+ Reply to Thread
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Is smart grid security as bad as the warnings predict?

  1. #1
    Super Moderator
    Join Date
    Oct 2010

    Is smart grid security as bad as the warnings predict?

    In Homer's Iliad, Cassandra's warnings are ignored but later come true. In American folklore, Chicken Little warns that the sky is falling but it later proves false.

    We've been getting a string of proclamations about the terrible state of smart grid security. Many of them come from security firms with a vested interest in scaring people. They remind me of similar warnings 15 years ago about Internet security, most of which never came true.

    What about today's warnings. Do they come from Cassandras -- legitimate prophets who will be proven correct? Or are they Chicken Littles, needlessly worrying people?

  2. #2
    I think the warnings are prophetic, though specifics are difficult to identify. Is the FBI the right agency to be chasing this or the only one??
    The field will an interesting one for hackers on a number of levels. Disabling the remote shut off switch in smart meters may appeal to the social consience of some and be saleable to a large number of threatened consumers at a modest price. More involved hacking could make meters respond to increasing price signals with decreasing but not zero load signals. Increased load signals could balance during low price periods to avoid detection by many utiltiy check programs.
    As the number of consumers having smart meters increases along with electricity prices and shut offs, the motivation for hacking will also increase.

  3. #3
    Junior Member
    Join Date
    May 2011

    Exclamation Mostly scare-mongering, but...

    Whilst most of this report is back to the quack doctor fascination with magnets, it does highlight one concern which deserves a bit more attention - the disgruntled employee. That's different from a hacker and is a lot more difficult to guard against.

    Most meters currently being deployed, or being developed, include the option of remote firmware upgrades. A hacker is unlikely to ever get access to this firmware, but a meter employee who is writing the code is. It would not be difficult to add a few lines of code which would disconnect every meter at some critical point in the future. So for countries that include an isolation switch in every meter, such as the UK, or ones controlling demand response as in the US and Australia, a disgruntled employee could easily write some code which could disconnect a large proportion of the grid in the middle of a peak period some months in the future. That would give the utility time to test it and deploy it to all of their meters before the malicious code kicked in. The code could then try to flip the supply back on and off every few minutes until everything in the grid is nicely burnt out. Followed by a truck roll to replace every meter. It's enough to make Enron sound warm and cuddly.

    It's not very difficult to do that if you're already writing the code. And because it would only be activated in the future, it's very difficult to spot. There are techniques for developing high reliability firmware which attempt to spot this type of bug, but I've not seen them being implemented by any meter vendor anywhere in the world. So for all you know it could already be out there waiting for the next summer peaks.

  4. #4
    Junior Member
    Join Date
    Dec 2010

    Smile Somewhat old news.......

    This is somewhat old news I think. I believe the story actually broke in 2009/2010. There was at least some news about a FBI report as of October, 2009.

    PREPA (Puerto Rico Electric Power Authority) was using AMR technology (TWACS) as far back as 2007. PREPA was launching a smart grid pilot using broadband over powerline (BPL) beginning in 2010.

    Some articles to review are available at the following URLs:


  5. #5

    Smart Meters, Smart Consumers

    I wouldn’t consider varying concerns about the increased security risks of smart grid network interconnections mutually exclusive. Cassandra and Chicken Little are both electric customers each approaching the issue from a different point of view. Findings from the Smart Grid Consumer Collaborative (SGCC) Consumer Pulse research shows that privacy and security of smart meter data is a key concern among end-users, particularly related to unauthorized access to detailed electricity usage. There is also concern about the appropriate use of energy usage data, both by the utility and by third parties.

    Utilities have always treated customer data privacy with the highest levels of concern and security. Increased data requirements from smart meters will not change that. While stakeholders know that data security efforts will be ramped up as threats ramp up, they now need to make sure consumers know, and provide reassurance that nothing will change in terms of their data remaining private and secure. Customers want and need assurance that utilities are working with regulators, top cyber security experts and government to develop, and enforce appropriate standards and legislation that strengthens smart grid privacy and security. This assurance is important to developing broad consumer acceptance of the smart grid and engagement with new smart meter–enabled technology and applications.

  6. #6
    Junior Member
    Join Date
    Apr 2012

    Possible missuse of smart grid data

    There will always be people at both ends of the spectrum: disbelief that anything bad could happen, to the other end with chicken-little. The reality is naturally in between.

    Besides the possibility modifying the meter to steal electricity (or reduce the rate). There are other possibilities.
    A thief who may wish to rob a house would like to know energy uses to deduce if no one is home for extended periods of time.

    Other possibilities, which many are already aware of, including the smart grid/meter being a portal for the consumer to control their appliances (turn on air conditioning, or heat, or start the oven, and so on). This is an opportunity for hacker mischief.

    The answer is not surprising: authentication and encryption.

  7. #7

    You have no concept of the most serious part of the danger

    "Those who cannot remember the past are condemned to repeat it." Jorge Santayana.

    I begin my lesson with the Enigma and Code Purple decrypts of German and Japanese codes in World War II and Venona where Arlington Hall broke Russian one time pad codes from WWII on. I conclude with Lam Son 719 an operation in Viet Nam which had the highest rate of aircraft losses of any period during the Viet Nam war. I was an Army maintenance officer there for that operation as part of 108th FAG. It made "going downtown" in Hanoi look like a walk in the park because the NVA broke our signals security. They shot down or destroyed beyond repair 10 aircraft and helicopters every day for 10 weeks. Go to the Mall and the Wall and read the names and units of the casualties between February 8th and April 15th 1971. 95% were aviation.

