38C3: Blinkencity, radio controlling street lamps and power plants [video]
1–10 of 54 posts
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#2Saw this in person, awesome look at street lamp control and then walking that all the way up to "oops we figured out a way to attack the European power grid"
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#3I can imagine how this went:
- We have this protocol to switch the streetlights remotely by modulating a signal on the main - but that's needing expensive hardware and it's cumbersome. Can't we just sent that over radio instead?
- There is all this decentralized renewable energy generation, we need a way to switch that off remotely if there is an overload in the grid - hey, we already have that hardware for swtiching streetlamps, let's just use that!
Of course encrption was never a concern and now anyone could remotely turn off / on power generation. But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor.
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#4I can imagine how this went: - We have this protocol to switch the streetlights remotely by modulating a signal on the main - but that's needing expensive hardware and it's cumbersome. Can't we just sent that over radio instead? - There is all this decentralized renewable energy generation, we need a way to switch that off remotely if there is an overload in the grid - hey, we already have that hardware for swtiching…
Like the one who's been messing with our deep sea cables?
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#5TL;DR: by law, German power stations are required to "turn off" (taken off the energy grid) when they receive specific radio messages. This is intended for energy grid load balancing.
Unfortunately, the message protocol is completely flawed security-wise, which allows malicious actors to control the power station.
It would require only a handful of strategically placed senders to control an estimated 20 gigawatt of load Germany-wide, causing havoc on the European energy grid (brown-out, cascading effects, etc.).
The security researchers followed a responsible disclosure towards the vendor, EFR, who reacted with sending letters from their lawyers.
Today's SPIEGEL online news magazine pre-talk report ( https://archive.is/p66as ) on this topic cites EFR that the proposed attack vector is not possible.
The security researchers therefore made the last minute decision to go full disclosure with today's talk to press on the urgency of the topic.
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#6Talk starts around ~16:20 minutes in..
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#7Why do we still build new remotely controlled things and then skip security? Like when was this ever a good idea?
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#8Why do we still build new remotely controlled things and then skip security? Like when was this ever a good idea?
I think it's a failure to solve 1 + x = 2. x is the percentage of the power grid controlled by this system, which has risen over time.
So at design time, the threat is just that people can turn off street lamps, which you can do with a BB gun. Then you expand to home solar. Also not so interesting.
But then you expand to be a significant fraction of the grid supply and load. Now there is a substantial target that actually needs security, but which requires a full redesign.
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#9TL;DR: by law, German power stations are required to "turn off" (taken off the energy grid) when they receive specific radio messages. This is intended for energy grid load balancing. Unfortunately, the message protocol is completely flawed security-wise, which allows malicious actors to control the power station. It would require only a handful of strategically placed senders to control an estimated 20 gigawatt of l…
Just read the SPIEGEL article and I think it’s a pretty balanced report on the positions of both sides. Basically, it comes down to the assertion that you can’t reach a large number of electricity generation plants with “simple radio equipment”. That is the position of EFR, and sadly, the Bundesnetzagentur (the radio communications regulator in Germany).
I haven’t watched the talk yet but I think it’s pretty clear to all of us on this website, that sending a specific short radio transmission to a large area is not an insurmountable challenge for our favorite terrorist state.
What I don’t understand is why there is such a reluctance to admit that these problems exist and work towards fixing them. Instead we pull the Ostrich maneuver every time. One day it’s going to really bite us in the ass.
EDIT: after watching the talk, the funny thing is that all of the “business secrets” that EFR is accusing our fellow hackers of leaking, are actually mostly DIN standards. In other words, they are just upset that someone is talking about the fact that no efforts have been made to proactively secure these receivers. Peinlich.
Re: 38C3: Blinkencity, radio controlling street lamps and power plants [video]
#10TL;DR: by law, German power stations are required to "turn off" (taken off the energy grid) when they receive specific radio messages. This is intended for energy grid load balancing. Unfortunately, the message protocol is completely flawed security-wise, which allows malicious actors to control the power station. It would require only a handful of strategically placed senders to control an estimated 20 gigawatt of l…
Just read the SPIEGEL article and I think it’s a pretty balanced report on the positions of both sides. Basically, it comes down to the assertion that you can’t reach a large number of electricity generation plants with “simple radio equipment”. That is the position of EFR, and sadly, the Bundesnetzagentur (the radio communications regulator in Germany). I haven’t watched the talk yet but I think it’s pretty clear to…
Ass covering, so much ass covering everywhere. I've done a fair bit of consulting for the public sector and figuring out their office politics is often the only real way to get anything done, the actual technical discussion is often secondary.