Schneier on Security

Clive Robinson • March 5, 2017 3:53 AM

Rip off Smart Meters

As I've commented in the past, I don't like Smart Meters due to the way many of them work as well as the fact they can enumerate you via your electronic device usage[1].

Part of the problem is "efficient devices"... Modern devices like LED lights use so little power that they use complex waveform switch mode power supplies. To accurately measure the power usage with a sampling sensor takes quite a large number of samples "of a stable signal". The problem is the LED and similar devices to meet various EMC and other requirments quite deliberately do not use stable signals to "get under the noise mask".

Thus the problem that the Smart Meter reads the power consumption of these devices quite inaccurately. Whilst some might read lower than usage, which would give a consumer a corespondingly lower bill. Others however will read high by as much as six times, which would give the consumer a very much higher bill, corespondingly giving the power supplier something like 2500% more profit[2].

http://sciencebulletin.org/archives/10940.html

[1] It has been shown that your home entertainment system has a power signal that can be used to very accurately identify what you are watching / listening to. And a smart meter sensor system has the sensing bandwidth to make the required measurments as well as the communications bandwidth to forward that information...

[2] That is the quoted profit on electricity supplied to home consumers in a number of places is about 20%. If the meter reads six times actual consumption, the consumer rather than paying 1USD giving 20cents profit to the supplier, would pay 6USD giving them 520cents profit instead. Which gives them 500cents or 2500% increase due to the faulty meter, (nice business if you can get it...).

Clive Robinson • March 5, 2017 11:16 AM

@ CallMeLate...,

"Help customers save money by shifting their usage to off-peak periods"

I think I've mentioned befor that that "political line" is compleat bovine excreter in huge steaming piles. Those uttering it in Government and the industry should be taken out and neutered with a hammer and anvil prior to having all their assets and those of all their living relatives sequestrated.

As you note it's a huge saving not just by the cost of employing meter readers but all the equipment etc used as part of their job. In effect an annual saving of about ten times what the --soon to be unemployed-- meter reader actually gets payed.

That's just the start of it, the next part is infrastructure maintanence and upgrade savings. Putting in new high voltage high efficiency primary network is not just eye wateringly expensive, you could buy several countries with the money they are going to save on that.

But the number one rule in the energy game is never give real savings to tied in customers, bleed them every which way you can. Thus if you reduce the unit price up the supply component to recover the loss of income from unit sales. This is why those energy companies are spending millions on bribing politicos and fighting mega battle court cases to stop people "going off grid".

I could go on but by now people should be thinking "hang on a mo, let me check that out" and when they do they might just suffer a pain in the chest or head from realising just how badley they are going to get worked over.

Oh and another trick they will pull will be installing the cheapest crapiest most unreliable piles of junk they can then charging you ten or twenty times the price. Either the first time or every subsequent time, pluss even though you will pay through the nose for it they won't alow you to buy your own on the open market...

Clive Robinson • March 6, 2017 4:27 AM

@ John Smith,

I have worked with smart meters, running EMC tests in GTEM cells and so on. Part of my tests was to blast the meters with pulsed RF, intense enough that the h/w and s/w on the meter stopped. Stopped as in ... no metering of electricity passing though the meter.

Welcom to the world of "EmSec Active EM Fault Injection Attacks" it's a fun world to play in.

I independently discovered it back in the 1980's when designing telemetry systems. It only took holding the "rubber duck" antenna a few inches from the CPU chip (1802 rad hardened) to cause it to lock up entirely, and also stop a brown out and timeout circuit from reseting the CPU...

As you note it's no better more than thirty years later.

Why the academic community have not investigated it further is a real puzzle, there are many PhDs and papers to be made in the early stages of a new domain of interest...

Clive Robinson • March 6, 2017 9:09 AM

@ Anura,

It might be time to have them regulate the [Smart] meters to ensure regular testing and calibration, as well as audits of hardware and software

Unfortunately many Smart Meters would pass the tests, but fail in real life.

It's due to conflicting standards requirments.

