Archive for the ‘SMART GRID’ Category

Smart Grid Initiatives and Government Intervension World Wide

August 11, 2009 Leave a comment

I’m trying to link Smart Grid Initiatives “large and small” worldwide with global trends of government intervention, mandated compliance, and regulatory frameworks within the concept of “Critical Infrastructure Protection” CIP. In other words, is the world in general leaning towards mandated compliance ? or are we still seeing a fight back in favor of industry self compliance?.

I began by looking at the Smart Meters Projects Map (Created by the Energy Retail Association – UK). I noticed the following:

Smart Meter Projects World Wide

Smart Meter Projects World Wide

– About 32 Countries in Total announced Smart Metering Projects as of 2009 “See Map”, 24 (75% of the total number) reportedly have or are working on CIP programs “with different Maturity levels”.

– I evaluated what’s publicly available on the CIP programs within those 24 countries against the “ International CIIP Handbook“. and mapped the CIP programs against More or Less government Intervention.

Government CIP Involvement

Government CIP Involvement

– It’s clear that we are going towards state mandated compliance with the majority starting off from column DGovernment is a consultant” towards Column BGovernment Clearly mandates clear and Precise CIP Standards“. Except for the United States which starts from Column EIndustry Self Regulation“.
– Although enjoying the strongest momentum, the US might not be the perfect model for the rest of the world, the US road map is certainly different.
– This Blog Visitors map “see top right” show exactly the same 24 countries.

Note: The “Gov/CIP involvement” Diagram is Based on the article “Models of CIIP” by Dan Assaf. Published in elsavier’s “International Journal of Critical Infrastructure Protection” Volume 1. 2008

Security Audit and Attack Detection Toolkit

August 5, 2009 Leave a comment

Department of Energy (DOE) is funding a project known as the (Cyber Security Audit and Attack Detection Toolkit) along with security companies like Digital Bond,tenable security and others, with the aim of releasing SCADA audit templates to be used with security scanners like Nessus, NetIQ and many others ( The templates are issued in OVAL format) see below. to compare security settings in the operating system and applications, including control system applications, to an optimal security configuration developed by the control system vendors like Areva and Emerson, participating companies and asset owners. The audit files will be made available as a paid subscription service.

– Comments:

1. I really think that the audit files “that can check your systems compatibility to NERC for instance” should be open source, free and available to the public. Specially that its a government funded program, at least available to researchers and SMEs who can add, review ,contribute and validate the compatibility checks. I believe this makes more sense than making the actual vulnerabilities and exploits available “check my previous post on nessus and Core Impact” to amateurs. on the other hand The project has a second phase and it includes releasing a tool to aggregate security events from a variety of data sources on the control system network and then correlates the security events to identify cyber attacks. I can see and understand that this is an extra mile and can be a paid service.

2. Using OVAL “Open Source” as the Audit files format is a wise choice, see the list of applicable/compatible products HERE

3. The project is a good indication that vendors are starting to be more involved in cleaning the mess.

More on the project / A fact Sheet ( Cyber Security Audit and Attack Detection Toolkit )

You can see below a list of the currently available Audit files (Source – SCADApedia)

List of Audit files

Faulty Signal Shuts Down A/C AT 18,000 homes …Remotely

August 2, 2009 Leave a comment

Perhaps in a prelude to one of the Smart Grid most anticipated type of Incidents, About 18,000 Duke Energy customers participating in an energy-saving program saved more energy than expected on Monday evening.The customers are part of the “Power Manager” program that installs a load management switch next to the air conditioner. This radio-controlled device cycles the air conditioner off and on when demand is especially high.

But Monday night, an incorrect signal was sent to the boxes, a Duke Energy spokeswoman said “Instead of cycling, the boxes shut down the units for three hours.” The Incident was announced to be due to a “human error”.

Full Article (Here)

Categories: SMART GRID

Power Lines Can be Used to Steal Data

July 19, 2009 Leave a comment

A recently announced exploit is targeting the electrical grid , with no expensive pieces of equipment required, How to execute these attacks will be demonstrated at the Black Hat USA 2009 security conference in Las Vegas later this month by Andrea Barisani and Daniele Bianco, a pair of researchers for network security consultancy Inverse Path.

