New “Ëœsmart’ meters that are being designed to help deliver electricity more efficiently have been put on the spot by computer-security researchers, who say flaws in the devices will let hackers tamper with the power grid, which was impossible with the old meters.
According to a recent report by the Associated Press, the new meters will also be vulnerable to attackers who want to harass individual customers by jacking up their power bills, and possibly in the future, learning ways to remotely turn other people’s power off and on.
An attacker could sit near a home or business and wirelessly hack the meter from a laptop, or could steal them and reprogram them, said Joshua Wright, a senior security analyst with InGuardians Inc. The firm was hired by utility companies to study the meters’ resistance to attack.
The utility companies, which remain anonymous, have already released smart meters in some areas and plan to roll the technology out to customers all along the grid, Wright told The Associated Press. In the US alone, more than 8 million smart meters have already been installed, with nearly 60 million coming online by 2020, according to The Edison Foundation, an organization focused on the electric industry.
Unlike traditional meters that only record power use, smart meters measure consumption in real time. The data can then be transmitted to a network of computers in electric utilities. The devices can also alert people or their appliances to take actions, such as reducing power usage when electricity prices spike. The interactivity that makes smart meters so attractive, is also what makes them vulnerable to attack, because each meter is basically a computer connected to a vast network.
Little research has been done on making meters’ resistance to attack, mainly because the technology is so new. However, Mike Davis, a researcher for IOActive Inc., showed last year how a computer worm could move between meters in the power grid, giving criminals complete control over the meters.
Hacking smart meters could prove to be a serious concern for electric utility companies, said Allan Paller, director of research for the SANS Institute. “We weren’t sure it was possible,” Paller said. “He (Wright) actually verified it’s possible. … If the Department of Energy is going to make sure the meters are safe, then Josh’s work is really important.” SANS has invited Wright to present his research at a conference it is sponsoring on the security of utilities and other infrastructures.
Thorough security testing is being done by utilities making sure power grids are more secure than the current system, according to industry representatives. The current system is already being hacked from adversaries thought to be working overseas.
Wright said his firm has found many errors, such as flaws in the meters and technologies that are used to manage data from meters. “Even though these protocols were designed recently, they exhibit security failures we’ve known about for the past 10 years.”
InGuardians techs found vulnerabilities in products from all five meter manufacturers that were studied, according to Wright. He did not disclose which makers were tested. They found a weakness in a communications standard used by the new meters to talk to utilities’ computers. Wright said that hackers could exploit the weakness and hack into the meters remotely, which would be a key step in shutting down the customer’s power, inflate their bills, or even lower their own. Hackers could also break into the main network and steal data or plan larger attacks on the system.
The biggest problem is how digital keys for unlocking encryption codes were stored. Instead of keeping the keys deep inside computers in utility network mainframes, they are being stored directly on the meters, which makes it very easy for attackers to gain entry to the network.
“That lesson seems to be lost on these meter vendors,” Wright said. That speaks to the “relative immaturity” of the meter technology, he added.
—
On the Net:
Comments