Thousands of Internet-Exposed Controllers Threaten Data Center Cooling and Power
Researchers have identified over 6,300 internet-exposed building automation controllers near U.S. data centers, posing a significant risk to critical cooling and power systems.
Thousands of internet-exposed building controllers, responsible for managing essential data center functions like cooling, electrical distribution, and environmental conditions, are presenting a substantial risk to the physical infrastructure of these facilities. A recent analysis by TrendAI researchers has uncovered a widespread vulnerability where these operational technology (OT) assets are accessible from the public internet, potentially allowing malicious actors to disrupt services, cause equipment damage, or trigger costly emergency responses.
The study, which utilized passive Shodan data rather than direct probing, identified approximately 6,300 industrial and building automation devices located within one kilometer of 1,063 U.S. data centers. While the research cannot definitively confirm that every identified device is directly linked to a data center's operations, it highlights a significant attack surface in close proximity to these critical facilities. The findings underscore the importance of securing OT assets, which are as vital to data center availability as the servers themselves.
Protocols commonly used in building automation systems (BAS) were found to be prevalent among the exposed devices. BACnet, typically used for air conditioning and environmental controls, and Fox/Niagara, a popular platform for building management, accounted for 81 percent of the identified internet-exposed controllers on their respective default ports. Additionally, the research noted the presence of 159 Modbus devices, frequently employed in power metering and industrial equipment, and 16 Vertiv/Liebert devices, associated with precision cooling and uninterruptible power supplies.
Exposed device banners often reveal crucial information such as vendor names, firmware versions, and equipment inventories, which can significantly lower the effort required for an attacker to identify and exploit a target. The research also highlighted the complexity of some systems, with 143 devices found to be multi-protocol, including 125 that supported both Fox/Niagara and BACnet. Such multi-protocol gateways can be particularly consequential, as a compromise through one interface could potentially grant access to multiple building systems.
Interestingly, newer data center facilities showed a higher rate of nearby exposed controllers compared to older ones. Facilities permitted from 2021 onward had a 13.1 percent exposure rate, compared to 4.9 percent for those built before 2010. This trend is attributed to factors like rapid deployment, increased reliance on remote management capabilities, and potentially delayed security assessments during the initial setup phases.
To mitigate these risks, organizations are strongly advised to proactively identify and secure these exposed assets. This includes reviewing public-facing IP ranges and firewall rules for any open ports associated with BAS protocols. Comprehensive asset inventories should extend to include facility management controllers, not just traditional IT equipment. Direct public access to these controllers should be eliminated, with secure remote access methods such as VPNs, SSH tunnels, or zero-trust solutions being implemented instead.
Further security best practices include replacing default credentials, patching supported devices, and implementing network segmentation to isolate building automation systems on separate networks with restricted communication to enterprise systems and the internet. Regular monitoring for unusual remote connections or unexpected changes in BAS traffic can also help detect malicious activity early. The potential for disruption, as demonstrated by past incidents like the FrostyGoop malware affecting Modbus systems, makes addressing this exposure a critical resilience concern for data center operators.