Stealing Keystrokes via Electrical Lines

Stealing Keystrokes via Electrical Lines

In the power-line exploit, the attacker grabs the keyboard signals that are generated by hitting keys. Because the data wire within the keyboard cable is unshielded, the signals leak into the ground wire in the cable, and from there into the ground wire of the electrical system feeding the computer. Bit streams generated by the keyboards that indicate what keys have been struck create voltage fluctuations in the grounds, they say.

The attack proved successful when tapping electric sockets located up to 15 meters from where the target computer was plugged in the researchers say.

“If our small research was able to accomplish acceptable results in a brief development time (approximately a week of work) and with cheap hardware,” they say. “Consider what a dedicated team or government agency can accomplish with more expensive equipment and effort,”

Comments: Applying the same technique Can a vulnerable Smart Meter be used to steal data from all the wired Computers in a house ?

Full Article HERE

SMART GRID Domains Where Standards are Needed

July 13, 2009 Leave a comment

In the presentation ( NIST Smart Grid Standards Roadmap Project Goals ).

An illustration of key standards per domain as mentioned in NIST’s Smart Grid Road Map, and how they come into play can be seen below.



Also in the slides NIST provides an analogy comparing the Smart Grid to Verizon’s new Triple Play network

Quote: ” (Verizon FiOS is one example – integrates voice, video, data)
• Initial field trials in 2004
• Nationwide full deployment will take 10-15 years
• Standards work started in 2003
• Three principal standards bodies involved
• Release 1 standards finalized year-end 2005
• Release 2 finalized early 2008
• About 600 standards documents
• Mostly “mix & match” and extensions of existing standards
• Standards continue to evolve with new technology

Smart Grid is about the same magnitude
• Key difference: many more standards bodies involved
• Strong coordination role needed
” End Quote.

My Comments:

– As the Smart Grid continues to attract media and general public attention, its worth noting that a huge amount of deep technical information is now out there for free. All the communication protocols in the graph are published online and available in details.

AT&T and Qwest Joins the Holy Grail Race (aka SMART GRID )

June 24, 2009 Leave a comment

Companies are repositioning themselves to grab a piece of the smart grid lucrative pie. after my previous post talking about CISCO,HP,GOOGLE..etc all announcing SMART initiatives… it was about time for the telco giants to join the race.

Qwest Communications has partnered with Current Communications on a smart-grid offering for utility companies that combines the former’s DSL network with the latter’s broadband-over-powerline (BPL) technology.

Last march SmartSynch and AT&T signed a partnership whereby AT&aT’s wireless network is used to connect smart meters at commercial and industrial locations to around 100 different utilities’ back offices. “See Picture Bellow”



Yesterday AT&T announced that they are targeting a much more diverse SMART GRID role as previously perceived

“We are starting at the meter and working our way back up the grid to the power production plant and looking at automating all the different elements along that chain,” said Abhi Ingle, vice president of industry and mobility application solutions at AT&T. “We’re embedding wireless intelligence at different points in the grid to not just capture usage and dynamic pricing information from the end user, but to also look at outage management, fault detection and things of that nature.”

In the news report published HERE , Its mentioned that Under the terms of the agreement, AT&T and Cooper will co-sell two products, OutageAdvisor and VARAdvisor. OutageAdvisor is a sensor that hangs on electric delivery lines every couple of miles to locate and isolate faults and then communicate them directly back within the system in real-time over AT&T’s network. Ingle said this will lessen the time it takes to identify and correct faults, as well as reduce the likelihood of an outage.

The VARAdvisor sensor will serve as an alternative to manual inspection of equipment that controls the voltage supplied to consumers and detects fuse failures, which Ingle said will also help reduce the need for on-site inspections.

Categories: SMART GRID Tags:

A Worm Opens Door to Power-Grid Botnet

June 13, 2009 Leave a comment

A recent article in the Register(UK) quoted ioactive’s security experts that they managed to write the First Power-Grid worm, to be demonstrated in the upcoming BlackHat conference in Las Vegas.

