Recent research has uncovered that thousands of internet-exposed building controllers are potentially jeopardizing the physical infrastructure of U.S. data centers. These controllers are integral to managing critical systems such as cooling, electrical distribution, and environmental conditions. Unauthorized access to these systems could lead to service disruptions, equipment damage, or necessitate costly emergency interventions.
The core issue arises from industrial and building-management devices being accessible via the public internet. Malicious actors can locate these systems online and exploit software vulnerabilities, weak configurations, or known flaws to gain unauthorized access.
Extent of Exposure
TrendAI researchers identified approximately 6,300 industrial-control and building-automation devices within a one-kilometer radius of 1,063 U.S. data centers. This data was obtained through passive analysis of Shodan data, without direct probing of the devices. While the research does not confirm that each device is directly associated with a data center, it highlights a significant nearby attack surface.
Maintaining optimal cooling and power is as crucial as server management in data centers. A sudden loss of cooling can trigger thermal alarms and protective shutdowns, while power disturbances can interrupt applications or corrupt data. Previous reports have demonstrated how vulnerabilities in management systems can escalate into broader availability incidents.
Details of Exposed Controllers
The study revealed that 81% of the exposed devices utilized BACnet on port 47808 and Fox/Niagara on port 1911. These protocols are commonly used to connect air conditioning systems, sensors, and access controls. Additionally, the data included 159 Modbus devices, often associated with power meters and industrial equipment, and 16 Vertiv/Liebert devices linked to precision cooling, uninterruptible power supplies, and distribution hardware.
Exposed device banners can reveal sensitive information such as vendor names, firmware versions, zone labels, and equipment inventories, thereby reducing the effort required for attackers to select targets. In one anonymized instance, researchers observed a device responding to both Modbus and BACnet, potentially linking power monitoring and cooling controls.
The risk is not confined to a single protocol or supplier. Researchers identified 143 multi-protocol devices, including 125 that supported both Fox/Niagara and BACnet. Such gateways are particularly concerning as one interface may provide access to multiple building systems.
Notably, newer facilities exhibited a higher rate of nearby exposure compared to older ones: 13.1% for sites permitted from 2021 onward, versus 4.9% for facilities built before 2010. This trend is attributed to rapid deployment, remote management practices, and delayed security assessments. However, it’s important to note that IP geolocation identifies a network area rather than a specific building, so these figures do not represent a definitive list of exposed data centers.
Mitigation Strategies
To address these vulnerabilities, data center operators should proactively identify exposed devices before they are exploited by attackers. This involves reviewing public-facing address ranges and router or firewall rules for port forwarding to BACnet, Fox, Modbus, and EtherNet/IP services. Asset inventories should encompass controllers used by facilities teams, in addition to servers and network equipment managed by IT.
Direct public access should be eliminated wherever possible. Remote maintenance can be conducted through controlled VPNs, SSH tunnels, or zero-trust access services, with robust authentication and limited permissions. Organizations should also replace default credentials, apply patches to supported products, and implement compensating network controls for devices that have reached end-of-life status.
Network segmentation is equally critical. Building automation systems should reside on separate operational networks, with restricted traffic to enterprise systems and the internet. This approach reinstates a security boundary that is often lacking in current configurations.
In summary, the exposure of building controllers to the internet presents a significant risk to data center operations. By implementing comprehensive security measures and adhering to best practices, organizations can mitigate these risks and safeguard their critical infrastructure.
