Black Hat Reveals Tech Grid Holes

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Technology vendors and governments are racing towards adopting Smart Grid technologies which could help to improve energy use and conservation efforts. But the Smart Grid, and in particular the smart meter part of the grid, could also introduce a new class of security threats. In April, a report came out claiming that the current US electrical grid, without the smarts – is also at risk from attack.

In a presentation set to be delivered at the Black Hat security conference in Las Vegas on Thursday afternoon, IOactive security researcher Mike Davis will detail what his research found is wrong with smart meters today. Davis spoke with InternetNews.com in advance of his session, providing some details on the types of attacks that he found smart meters to be at risk from. Davis noted that the goal of his presentation isn’t to teach people how to hack the power grid, but is intended as a wake up call to smart meter vendors, which he said have for the most part been receptive to his research.

Davis and his team were able to take control of vulnerable smart meters. With that control, Davis could potentially turn remote power on or off as well as anything he wanted to do by way of a worm that the smart meters could be infected by.

“In the case of the worm that I’m talking about, we found more than one system allowed us to put our own firmware onto the endpoint device,” said Davis. “Due to the peer to peer nature of the network we could hop from one meter to the next updating the firmware, so that essentially they could all be running a custom firmware patch that any attacker could use to insert into the network.”

Smart meters are the physical hardware devices that help to enable the smart grid, by being attached to homes and business, enabling a utility to remotely monitor usage as well as having the ability to shut the power off or on.

Davis explained that he physically pulled apart smart meters from numerous vendors in order to figure out how they worked and to identify any security issues.

The source of the problems

“When I go looking for vulnerabilities, I’m pulling circuit boards out, sniffing the connection between chips and seeing how the chips communicate,” Davis said. “It’s the architecture that is failing sometimes and sometimes it is a software quality issue.”

Smart meters work on what are supposed to be closed systems that are not open to public. Yet Davis noted that ultimately the meters do need to communicate and that’s where the security issues come up.

“The meters themselves are devices in the network. So if you go up to the house and you take the meter off the house that meter becomes a tool to attack the network,” Davis said. “At that point if the designers of the network didn’t anticipate a node going rogue bad things can occur.”

Davis has already approached the smart meter vendors with his research and some of them have been receptive to improving security.

“I think I’ve already gotten what I wanted out of this research, I’ve started the dialogue,” Davis said. “People now understand that smart meters are an active device, and in response utility companies are pushing the smart meter vendors to have security tests done.”

Article courtesy of InternetNews.com.