Technology news and Jobs 
VIRTUALISATION Victoria's (not so) smart electricity meters
VIRTUALISATION Victoria's (not so) smart electricity meters | Victoria's (not so) smart electricity meters |
|
| by David Heath | |
| Wednesday, 29 July 2009 | |
|
Page 1 of 2   
Featured Whitepaper
5 Best Practices for Smartphone Support
As is so typical with rapid design, development and roll-out of new technologies, scant regard is paid to security of the devices. This has happened time and time again – the original GSM security /encryption being a shining example – developed in obscurity, it was rapidly shown to be completely 'broken.' Roll on the latest (pending) disaster. At this week's Black Hat conference in Las Vegas, Mike Davis of IOActive will present the result of his team's efforts to defeat the Smart Meters. The results are not pretty. Quoting from the presentation abstract , "Mike Davis and a team of IOActive researchers were able to identify multiple programming errors on a series of Smart Meter platforms ranging from the inappropriate use of banned functions to protocol implementation issues. The team was able to "weaponize" these attack vectors, and create an in-flash rootkit, which allowed them to assume full system control of all exposed Smart Meter capabilities, including remote power on, power off, usage reporting, and communication configurations. "In this presentation, Davis will discuss the broad, yet almost ubiquitous exploits and basic design flaws in today's Smart Meter and Advanced Metering Infrastructure (AMI) technology. Typical attacker techniques such as buffer overflows, persistent and non-persistent root kits, and even self-propagating malicious software will be illustrated. Davis will even demonstrate a proof-of-concept worm attack and the general reverse engineering techniques used to achieve code execution. To show all is not hopeless, he will also cover the incident response impacts of possible worm attack scenario. Finally, building upon the analysis of the worm-able attack surface as well his hardware and software penetration testing research, Davis will suggest inherent design fixes that AMI vendors can implement to greatly mitigate these broad exploits." The implementation consultants are dealing with this, right? Umm…. |
| < Next story in category | Previous story in the category > |
|---|
