Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/28/2009
06:57 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Black Hat: Smart Meter Worm Attack Planned

IOActive's Mike Davis intends to unleash a worm on a smart meter at the Black Hat security conference on Thursday.

The smart grid, the emerging power distribution infrastructure upgrade, may not be the bright idea its name suggests. In the rush to modernize the way electricity moves, security appears to be an afterthought.

At Black Hat on Thursday, Mike Davis, a senior security consultant with IOActive, plans to conduct a worm attack on a smart meter, a part of the smart grid that's being installed at consumers' homes around the country.

The worm, Davis claims, can copy itself from one smart meter to the next in a neighborhood, ultimately causing power outages and rendering the smart meter inoperable.

"Many of the security vulnerabilities we found are pretty frightening and most smart meters don't even use encryption or ask for authentication before carrying out sensitive functions like running software updates and severing customers from the power grid," said Davis in a statement.

IOActive president and CEO Joshua Pennell said much the same thing in March when he testified before the Committee of Homeland Security and the Department of Homeland Security.

"Based on our research and the ability to easily introduce serious threats, IOActive believes that the relative security immaturity of the smart grid and AMI markets warrants the adoption of proven industry best practices including the requirement of independent third-party security assessments of all smart grid technologies that are being proposed for deployment in the nation's critical infrastructure," he said.

Last year, a CIA analyst revealed that "cyberattacks have been used to disrupt power equipment in several regions outside the United States." Such attacks have been rare due to the complexity and obscurity of the SCADA systems that govern electrical infrastructure. With the smart grid transition, the technical barriers to an attack of this sort are likely to be lower, at least initially.

Google and Microsoft are both developing smart meter services that aim to provide greater insight into home energy usage. Google has its PowerMeter project, and Microsoft in June introduced Hohm.

Davis is scheduled to make his presentation on Thursday, July 30 from 4:45-6:00 P.M. in the Milano Ballroom at Ceasar's Palace in Las Vegas, where Black Hat is being held.

Black Hat is owned by TechWeb, which publishes InformationWeek.

InformationWeek has published an in-depth report on Google's upcoming Chrome OS. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "This is the last time we hire Game of Thrones Security"
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
CVE-2019-19230
PUBLISHED: 2019-12-09
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.