Every modern business center, skyscraper or even your house is automated. Building automation technologies are widespread for the last decade because they reduce financial expenses and increase the level of comfort. BACnet is the most common solution for BMS, however, it is often used as a high-level communication technology. On the lower layers there is a variety of different field protocols, which main task is interaction between sensors/actuators and transmitting the current state to the systems of upper level. KNX, or KNX/EIB, is the one of protocols that provides a low-level communication. In this talk, we will speak about the security of KNX from the lowest layer, when an attacker can only connect to a twisted-pair wiring from outside the secure perimeter. It's easier than it may seem - for example, in every room of your office there are smart push buttons, sensors, and other devices, which are connected to the KNX bus. When I started this research, there was not any tools to research this protocol. So, firstly, I reverse engineered this protocol to study how it works in terms of physical processes and then I wrote pyKNXtools which allow scanning the network, reading and writing memory of any KNX node, managing any node in any KNX node and, if necessary, providing memory protection from rewriting. At the end of the presentation, I will show the proof of concept video where we will see how to connect to a KNX twisted-pair, to read/write memory of the node and manage it. I am an infosec specialist at Digital Security. Specialize in the security of ICS and embedded devices. Dedicated a lot of time to programming industrial controllers for ICS. Took part in smart home development projects.