New technology that controls our electrical grids is hackable without proper security measures, one expert shows

Power Grids could the security of our electricity be compromised?

New “smart” electricity meters, beginning to be rolled out across the country, may be rife with bugs that could pose security risks. The new meters create a smart communication network between the user and the local power plant. The software that powers some of the smart meters, however, is coming under fire from security experts for its lack of adequate protections against malicious hacks. One expert, hoping to illustrate the risks involved, claims to have created a worm program that infects one of the popular meters, taking control of its functionality and propagating itself further throughout the grid.

The new meters supposedly require no authentication or encryption whenever running functions such as software updates. These vulnerabilities are what the worm, written by the security furm IOActive as a proof of concept, will exploit using peer-to-peer technology to spread. Using it, hackers could potentially control the workings of the grid, turning on and off power to users, or even reconfiguring the entire system’s settings.


These smart meters were a result of a $4.5 billion stimulus plan by the Obama administration to update electrical grids across the country to make them smarter and more efficient. This could allow meter values to be sent directly to the company rather than requiring a meter reader to stop off at each user’s house. It also can shift, in real-time, the demands on the power grid to provide electricity where needed and change rates based on the electricity being used and what is available. However, in order to receive larger chunks of the stimulus money, companies raced each other to create a smart meter that worked. Perhaps in the rush, the amount of testing needed was reduced and security issues may have been compromised.

Several companies have created their own smart meter products and it is as yet unclear which ones, if any, are affected by a lack of security. The worm described will only be shown at a security conference occurring next month, so we’ll have to wait to see if the claims are true and on what scale.

[The Register]

Want the latest news on grown-up toys and gadgets, product reviews, sneak peeks, and more? Subscribe to Popular Science and enter to win $5,000!

8 Comments

I'm more worried about coronal mass ejections/flares from the sun. These 'Power Grids' need to be modified to prevent damage from happening when a flare hits. I know it's being worked on now, but I doubt any real progress is being made. I'll have to research.

The whole premise of this article assumes that smart meters can do more than monitor the electric grid, certainly that is possible on some grids, but the majority of grids provide no control capabilities through the smart meters. The best you could hope for is a remote disconnect, and you need special hardware between your meter socket and meter to do that. A regular electric meter cannot shut-off anything.

This is simply a case of a security firm claiming they can make a worm to prove it can disrupt the network(when have we all seen this before). Ok, make the worm and prove it and stop trying to get free press with your scare tactics.

BTW as far as solar flares go, they have potential to temporarily disrupt smart meter communication, but really nothing else.

Viruses began in computers, now they are running wild in mobiles.

Will we need virus checkers, firewalls, regular security updates, with our new Smart Meters?

This could be an actual issue, even if the 'smart meters' only report electric usage to the power companies.

If there is, in fact, no real security, that is very bad. I don't want my electric bill to be screwed up.

Additionally, if the companies start to use the meter reports to make network adjustments, things could get ugly.

I say, let the security folks demonstrate their worm. Also, the designers should be showing their security measures to those who need to know. Maybe the security folks are wrong, but there are other areas o concern.

Also, I don't know how often meters are read in the USA, but in NZ it is every two months, and used to be a bill every 2 months, then they began doing estimates in between, with a bill every month.

I foresee Smart Metres resulting in prepaid almost, it gives them the ability to send a bill every day.

10,000 homes in NZ are on prepaid meters (enter a number like a prepaid mobile) because bad payers don't get power otherwise, such people live in state housing, and move around a lot, so people moving into their empty homes are stuck with prepaid, unless they pay for an old meter to be installed. Recently we had a sudden early cold snap long weekend, lots of people could not get prepaid top ups, due to a software failure at the retailers call centre.

2 years ago, a elderly lady (and family) had their power cut off because they had not paid for a long time, the family talked to the representative while he was turning off their power, but did not tell him that the lady needed power for a oxygen generator. She died.

It became political. For my personal health reasons, my Telco and Power retailer, have me on their new medical registrar, but a lot of people are trying to get on it, thinking it means free power for life, no debt collectors.

NZ is in two main Islands, most of the population is in the North Island, we have lots of Hydro in the South Island, there is a 400 mile long overhead DC transmission cable coming up the South Island, then a cable (2 sets) under Cook Strait. Pole one and pole two. The original pole one built 40-years ago uses mercury filled equipment to turn DC into 50 cps AC on the North Island end, almost in the middle of our capital city Wellington. (Haywards in the Hutt Vally

Last year this cable lost its insurance cover for a while, because the old mercury equipment is obsolete, however we got it back for this Winter (just beginning, and its bad) but de-rated regaining our insurance cover, the big risk is, a fault at Haywards could explosively vaporise 500-kg of mercury and contaminate Hutt Vally city and Wellington, maybe 20 miles away.

