Smart Meters - Public Service Commission

Smart meters are a crucial component of the smart grid. The devices are designed to
collect energy consumption data from homes and transmit it back to power distribution
companies for billing, network and demand management purpose. The technology also
lets consumer view their energy usage patterns in near real time to help them better
manage home energy use.
Utility companies around the country are in the process of installing millions of smart
meters in homes to better manage energy consumption, respond to demand better and
eventually offer tiered rating plans based on a consumer's energy use habits.
The problem is that there are no publicly available tools for testing the security controls
of these systems, McIntyre said. Poorly configured and poorly protected smart meters
can allow attackers to take control of the system and manipulate the data that they
collect and transmit, he said.
"They can read and modify any data, they can reset usage tables, they could change
the rate type," and commit other types of fraud, he said.
Most meters provide low-level access to the device, mid-level administrative access
and super-user privileged access to the device, he said. Without the proper tools there
is no way that utility companies and others can verify the strength of the access control
and authentication mechanisms the device maker might have put in place for
controlling access, he said.
McIntyre downplayed concerns about tools such as Termineter giving malicious
hackers easy access to something they can use to attack smart meters. The same sort
of open source tools that were used to build Terimenter is available to anybody that
wants it so there's no telling if similar tools haven't already been built by malicious
attackers, he said.
The tool as it exists today also requires the attacker to have a fairly good understanding
of how smart meters work. To get it to communicate with a smart meter, users need to
get physical access to the device he said.
Meanwhile, according to a description of InGuardian's presentation at Black Hat next
week, the company will show how criminals can gather information and authentication
credentials from smart meters. The company will also show how a smart meter's IR
port can be used to interact with the device.
Jaikumar Vijayan covers data security and privacy issues, financial services security
and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or
subscribe to Jaikumar's RSS feed . His e-mail address
isjvijayan@computerworld.com.