Feeds

Smart meters pose hacker kill-switch risk, warn boffins

Who turned off the lights?

Internet Security Threat Report 2014

A leading computer scientist has warned of the security risks of using smart meters in controlling utility supplies.

A programme is underway to replace Britain’s 47 million meters with smart meters that can be turned off remotely. Utilities welcome the move because it will greatly simplify the process of collecting meter reading and controlling supply at times of high demand. As an added bonus the technology also makes it easier to switch subscribers to new (higher) tariffs if they persistently fail to pay their bill on time.

However, Ross Anderson, professor in security engineering at the University of Cambridge Computer Laboratory, warns that the move to smart metering introduces a "strategic vulnerability" that hackers might conceivable be exploit to remotely switch off elements on the gas or electricity supply grid.

In his Who controls the off switch? paper, Anderson and colleague Shailendra Fuloria build on the Cambridge team's earlier work on the security economics of the worldwide move to smart metering. The computer scientists warn the move is fraught with hidden risks.

The off switch creates information security problems of a kind, and on a scale, that the energy companies have not had to face before. From the viewpoint of a cyber attacker – whether a hostile government agency, a terrorist organisation or even a militant environmental group – the ideal attack on a target country is to interrupt its citizens’ electricity supply… Until now, the only plausible ways to do that involved attacks on critical generation, transmission and distribution assets, which are increasingly well defended.

Smart meters change the game. The combination of commands that will cause meters to interrupt the supply, of applets and software upgrades that run in the meters, and of cryptographic keys that are used to authenticate these commands and software changes, create a new strategic vulnerability.

Smart meter roll-outs are taking place in both the US and Europe, with other regions likely to follow. The Cambridge team warns that either software error, possibly during a system update, or a hacker taking seizing control of smart meter systems (perhaps via some form of cryptographic attack) could have a devastating effect.

Problems could include shutting off supply to portions of the grid, disastrous especially in winter in areas where lives are even more dependent on reliable heat and lighting supplies.

Anderson and Fuloria suggest safeguards that ought to be applied - such as local-override features and shared control - before nationwide roll-outs take place

US security researchers at IOActive have also looked at the potential for hacking into smart meters, reaching similar conclusions as the Cambridge team. IOActive researcher highlighted flaws in poor authentication, lack of encryption and inadequate authorization in smart meter rollouts.

This exposes utility companies to possible fraud, extortion attempts, lawsuits or widespread system interruption. Addressing security concerns once the devices are deployed is likely to be cost-prohibitive, it warns. Programming errors and security vulnerabilities in smart meter devices both created possible mechanisms for seizing control of the end-points in power distribution networks, it warns. A summary of IOActive research can be found here.

The rollout of an estimated 47 million smart meters to each of the UK's 26 million homes by 2020 is estimated at costing around £8bn. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.