Feeds

Smart meters pose hacker kill-switch risk, warn boffins

Who turned off the lights?

Security for virtualized datacentres

A leading computer scientist has warned of the security risks of using smart meters in controlling utility supplies.

A programme is underway to replace Britain’s 47 million meters with smart meters that can be turned off remotely. Utilities welcome the move because it will greatly simplify the process of collecting meter reading and controlling supply at times of high demand. As an added bonus the technology also makes it easier to switch subscribers to new (higher) tariffs if they persistently fail to pay their bill on time.

However, Ross Anderson, professor in security engineering at the University of Cambridge Computer Laboratory, warns that the move to smart metering introduces a "strategic vulnerability" that hackers might conceivable be exploit to remotely switch off elements on the gas or electricity supply grid.

In his Who controls the off switch? paper, Anderson and colleague Shailendra Fuloria build on the Cambridge team's earlier work on the security economics of the worldwide move to smart metering. The computer scientists warn the move is fraught with hidden risks.

The off switch creates information security problems of a kind, and on a scale, that the energy companies have not had to face before. From the viewpoint of a cyber attacker – whether a hostile government agency, a terrorist organisation or even a militant environmental group – the ideal attack on a target country is to interrupt its citizens’ electricity supply… Until now, the only plausible ways to do that involved attacks on critical generation, transmission and distribution assets, which are increasingly well defended.

Smart meters change the game. The combination of commands that will cause meters to interrupt the supply, of applets and software upgrades that run in the meters, and of cryptographic keys that are used to authenticate these commands and software changes, create a new strategic vulnerability.

Smart meter roll-outs are taking place in both the US and Europe, with other regions likely to follow. The Cambridge team warns that either software error, possibly during a system update, or a hacker taking seizing control of smart meter systems (perhaps via some form of cryptographic attack) could have a devastating effect.

Problems could include shutting off supply to portions of the grid, disastrous especially in winter in areas where lives are even more dependent on reliable heat and lighting supplies.

Anderson and Fuloria suggest safeguards that ought to be applied - such as local-override features and shared control - before nationwide roll-outs take place

US security researchers at IOActive have also looked at the potential for hacking into smart meters, reaching similar conclusions as the Cambridge team. IOActive researcher highlighted flaws in poor authentication, lack of encryption and inadequate authorization in smart meter rollouts.

This exposes utility companies to possible fraud, extortion attempts, lawsuits or widespread system interruption. Addressing security concerns once the devices are deployed is likely to be cost-prohibitive, it warns. Programming errors and security vulnerabilities in smart meter devices both created possible mechanisms for seizing control of the end-points in power distribution networks, it warns. A summary of IOActive research can be found here.

The rollout of an estimated 47 million smart meters to each of the UK's 26 million homes by 2020 is estimated at costing around £8bn. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.