http://www.nctimes.com/business/article_244ff4dc-7f2b-5a8b-96d2-dc14c17681bf.html
ENERGY: Experts hack new power meters
Utilities installing networked devices on homes
By ERIC WOLFF Posted: January 10, 2010 9:30 pm
Lee Campbell shows the "smart meter" installed by SDG&E above his
regular electric meter at his home in San Diego last Feb. 12. (File
photo by Hayne Palmour IV - Staff Photographer) .
As California's utilities roll out millions of "smart meters" in the
coming years, they're creating, for the first time, the possibility
that the electricity infrastructure could be hacked through a home,
security consultants say.
With San Diego Gas & Electric Co. and Southern California Edison
installing 7.3 million smart meters ---- upgrading their entire
customer base ---- they're essentially attaching small computers to
each house, each equipped with wireless communications back to the
utilities.
Utilities say they have been hardening the smart meters since they
began development, but security consultants say they are worried: If
criminals cracked the system, they could remotely install a virus that
could shut down power for millions of customers.
The new smart meters will have a host of capabilities: They will
credit homeowners who produce their own electricity via solar cells or
wind mills, be able to wirelessly communicate data to the utility and
let utilities turn off the power remotely, among other functions that
could be added.
"Were it telemetry only, then the only compromise is privacy," said
Mike Davis, senior security consultant for the security service
IOActive. "When you add remote disconnect, then you increase the
attractiveness of the meter as a target."
Davis and his team hacked into smart meters last spring as part of a
proof-of-concept they showed off at a Las Vegas security conference
last summer.
They reverse engineered meters they bought on eBay and found in trash
bins near installation sites. Then they installed a computer virus
that would replicate itself across the wireless network and block the
utility from each meter as it went.
Representatives from Edison and SDG&E said that the demonstration
didn't change their work at all; that they've been working on security
since they started development three years ago.
But Davis noted that utilities now require secure recycling of old
meters, and eBay won't allow that sort of gear to be sold on the site
any longer. Davis said they have done such a good job keeping the
meters out of his hands that he hasn't hacked the most recent meters
because he can't find one through legal means.
The demonstration may have also driven the federal government to
create standards for smart meters in the previously unregulated smart
meter arena. The National Institute of Standards and Technology, a
branch of the Department of Commerce, released a draft of standards in
September.
"Our security complies with the emerging smart grid standards in
NIST," said Paula Campbell, director of the Edison Smart Connect
Program. "There's unique encryption, all designed with the goal in
mind of minimizing the vulnerabilities."
The encryption would apply primarily to over-the-air communications
from the devices. In theory, a criminal could sit in a car up to a
mile away from a site and attempt to hack the WiFi signal of the
devices.
Baker said that would be pretty hard.
"It's called security in depth," Baker said. "The old technology is
there's one key that could open every door in the neighborhood. In the
systems employed today, you need a different key for every room in
your house."
Alternatively, a hacker could just try to wire directly into a meter.
All the devices will include a detector that sends an alert to the
utility if the meter is shaken, removed or even if the front cover is
taken off.
