Feeds

Smart meters pose hacker kill-switch risk, warn boffins

Who turned off the lights?

The Power of One eBook: Top reasons to choose HP BladeSystem

A leading computer scientist has warned of the security risks of using smart meters in controlling utility supplies.

A programme is underway to replace Britain’s 47 million meters with smart meters that can be turned off remotely. Utilities welcome the move because it will greatly simplify the process of collecting meter reading and controlling supply at times of high demand. As an added bonus the technology also makes it easier to switch subscribers to new (higher) tariffs if they persistently fail to pay their bill on time.

However, Ross Anderson, professor in security engineering at the University of Cambridge Computer Laboratory, warns that the move to smart metering introduces a "strategic vulnerability" that hackers might conceivable be exploit to remotely switch off elements on the gas or electricity supply grid.

In his Who controls the off switch? paper, Anderson and colleague Shailendra Fuloria build on the Cambridge team's earlier work on the security economics of the worldwide move to smart metering. The computer scientists warn the move is fraught with hidden risks.

The off switch creates information security problems of a kind, and on a scale, that the energy companies have not had to face before. From the viewpoint of a cyber attacker – whether a hostile government agency, a terrorist organisation or even a militant environmental group – the ideal attack on a target country is to interrupt its citizens’ electricity supply… Until now, the only plausible ways to do that involved attacks on critical generation, transmission and distribution assets, which are increasingly well defended.

Smart meters change the game. The combination of commands that will cause meters to interrupt the supply, of applets and software upgrades that run in the meters, and of cryptographic keys that are used to authenticate these commands and software changes, create a new strategic vulnerability.

Smart meter roll-outs are taking place in both the US and Europe, with other regions likely to follow. The Cambridge team warns that either software error, possibly during a system update, or a hacker taking seizing control of smart meter systems (perhaps via some form of cryptographic attack) could have a devastating effect.

Problems could include shutting off supply to portions of the grid, disastrous especially in winter in areas where lives are even more dependent on reliable heat and lighting supplies.

Anderson and Fuloria suggest safeguards that ought to be applied - such as local-override features and shared control - before nationwide roll-outs take place

US security researchers at IOActive have also looked at the potential for hacking into smart meters, reaching similar conclusions as the Cambridge team. IOActive researcher highlighted flaws in poor authentication, lack of encryption and inadequate authorization in smart meter rollouts.

This exposes utility companies to possible fraud, extortion attempts, lawsuits or widespread system interruption. Addressing security concerns once the devices are deployed is likely to be cost-prohibitive, it warns. Programming errors and security vulnerabilities in smart meter devices both created possible mechanisms for seizing control of the end-points in power distribution networks, it warns. A summary of IOActive research can be found here.

The rollout of an estimated 47 million smart meters to each of the UK's 26 million homes by 2020 is estimated at costing around £8bn. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.