Security analysis of Dutch smart metering systems - Multiple Choices

4.4 Port P3 4 PRACTICAL ANALYSIS
It is unclear whether encryption is being used in any of the proprietary RF protocols that are used
today, or whether it will be used in NTA compliant wireless M-Bus implementations in the future.
Further research is required to verify this. Generic devices that can sniff and simulate wireless
signals, such as GNUradio [26] could be used to analyse this.
4.3.2 Attack feasibility
We have seen that simulation of a wired M-Bus master to send fake control commands is possible
using a M-Bus Micromaster, making such an attack feasible. It is also possible to simulate a M-
Bus slave using the M-Bus slave level converter, which makes simulation of a gas or water meter
to send fake meter data feasible.
Although the wireless encryption as defined in the M-Bus specification contains a potential weakness,
further research is required for attacks on wireless communication. This is applicable to
both wireless M-Bus as well as the various proprietary wireless protocols that are available. An
overview of the different attacks is displayed in table 10.
C • Wireless M-Bus sniffing Research required
I • Alter meter data of M-Bus connected meters Feasible
• Block P2 communication to and from meter Feasible
A • Send fake valve close commands to wireless M-Bus meters Research required
• Send fake valve open commands to M-Bus meters Feasible
4.3.3 Recommendations
Table 10: Port P2 attack feasibility
Encryption and authentication between devices is necessary and should be required by the NTA.
Especially in a wireless environment sniffing of meter communication could affect the confidentiality
of meter data. Unauthorised control command could lead to a breach of availability when gas
or water valves could be controlled from a remote distance.
It would be recommended to update the M-Bus standard to a more modern encryption mechanism
which could replace the single DES standard. In case the M-Bus standard defines encryption as
mandatory instead of optional, more manufacturers would be likely to implement those features.
4.4 Port P3
Port P3 is defined as the communication port between the meter and grid operator. The NTA
defines PLC, GPRS and Ethernet as possible communication technologies. Communication can
take place directly from the smart meter to the CAS at the grid operator or through an intermediate
data concentrator (DC) which passes it data to the CAS. Besides the technologies mentioned in
the NTA we will also describe radio frequency (RF) based systems which are being used in various
pilot projects.
4.4.1 Implementation
Ethernet (IP)
Delta Energy is the only grid operator we have found testing a smart metering system which uses
a broadband Internet connection as a communication channel. Delta is also the cable network
28