The Ghost in the Building: Non-Invasive Spoofing and Covert Attacks on Automated Buildings

Abstract

Sensor and actuator event log analyses in the context of digital forensics is the key to understand what might have happened in an automated building, as in a building automation and control system (BACS) or a home automation system (HAS). Conclusions drawn from erroneous, misleading, or corrupted log data may have an unwanted effect on a crime scene investigation and reconstruction.This work aims to raise awareness of the potential risk of misinterpretation, due to corrupted or tampered data from BAS or HAS event log system. A set of non-invasive sensor and actuator attacks on such systems was designed and conducted to conclude the feasibility to 1) inject spoofed pyroelectric infrared (PIR) and carbon dioxide (CO2) sensor event log records, 2) become invisible to PIR sensor and CO2 sensors, and 3) mimic the behaviour of an actuator, with aim to inject spoofed event log records.Finally, this work concludes that sensor fusion can reveal activities that were concealed to the CO2 sensors.

Keywords: building automation and control systemhome automation systemnon-invasive attackevent log recordanti-forensic method