So pole 2 not using mercury equipment (but silicon switching) is running flat out, but even the 400 mile overhead lines are at risk, we had close calls last Winter with transmission towers going over, one tower had guy wires added during a storm.

There is hydro in the North Island, but if the cable from the south goes out, the North Island will be using peak load generation to fill base load demand, all our gas, coal and oil thermal stations will be on line 24/7.

We also have a (I think 50mw) base load geothermal station in the North Island, built in the early '50s for the British planning to make heavy water here for their A-bomb project, but just as NZ began needing lots of power for industry, the British changed their mind, and we got that power.

My retailer has begun putting in Smart Meters in Auckland (top of the North Island)and working south.

I don't think it was intended, but Smart Meters,once every consumer has one, would turn out to be a really fair way of rationing power in NZ.

Our Cook Strait cable won't be fixed and upgraded for another 3 years, and due to the Greens (I admit I am one, but only because I support renewal power) we have not built as much generation the last 15-years as we should have. Previous years, drought in the South Island and North Island meant we were always at risk of running out of power NZ wide during our Winter so the North was sending power South, but this winter the lakes are over flowing down south, and we can not make full use of all that hydro power.

There is a aluminium smelter down south, but due to the recession, its had to cut production, meaning its spilling water from its hydro lake, which it also shares with the national grid.

Hey, our retailers offer us power slightly cheaper if we allow them to turn on and off our hot water supply heater, and space heating.

The technology goes back to Bell inventing the telephone, first trying vibrating reeds, which same system was also used to send multiple telegrams down one telegraph line.

I think there are only a limited number of codes, its like a pendulum swinging to a certain beat, until it swings far enough to hit a switch, I sometimes can hear it, on a old radio of mine.

One local power retailer also offers broadband WWW over the power network, that is a signal like DSL piggy backed, I suspect Smart Meters use this technology, but the big hold up was, the DSL signal gets blocked by transformers, such as the one on your local street corner, the transformers are being retrofitted with DSL by-passes.

Smart Meter ability, might also mean another ISP provider in your area.

Part of being Energy Smart means your retailer controlling load or demand (not just anticipating and bringing on line generators), so Smart Meters will be able to turn off and on, lots of devices in your home, e.g. if there is a brief shortage of power, they could turn off your freezer or air conditioning for 5 minutes, all in the interests of coping with a brief peak demand.

Smart Meters are going to make your power line, which you used to share with your neighbours, into something just like your land telephone line, specific for you, where you have peak and off peak long distance calling rates, so you could end up with two power rates at the same time, one for your base load, hot water, freezer etc, but a higher rate for devices you chose to turn on and off yourself, and don't forget the special night rates for charging the battery on your new electric car. And maybe a premium rate for a device they decide is a luxury.

And if you don't pay the bill, they can even shut you off from their HQ for a few hours each day, until you get the message that they are in control and you are powerless.

Old Timer: "I don't think it was intended, but Smart Meters,once every consumer has one, would turn out to be a really fair way of rationing power in NZ."

Ding ding ding. Yes Old Timer, that IS the point of this exercise. Among other things: since they already have test programs offering internet service thru your electric hook-up; data interaction with a Smart Meter is a real factor, not a fantasy.

So then, it's entirely possible that someone could 'get into' the 'smart grid' for whatever reason; the lack of obvious safe-guards is an issue to be addressed.

And I don't know about you, but I'm NOT interested in extending that level of control into my household. My usage is self-regulated: my cost vs my budget. Period.

Any other reason allows for the possibility of [State=political] ABUSE. [Show me in black and white what rights I retain after self-regulation becomes a 'non-issue'.]

The other matter OT touches on: generation capacity vs future needs [system growth]. For people of a certain mind-set, access control is the perfect way to avoid addressing the issue of future needs. The 'pie' never needs to get bigger, they'll just make your slice smaller.

Sorry Old Timer, being a true 'Green' means foregoing 'growth'; the honest ones will tell you as much.

Hey, mate, I never said I was a true Green.



Download Our iPhone App

Stay up to date on the latest news of the future of science and technology from your iPhone with full articles, images and offline viewing



Follow Us On Twitter

Featuring every article from the magazine and website, plus links from around the Web. Also see our PopSci DIY feed



Become a Fan On Facebook

Share links with friends, comment on stories and more


December 2009: Best of What's New

In our December issue, Popular Science names the 100 best innovations of the year: bombproof wallpaper, self-parking cars, the fastest helicopter, and 97 more. Plus inventor profiles and videos.

Check out the best of what's new here.

Popular Science Photo Pool


Share your photos in the Pop Sci pool at www.flickr.com!
tags_sprite.png
POP_embeddedForm_cover_May09.jpg