Feeds

Smart meters pose hacker kill-switch risk, warn boffins

Who turned off the lights?

Beginner's guide to SSL certificates

A leading computer scientist has warned of the security risks of using smart meters in controlling utility supplies.

A programme is underway to replace Britain’s 47 million meters with smart meters that can be turned off remotely. Utilities welcome the move because it will greatly simplify the process of collecting meter reading and controlling supply at times of high demand. As an added bonus the technology also makes it easier to switch subscribers to new (higher) tariffs if they persistently fail to pay their bill on time.

However, Ross Anderson, professor in security engineering at the University of Cambridge Computer Laboratory, warns that the move to smart metering introduces a "strategic vulnerability" that hackers might conceivable be exploit to remotely switch off elements on the gas or electricity supply grid.

In his Who controls the off switch? paper, Anderson and colleague Shailendra Fuloria build on the Cambridge team's earlier work on the security economics of the worldwide move to smart metering. The computer scientists warn the move is fraught with hidden risks.

The off switch creates information security problems of a kind, and on a scale, that the energy companies have not had to face before. From the viewpoint of a cyber attacker – whether a hostile government agency, a terrorist organisation or even a militant environmental group – the ideal attack on a target country is to interrupt its citizens’ electricity supply… Until now, the only plausible ways to do that involved attacks on critical generation, transmission and distribution assets, which are increasingly well defended.

Smart meters change the game. The combination of commands that will cause meters to interrupt the supply, of applets and software upgrades that run in the meters, and of cryptographic keys that are used to authenticate these commands and software changes, create a new strategic vulnerability.

Smart meter roll-outs are taking place in both the US and Europe, with other regions likely to follow. The Cambridge team warns that either software error, possibly during a system update, or a hacker taking seizing control of smart meter systems (perhaps via some form of cryptographic attack) could have a devastating effect.

Problems could include shutting off supply to portions of the grid, disastrous especially in winter in areas where lives are even more dependent on reliable heat and lighting supplies.

Anderson and Fuloria suggest safeguards that ought to be applied - such as local-override features and shared control - before nationwide roll-outs take place

US security researchers at IOActive have also looked at the potential for hacking into smart meters, reaching similar conclusions as the Cambridge team. IOActive researcher highlighted flaws in poor authentication, lack of encryption and inadequate authorization in smart meter rollouts.

This exposes utility companies to possible fraud, extortion attempts, lawsuits or widespread system interruption. Addressing security concerns once the devices are deployed is likely to be cost-prohibitive, it warns. Programming errors and security vulnerabilities in smart meter devices both created possible mechanisms for seizing control of the end-points in power distribution networks, it warns. A summary of IOActive research can be found here.

The rollout of an estimated 47 million smart meters to each of the UK's 26 million homes by 2020 is estimated at costing around £8bn. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.