Low power low output voltage SMPSUs designed to run off of 80-300V 45-70Hz AC and used in LED lights and most IoT devices have issues. Basically they turn on only for very small fractions of a cycle. This turn on/off generates a waveform with high harmonic content up into the hundreds of MHz and is especially bad if the on/off is regular in frequency. Thus they fall foul of EMC directives and their "noise limit masks". The easy solution component cost wise is to move the on/off times in what apprars to be a random pattern, thus spreading the harmonic content into wideband slots thus bring down the Energy per Hz inside the mask. Thid is realy a quite complex signal as in effect it's a Direct Sequence Spread Spectrum (DSSS) signal.

The meter standards however are based on measurments decided to measure the phase relationship between the AC Voltage waveform and the AC current wave form and multiplying their magnitudes to give the "complex power" then by the cos of the phase difference to get from the "apparent power" to the "real power"... Whilst this can be done relatively trivially for sine waves with a lookup table and interpolation between points, other "sampled" waveforms fail realy baddly.

THus the difference between the real power (what you should pay for) and the complex waveform "apparent power" can not only be immense but immensely difficult to calculate.

The more "low power low output voltage SMPSUs" you use the worse the problem and the more likely you are to end up paying for some mangled complex waveform "apparent power" which is many times the real power.

How we are going to resolve this "clash of standards" I don't know, but what I do know is that the Likes of LED bulbs are going to cost you many times the real power they use... "Treebles all round" for the suppliers "Rip off misery" for the low energy user...

Clive Robinson • March 6, 2017 2:08 PM

@ JG4,

It would be advantageous to block the high-frequency signals from the smart meter modem that are querying appliances in the structure without consent and without authorization

It would but as in all things there is a price to pay...

A simple solution I've mentioned when talking about setting up a "poor man's SCIF" is to put a couple of EMC style mains filter blocks in series. Unfortunatly there are a couple of problems. Firstly the cut off frequency is quite high, secondly they shunt not reflect the unwanted energy thus generating heat and power usage you have to pay for.

You can partialy resolve the cut off frequency problem by increasing the value and thus size of the filter components. To see where this takes you have a look at a Line Issolating (LI) Line Impedence Stabilisation Network (LISN) used in EMC testing. They are designed to have a cut off frequency below 9KHz to mret EMC masks/test requirments[1] but alow the pasing of considerable mains power, the design of such beasts[2] often surprises people.

To get the cut off frequency lower down below 600Hz would require the components especially the inductors to be many times the size (around twenty times the size for air-core single winding inductors). I've built filters using ferrite toroidal audio transformers of the type used in Class A Bridge amplifiers, that some jokingly refer to as "Battleship anchors".

One problem as I've indicated is that they "shunt not reflect" the energy of the signals you are trying to remove, usually into a low impeadence such that they get turned into heat. Thus "real power" that costs money is being used.

To reflect the energy back to the source can greatly increase the efficiency, which is what you see in the design of Class F amplifiers (of which I have one that produces in excess of 1KW at a VLF "very low frequency" Amateur Radio band not far below the old Long Wave band). In essence a class F system works by presenting a short circuit to odd harmonics and open circuit to even harmonics by using a quarter wave line from the supply and a half wave line to the load, the result being a square wave voltage on the FET drain but a sinusoidal current to the load. Thus no harmonic power is dissipated in any load.

Thus you can reflect the signals back into the mains supply such that whilst their may be a voltage present, no current flows for it thus no real power is used thus you don't have to pay for it. Further if there is no power at those higher frequencies they are not radiating out either (current through a loop etc).

[1] https://en.m.wikipedia.org/wiki/Line_Impedance_Stabilization_Network

[2] http://www.feng.pucrs.br/~fdosreis/ftp/publicacoes/Conferencias/IECON/IECON2003/lepuc6elio.PDF

Clive Robinson • March 9, 2017 7:12 AM

@ r,

You might want to look into the background of the author of that ZDNet article you link to.

Whilst there is in part a degree of truth in the article, there is no mention that many smaller commercial companies suffer from exactly the same if not worse problems.

Thus it's not realy an Open-v-Closed software argument but one of Little-v-Big team argument.

Which brings the argument to one of resources, little teams suffer disproportionately in the resources issue. One large team issue is the issue of in house experts. In a large organisation a single experts abilities get spread across a much larger surface than they do in small organisations, thus the number of experts actually required does not change much with the size of an organisation.