    Given human ingenuity, you cannot develop a security that will withstand concerted effort of a state actor or an organized group such as Anonymous. They have already succeeded in breaching FBI servers and wiretapped phone calls on "SECURE " telephone lines between the FBI and Scotland Yard and recorded telephone conversations between the two planning the arrest of Anonymous members. The servers at McDill AFB which serves as HQ for CENTCOM were completely compromised and all materials identifying our operatives in that end of the world were obtained by someone. At a much more serious level , any one running Intel based servers is compromised regardless of what you do for security. A Russian security expert named Mikail Kasperskey (no kin to Eugene) demonstrated in Hack In The Box 2008 that due to 53 errata in the Intel processors, javascript exploits of Intel servers can be crafted to take control of the server. There is some debate as to whether or not he is associated with the SVR or the FSB. It would be better if he were since that means the hardware hacks are not necessarily out in the wild. http://conference.hitb.org/hitbsecco...age_id=214.htm Face it no amount of protection is going to work because today's operating systems are designed for interoperability not security.. SSL3.0 was compromised in 1995 and demonstrated to serious effect 3 years ago. TSL 1.2 is the only secure system of authentication out and that is primarily becuase nonee of the commonly used browsers support it. http://www.theregister.co.uk/2011/09...ts_paypal_ssl/

    I have a smart meter installation at my house because I am part of the CPS load shedding program(DR) for AC and I have a solar array. It took one of my clients from my days in the Federal Public Defenders Office less than 10 minutes to compromise my system.


    The smart grid makes our total infrastructure waste water, water, electricity natural gas vulnerable to a Pearl Harbor attack by a state actor or a 9/11 attack by stateless organization. STUXNET and DUQU merely prove the point. http://uk.reuters.com/article/2011/1...rbssEnergyNews

    A return to something like the 3k carrier wave system used in the 1960's and 70's with a complete air gap would allow a utility to operate securely. But RTO's and ISO's even using secure telephone land lines can be hacked by college students as HL&P learned while I worked there in the early 70's.
    Last edited by Edward Hinders; 04-10-2012 at 07:30 PM.

  8. #8

    Cool Smart security

    Not wishing to sound paranoid (because I'm not), but as most of these meters (along with most Smartphones) are being built in a country not known for its alleged reluctance to get involved in state-sponsored hacking..........
    Keeping a roll of foil next to your smart meter, just for emergencies, is starting to look like not such a bizarre idea.....


  9. #9

    Security is needed appropriate to the risk

    Security is like using armor. Wear nothing and you can be easily killed (unless you are Achilles). Wear a bulletproof vest and you may not be killed but you may still have your legs shot off. Wear full body armor and you are unlikely to be killed or maimed. Even then, there will be a chink in that armor, the Achilles heel. This then has to be considered along with the risk. Risk management is about evaluating the likelihood of an occurrence in a scenario and the impact it would have should it occur and the mitigation that would need to be taken to prevent it. So, the likelihood of being shot at where I live now is really very low, so I don't choose to wear any armor. If I were in Damascus or Homs right now, I would choose at least a bulletproof vest.

    The problem with the debates on Smart Grid security is the wild extrapolation that occurs when any security breach is reported and the monolithic view of security in general. For example, the claim that someone who manages to "pwn" (subvert) a smart meter can take down the whole Smart Grid. Not impossible but extremely unlikely. Another example mentioned in an earlier post: the SSL breach (BEAST). This is extrapolated to SSL/TLS1.0 is broken - it isn't (please see Eric Rescorla's blog for why) but this is never explained in the less-detailed posts (e.g. the one in The Register).

    In reference to the above scenario, we are not in a full-scale war (although some would have us believe otherwise). It is said grid security at the moment is woefully inadequate but the lights are still on and I am able to post this reply. However, that is not to say the threats and the landscape aren't different. They are and need to be considered accordingly. Systems need to be adequately protected and designed so they are loosely coupled. The usual security controls need to be put in place to address the information security attributes (confidentiality, integrity etc.).

    It will never be possible to provide a system with 100% security. However if we can provide the right armor for the scenario (including Nick Hunn's disgruntled employee of course) based on risk analysis, the chances are that the lights will remain on.
    Last edited by Robert Cragie; 04-12-2012 at 03:14 AM.

  10. #10


    I don't mean to be rude , but the real world is a lot more brutish than Mr. Cragle thinks. Here is a link to the declassified version of the latest National Security Assessment for foreign illegal operations in the US. http://www.dss.mil/counterintel/2011...ied-trends.pdf Please note that IT technology is the number 1 target for illegal acquisition by foreign operatives. I have had access to secure systems in the US Judicial System since 1999. SSL 3.0 was broken in the Inter-Service Academy Cyber Defense Competition back before 2005 and as a consequence removed from the list of approved protocols by USCERT. Let's just say Mr Rescorla's work is 5-10 years out of date.

    As for the "at war" issue I suggest reading this This link is to a Bloomberg article that provides a simple summary http://www.bloomberg.com/news/2012-0...ed-by-fbi.html The war has never ended.

+ Reply to Thread
Page 1 of 2 12 LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
Powered by vBulletin® Version 4.1.8
Copyright © 2012 vBulletin Solutions, Inc. All rights reserved.