Tech\"],\"articleSection\":[\"Practice\",\"Tools\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\",\"url\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\",\"name\":\"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal\",\"isPartOf\":{\"@id\":\"https:\/\/architizer.com\/blog\/#website\"},\"datePublished\":\"2017-01-06T15:00:00+00:00\",\"dateModified\":\"2022-05-31T11:46:30+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/architizer.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/architizer.com\/blog\/#website\",\"url\":\"https:\/\/architizer.com\/blog\/\",\"name\":\"Journal\",\"description\":\"Inspiration and Tools for Architects\",\"publisher\":{\"@id\":\"https:\/\/architizer.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/architizer.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/architizer.com\/blog\/#organization\",\"name\":\"Architizer\",\"url\":\"https:\/\/architizer.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/architizer.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/blog.architizer.com\/wp-content\/uploads\/favicon.df2618023937.png\",\"contentUrl\":\"https:\/\/blog.architizer.com\/wp-content\/uploads\/favicon.df2618023937.png\",\"width\":36,\"height\":36,\"caption\":\"Architizer\"},\"image\":{\"@id\":\"https:\/\/architizer.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/Architizer\/\",\"https:\/\/x.com\/Architizer\",\"https:\/\/www.instagram.com\/architizer\/\",\"https:\/\/www.linkedin.com\/company\/architizer\/\",\"https:\/\/www.pinterest.com\/architizer\/\",\"https:\/\/www.youtube.com\/user\/Architizer\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/architizer.com\/blog\/#\/schema\/person\/9d33afb51562d725f03bf42ac60f8fa6\",\"name\":\"Ross Brady\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/architizer.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7d6e2303ff280c9ffb2fd34c7fd4de5e4251197077248a19846cf3f5b5490fb5?s=96&d=https%3A%2F%2Fblog.architizer.com%2Fwp-content%2Fuploads%2Flogo-600x600-1.jpg&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7d6e2303ff280c9ffb2fd34c7fd4de5e4251197077248a19846cf3f5b5490fb5?s=96&d=https%3A%2F%2Fblog.architizer.com%2Fwp-content%2Fuploads%2Flogo-600x600-1.jpg&r=g\",\"caption\":\"Ross Brady\"},\"url\":\"https:\/\/architizer.com\/blog\/author\/ross-brady\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/","og_locale":"en_US","og_type":"article","og_title":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal","og_description":"One of the most disregarded happenings in the world of architecture today is that computer networks controlling the buildings and infrastructure architects design are regularly being hacked. This tends to go under-reported, because it often involves private companies concerned for their public images, and untreated, because these systems are coordinated by various parties that have…","og_url":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/","og_site_name":"Journal","article_publisher":"https:\/\/www.facebook.com\/Architizer\/","article_published_time":"2017-01-06T15:00:00+00:00","article_modified_time":"2022-05-31T11:46:30+00:00","author":"Ross Brady","twitter_card":"summary_large_image","twitter_creator":"@Architizer","twitter_site":"@Architizer","twitter_misc":{"Written by":"Ross Brady","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#article","isPartOf":{"@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/"},"author":{"name":"Ross Brady","@id":"https:\/\/architizer.com\/blog\/#\/schema\/person\/9d33afb51562d725f03bf42ac60f8fa6"},"headline":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure","datePublished":"2017-01-06T15:00:00+00:00","dateModified":"2022-05-31T11:46:30+00:00","mainEntityOfPage":{"@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/"},"wordCount":1139,"commentCount":0,"publisher":{"@id":"https:\/\/architizer.com\/blog\/#organization"},"keywords":["Tech"],"articleSection":["Practice","Tools"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/","url":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/","name":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure - Architizer Journal","isPartOf":{"@id":"https:\/\/architizer.com\/blog\/#website"},"datePublished":"2017-01-06T15:00:00+00:00","dateModified":"2022-05-31T11:46:30+00:00","breadcrumb":{"@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/architizer.com\/blog\/practice\/tools\/hacking-architecture\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/architizer.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Hacking Architecture: A Crash Course on the Pitfalls Facing Smart Buildings and Intelligent Infrastructure"}]},{"@type":"WebSite","@id":"https:\/\/architizer.com\/blog\/#website","url":"https:\/\/architizer.com\/blog\/","name":"Journal","description":"Inspiration and Tools for Architects","publisher":{"@id":"https:\/\/architizer.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/architizer.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/architizer.com\/blog\/#organization","name":"Architizer","url":"https:\/\/architizer.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/architizer.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/blog.architizer.com\/wp-content\/uploads\/favicon.df2618023937.png","contentUrl":"https:\/\/blog.architizer.com\/wp-content\/uploads\/favicon.df2618023937.png","width":36,"height":36,"caption":"Architizer"},"image":{"@id":"https:\/\/architizer.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Architizer\/","https:\/\/x.com\/Architizer","https:\/\/www.instagram.com\/architizer\/","https:\/\/www.linkedin.com\/company\/architizer\/","https:\/\/www.pinterest.com\/architizer\/","https:\/\/www.youtube.com\/user\/Architizer"]},{"@type":"Person","@id":"https:\/\/architizer.com\/blog\/#\/schema\/person\/9d33afb51562d725f03bf42ac60f8fa6","name":"Ross Brady","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/architizer.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7d6e2303ff280c9ffb2fd34c7fd4de5e4251197077248a19846cf3f5b5490fb5?s=96&d=https%3A%2F%2Fblog.architizer.com%2Fwp-content%2Fuploads%2Flogo-600x600-1.jpg&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7d6e2303ff280c9ffb2fd34c7fd4de5e4251197077248a19846cf3f5b5490fb5?s=96&d=https%3A%2F%2Fblog.architizer.com%2Fwp-content%2Fuploads%2Flogo-600x600-1.jpg&r=g","caption":"Ross Brady"},"url":"https:\/\/architizer.com\/blog\/author\/ross-brady\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/posts\/20206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/comments?post=20206"}],"version-history":[{"count":0,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/posts\/20206\/revisions"}],"wp:attachment":[{"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/media?parent=20206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/categories?post=20206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/tags?post=20206"},{"taxonomy":"architizer_project","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/architizer_project?post=20206"},{"taxonomy":"architizer_brand","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/architizer_brand?post=20206"},{"taxonomy":"architizer_firm","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/architizer_firm?post=20206"},{"taxonomy":"architizer_product","embeddable":true,"href":"https:\/\/architizer.com\/blog\/wp-json\/wp\/v2\/architizer_product?post=20206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}