Security analysis of Dutch smart metering systems - Multiple Choices

4.1 Port P0 4 PRACTICAL ANALYSIS
Figure 9: Meter readout using an optical probe and Landis+Gyr MAP120 software
4.1.4 Attack feasibility
We have verified that at least some of the attack vectors as summarized in table 7 are accessible
through port P0. Alteration of security settings and disruption of communication to Gas or Water
meters are possible on Sagem meters, but require opening of a cover which will break a security
seal and possibly activate a tamper switch. Disruption of P3 communication settings could not
be verified. Alteration of tariff settings is verified by information received from Oxxio.
C • Disable or alter data security parameters Feasible (seal protection)
I
• Reset or alter metering data
• Alter tariff settings
Research required
Feasible
A
• Disrupt communication to CAS (P3)
• Disrupt communication to Gas or Water meter (P2)
Research required
Feasible (seal protection)
Table 7: Port P0 attack feasibility
It is questionable whether the security seal and tamper detection of the cover can prevent unauthorised
use of programming functions through the optical port. Grid companies have confirmed
that tamper switches can generate false positives caused by passing metro trains. Therefore, it is
questionable whether grid companies will check every case of tamper detection. Sealing tools are
also widely available at low costs at Ebay for example, which could give attackers the opportunity
to reseal the meter after reprogramming. Furthermore, disruption of P3 communication could
prevent tamper alerts from being send to the grid operator.
The optical port is an easy way to interface with a smart metering system which makes it likely
that attacks on this port will be developed by researchers or attackers. The most important meter
settings will require breakage of a seal, but it is questionable whether this would stop a dedicated
attacker.
24