Applied Risk @ Hack In The Box Amsterdam | Building Management System Hacking Challenge & Research Presentation By Gjoko Krstic


Applied Risk's PWN My Building - Hacking Challenge

Want to hack industrial building controls like a pro? Conquer the small scale Applied Risk industrial doll house, decked out with large scale industrial building management system controls and win yourself a prize!

Our ICS security professionals can provide guidance, so jump onto one of our connected demo laptops at the Applied Risk Booth or connect your own! Win yourself admission to the Applied Risk Advanced ICS/SCADA 2-day Hacking Training held on the 28th-29th of May (valued at €2500) or take home a Raspberry Pi 3 B+ for beating the challenge!

The Challenge

  • Exploit the industrial doll house access control system, open the secure door entry to retrieve your ticket and go in the draw to win the prize of your choice!
  • Bypass the doll house web-based camera authentication to view the secret live stream in the hidden room for hints
  • Get hands-on experience with cloning RFID reader security access cards on our demo kits to exploit and swipe your way into the pint size facility
  • Utilise common and industrial specific hacking tools to abuse and make unauthorized changes to the Modbus controlled building lighting systems

Retrieve your ticket and we’ll register you for the prize draw held at the end of the conference! Drop by for a friendly chat with our ICS security professionals and learn some unique new skills you won’t learn anywhere else, all at the Applied Risk Booth on the Haxpo floor.

Se the event site at


Gjoko Krstic - I Own Your Building (Management System)

Despite the rapidly growing deployment of IP-based technologies around us, the security of these deployments remains susceptible to basic cyber security attacks. What began as a small enumeration of the exposure of Security Access Control Platforms on several Internet-connected device search engines, grew into a research project covering several Building Management Systems (BMS) or Building Automation Systems (BAS) and its various sub-categories.

The execution of such attacks enables an unauthenticated attacker to access and manipulate doors, elevators, air-condition systems, windows blinds, cameras, boiler, PLCs, lights, alarm system in an entire building. In the case of this research, more than 10 million people could be affected by the findings presented.

This presentation discusses vulnerabilities found by Applied Risk research team across several BMS components and products from various vendors in the industry. Multiple vulnerabilities have been identified that could result in the total compromise of entire buildings and critical facilities (e.g. banks, hospitals, industrial facilities, government, residential…etc.).

In addition to the discovered vulnerabilities, the process we followed during our research will be discussed.

View the complete agenda here