Clive Robinson • March 9, 2017 1:06 PM

@ CallMeLate... And others,

Just think how much more interesting life will be when - yes, *when*, not if - reprobates have crasked operational and security protocols of smart meters.

What "operational and security protocols"?

A ways from my home down the street is a grey post in the pavement. When the top is off and a service technition is there it is very easy to see what is in the post and from glancing at the screen connected by the serial port what is going on.

It was fairly easy to find what frequency the UHF radio used and then using a similar post elsewhere with a data collecting device work out the simple unencrypted protocols... Having made this info available to others that do red team work on industrial equipment, other information became available including passwords etc...

I have no reason to belive that the designers of such systems would put any effort into real security, just a bit of obfuscation at best.

As with much infrastructure equipment the only way you will get any kind of security is by legislative and regulative means and currently that's not happening.

Clive Robinson • March 9, 2017 4:15 PM

Is Android the OS equivalent of FEAL

Back in 1987 a couple of people --who probably still cringe today-- designed the Fast data Encryption Algorithm (FEAL)[1] to replace DES. As with all new encryption algoritms of the time presented at conferances it got analyzed... And it's design was such that it became the "go to" algorithm to attack. It was the algorithm where several new crypto analysis attacks were found and honed two of which were linear and differential cryptoanalysis...

Well it appears you can not pick up a conference paper today that is not attacking Android in some new way. Which is probably good for the design theory and practice of OS construction, but do you want the latest "go to target" in what is begining to look like the looser in an 455 kicking contest?

Well even if you don't have an Android device the title of this paper alone should make you curious,

MaMaDroid: Detecting Android malware by building Markov chains of behavorial models

We evaluate MaMaDroid’s accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 87% and 73% F-measure, respectively, one and two years after training).

https://www.internetsociety.org/sites/default/files/ndss2017_03B-3_Mariconti_paper.pdf

[1] https://en.m.wikipedia.org/wiki/FEAL

Clive Robinson • March 9, 2017 4:46 PM

JavaScript worse than we guessed

As a few know, I don't take kindly to sites that insist on using JavaScript. In fact I shun them big time.

The reason is that when I've looked I've found that out of date and insecure libraries are usually involved. So I stopped looking and just turned JavaScript off (which despite the hype does have advantages).

Well it would appear that my reasoning based on a small sample applies rather more generally than I thought. In a paper called,

Thou shalt not depend on me: analysing the use of outdated JavaScript libraries on the web.
Perhaps our most sobering finding is practical evidence that the JavaScript library ecosystem is complex, unorganised, and quite “ad hoc” with respect to security. There are no reliable vulnerability databases, no security mailing lists maintained by library vendors, few or no details on security issues in release notes, and often, it is difficult to determine which versions of a library are affected by a specific reported vulnerability.

http://www.ccs.neu.edu/home/arshad/publications/ndss2017jslibs.pdf

The authors have taken a much more indepth look than I did, "And folks it sure ain't pretty" so you might just want to turn it off and delete it from your systems for good where you can.

Clive Robinson • March 11, 2017 8:42 AM

@ ab praeceptis,

Now, I personally don't care too much; I'm used to work with utterly poor tool chains but I would have loved so much to have something to generally recommend.

I'm of an age where I had to build not just my own toolchains but also my own BIOS equivalent and reduced set OS or RTOS, the later two for virtually every embedded project I worked on as the chip designers were shall we say not the users of their products...

There are three basic things to say about this,

Firstly it starts as a great waste of time, and even after you learn the tricks there is still effort involved that might be better used else where.

Secondly you learn quite a lot you would otherwise have no reason to learn. Importantly it has knock on effects that helps you write better and certainly more resiliant and secure code (skills that are rarer than the proverbial "hens teeth".

Thirdly, it makes you a creature of habit, like a blind gardener, you are more atune to your own environment than most others are to theris, but sadly you don't get to see how other gardens and their environments work. So whilst you are quicker off the mark and faster than the ordinary you are nether the less limited by your own horizons and falling behind as you do not come into contact with new ideas in a way you have to realy evaluate them. Thus like an old dog you are good at the tricks you perform but hapless with those that have become vogue.