The researchers tested about half a dozen smart meters and found that most of the devices ask for no encryption or authentication.

The worm will use the unauthenticated P2P update feature that comes with smart meters to send the malicious code.

Some US-Market numbers from (EnergyPulse) to think about:

-More than two million smart meters in field use today
-Additional 17 million devices on order by over 73 participating utilities
-Smart Meters once deployed are expected to last 10-15 years.
-Many of the smart meters currently in production are built using vulnerable hardware like the Texas Instruments MSP430 “shown below from ebay”

The smart grid will gain a lot of momentum in the next few years due to many political, environmental and financial incentives. efforts worldwide are underway to develop/update the required legal and technical frameworks. Yet there are some pressing debates and issues. for Example:

-Is it OK to build the smart meters in a foreign country using foreign components? ( Chinese Firm Huawei hits back at cyberspy claims )
-Should a government impose or name a certain communication encryption algorithm?
-Should SCADA vulnerabilities be publicized as regular PC vulnerabilities ? we don’t hear often about vulnerabilities in the medical equipment/industry …do we?
– Its BlackHat 2020 and the freedom hackers group has just announced several critical vulnerabilities in the hardware deployed at millions of homes.. when shall I expect the electricity guy to come and replace my vulnerable meter ?

TI MSP 430

TI MSP 430

CISCO and Google Going SMART

May 19, 2009 Leave a comment

Further news about IT big players entering the heavily funded SMART GRID market space, CISCO officially unveiled its first end-to-end smart grid solution and strategy (HERE) , The networks giant official press release states that :

“Cisco’s plan establishes a complete communications fabric from electrical generation to business and the home based on Internet-Protocol standards. This will build intelligence, resiliency and two-way communications into an electricity distribution system that has been traditionally fragmented”.

My Comments on the news:

– CISCO’s purchase of (Pure Networks allowed them to acquire the rights for the HNAP (Home Networks Administration Protocol) that will allow Home appliances to speak and connect seamlessly together. think about it as Upnp meeting Apple’s Bonjour.this helped them offer a complete end to end solution.

– Google’s recent Venture Investment in the much talked about , Smart Grid networking specialists SilverSpring , Signaled a genuine intention to compete in the SMART GRID lucrative space.

– Google and GE Partnership for the Smart Grid Plug in – Allowing you to Watch your Home appliances energy consumption online – (See my post on may 7th about the topic: IT-powerhouses-sees-the-smart-grid-as-a-booming-business)

– The US Stimulus Package will inject 11 Billion$ into the Smart Grid as research and implementation funds within the next few year

I can only say that a vulnerability in your chrome browser or IP softphone can make you loose all your money, But a vulnerability in mission critical systems running the energy sector can cause millions of people to suffer a complete blackout and perhaps human lives…are we as an IT industry ready and up to a challenge where patching might be just too late.

2003 US-Blackout

2003 US-Blackout

IT Powerhouses See the Smart Grid as a Booming Business

May 7, 2009 Leave a comment

Its now a daily routine that I come across news about Big IT players fighting over a stake in the Smart Grid/Critical Infrastructures modernization efforts. I really think its a trend that is definitely worth monitoring. Reports say that the smart grid eco-system will receive around 11 Billion USD in Obama’s bail out plan.

– Google and GE Partnership for the Smart Grid Plug in – Watch your Home appliances online (Article)
– IBM: “Its all about the SMART GRID in 2009” (Article)
– IBM pours $2B into smart grid as other big names reach for a piece of the pie (Article)
– Forbes: Cisco and GE announce Smart Grid Play (Article)
– EDS and HP Smart Grid Vision (Article)
– Microsoft Joins a Smart Grid Project in Austin (Article)

My Presentation about the SMART GRID -Simplified

April 23, 2009 Leave a comment

This is my presentation (Simplified) about the SMART GRID Vulnerabilities and the CI Interconnections

Categories: SCADA Security, SMART GRID