> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BACnet

> Building automation protocol — HVAC, access control, and fire systems as an ICS attack surface.

BACnet (Building Automation and Control Networks) is the dominant open protocol for building management systems: HVAC, lighting, access control, and fire panels. It is ISO 16484-5 and runs widely over IP (**UDP/TCP 47808**).

## How BACnet works

Devices expose **objects** (analog inputs, binary outputs, schedules) that clients read and write. BACnet/IP uses broadcast and unicast discovery. Many deployments leave devices on corporate or even public networks with weak or no authentication.

## How attackers abuse it

* **Device discovery** — Who-Is / I-Am enumeration to map a site
* **Property reads** — temperatures, occupancy, door states for physical reconnaissance
* **WriteProperty** — change setpoints, unlock doors, disable alarms
* **Denial of service** — flood Broadcast Management Devices (BBMD)

Building systems often bridge to corporate IT, making BACnet a pivot into both physical security and enterprise networks.

## What Reyhford observes

BACnet traffic on our sensors is lower volume than Modbus/S7 but high signal: probes tend to be deliberate discovery rather than blind internet noise. Indicators typically map to reconnaissance and unauthorized command patterns (MITRE **T0855**, **T0830** when on-path).

<Note>
  Facilities and campuses should treat BACnet/IP exposure with the same seriousness as Modbus — building automation is OT.
</Note>