Risk
7/28/2009
06:57 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Black Hat: Smart Meter Worm Attack Planned

IOActive's Mike Davis intends to unleash a worm on a smart meter at the Black Hat security conference on Thursday.

The smart grid, the emerging power distribution infrastructure upgrade, may not be the bright idea its name suggests. In the rush to modernize the way electricity moves, security appears to be an afterthought.

At Black Hat on Thursday, Mike Davis, a senior security consultant with IOActive, plans to conduct a worm attack on a smart meter, a part of the smart grid that's being installed at consumers' homes around the country.

The worm, Davis claims, can copy itself from one smart meter to the next in a neighborhood, ultimately causing power outages and rendering the smart meter inoperable.

"Many of the security vulnerabilities we found are pretty frightening and most smart meters don't even use encryption or ask for authentication before carrying out sensitive functions like running software updates and severing customers from the power grid," said Davis in a statement.

IOActive president and CEO Joshua Pennell said much the same thing in March when he testified before the Committee of Homeland Security and the Department of Homeland Security.

"Based on our research and the ability to easily introduce serious threats, IOActive believes that the relative security immaturity of the smart grid and AMI markets warrants the adoption of proven industry best practices including the requirement of independent third-party security assessments of all smart grid technologies that are being proposed for deployment in the nation's critical infrastructure," he said.

Last year, a CIA analyst revealed that "cyberattacks have been used to disrupt power equipment in several regions outside the United States." Such attacks have been rare due to the complexity and obscurity of the SCADA systems that govern electrical infrastructure. With the smart grid transition, the technical barriers to an attack of this sort are likely to be lower, at least initially.

Google and Microsoft are both developing smart meter services that aim to provide greater insight into home energy usage. Google has its PowerMeter project, and Microsoft in June introduced Hohm.

Davis is scheduled to make his presentation on Thursday, July 30 from 4:45-6:00 P.M. in the Milano Ballroom at Ceasar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which publishes InformationWeek.

InformationWeek has published an in-depth report on Google's upcoming Chrome OS. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.