Risk
7/28/2009
06:57 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Black Hat: Smart Meter Worm Attack Planned

IOActive's Mike Davis intends to unleash a worm on a smart meter at the Black Hat security conference on Thursday.

The smart grid, the emerging power distribution infrastructure upgrade, may not be the bright idea its name suggests. In the rush to modernize the way electricity moves, security appears to be an afterthought.

At Black Hat on Thursday, Mike Davis, a senior security consultant with IOActive, plans to conduct a worm attack on a smart meter, a part of the smart grid that's being installed at consumers' homes around the country.

The worm, Davis claims, can copy itself from one smart meter to the next in a neighborhood, ultimately causing power outages and rendering the smart meter inoperable.

"Many of the security vulnerabilities we found are pretty frightening and most smart meters don't even use encryption or ask for authentication before carrying out sensitive functions like running software updates and severing customers from the power grid," said Davis in a statement.

IOActive president and CEO Joshua Pennell said much the same thing in March when he testified before the Committee of Homeland Security and the Department of Homeland Security.

"Based on our research and the ability to easily introduce serious threats, IOActive believes that the relative security immaturity of the smart grid and AMI markets warrants the adoption of proven industry best practices including the requirement of independent third-party security assessments of all smart grid technologies that are being proposed for deployment in the nation's critical infrastructure," he said.

Last year, a CIA analyst revealed that "cyberattacks have been used to disrupt power equipment in several regions outside the United States." Such attacks have been rare due to the complexity and obscurity of the SCADA systems that govern electrical infrastructure. With the smart grid transition, the technical barriers to an attack of this sort are likely to be lower, at least initially.

Google and Microsoft are both developing smart meter services that aim to provide greater insight into home energy usage. Google has its PowerMeter project, and Microsoft in June introduced Hohm.

Davis is scheduled to make his presentation on Thursday, July 30 from 4:45-6:00 P.M. in the Milano Ballroom at Ceasar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which publishes InformationWeek.

InformationWeek has published an in-depth report on Google's upcoming Chrome OS. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2329
Published: 2015-08-31
Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by ...

CVE-2014-2330
Published: 2015-08-31
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown ...

CVE-2014-2331
Published: 2015-08-31
Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2332
Published: 2015-08-31
Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2570
Published: 2015-08-31
Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.