Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Security Businesses Power The Almighty Buck

FBI Says Smart Meter Hacks Are Likely To Spread 189

tsu doh nimh writes "A series of hacks perpetrated against so-called 'smart meter' installations over the past several years may have cost a single U.S. electric utility hundreds of millions of dollars annually, the FBI said in cyber intelligence bulletin first revealed today. The law enforcement agency said this is the first known report of criminals compromising the hi-tech meters, and that it expects this type of fraud to spread across the country as more utilities deploy smart grid technology."
This discussion has been archived. No new comments can be posted.

FBI Says Smart Meter Hacks Are Likely To Spread

Comments Filter:
  • If the new frauds against the new meters are equivalent in size to the old frauds against old meters, but with the new meters they are at least more easily quantified, it still makes sense to deploy them. If the new frauds amount to lesser losses compared to the older frauds, then its still worth it.

    If not, Id try and find out who is getting the kickback for this idiotic things.

    • by cayenne8 ( 626475 ) on Monday April 09, 2012 @01:01PM (#39620955) Homepage Journal
      I dunno...but the simple use a powerful magnet trick to cut the usage tracking down sounds fantastic to me!!

      Simple, just put the magnet on at night...take it off during the day when at work....

      I've been wanting to get some rare earth magnets to play with...hmm...now, maybe I have even more justification?

      {BAEG}

      • by mhajicek ( 1582795 ) on Monday April 09, 2012 @01:47PM (#39621461)

        The law enforcement agency said... that it expects this type of fraud to spread across the country...

        Especially now that the vulnerabilities have been announced.

        • Or they are actively encouraging people to tamper with them. These things are not easy to tamper with and have everything from gyrometers and other gizmos that will set off alarms even before someone tries to mess with them.

          There was a talk about this on SmartMeters at GRRCon: http://www.youtube.com/watch?v=9ePWfR6A4_o [youtube.com]

      • 'No officer, I did not put that old hard drive on the power meter. I really don't have any idea why it's there.'

      • by LoRdTAW ( 99712 ) on Monday April 09, 2012 @02:24PM (#39621865)

        Smart meters do not use the old electro-mechanical method to measure power consumption. They are solid state and have no moving parts or coils that can be tampered with by a magnetic field.

        Little story:
        Back in high school I took electrical installation, basically you were taught to become an electrician for residential, commercial and industrial. We had an amazing teacher, a master electrician who told us how he cheated the meter to cut his bill down. Basically most older electric meters were "5-jaw" meaning that they had 5 contacts, two incoming hot legs from the street, one neutral and two outgoing hot legs to your panel box. If you cut the neutral leg the meter stopped spinning. So he "obtained" a forged matching utility seal (the numbered plastic thing that seals the meter to detect tampering) and ran two wires stealthily into the meter pan. Instead of the neutral leg of the meter going strait to the main neutral bus bar, it first went into his home to a timer switch hidden in a closet and back to the meter pans neutral bus bar. He said if you looked in the pan and didn't poke around, you would never see that the wires were diverted.
        So over the period of a few years he finally got it to the point where he would only pay 20-30 dollars a month in electricity because he lowered it very very slowly over time. If you suddenly half your electric bill the uitility's billing software would flag you and send an investigation team out who will pull your meter and take it to a lab for diagnosis and inspect your meter pan. Well he was sitting pretty paying next to nothing while running air conditioners and pool filters but one day the timer burnt out completely shutting the meter off. He didnt notice and said it could have been that way for well over a month. The utility came to his house on a day when he happened to be home and pulled the meter. The lights went out and he decided to look out the window and saw the utility truck in front of his house. He ran out and with some quick thinking started screaming at the utility workers "What the fuck are you doing! My wife was carrying laundry down the stairs and she fell. I think she broke her leg. Im calling 911, and im going to sue your asses!" before he could get back in the house the utility crew plugged the meter back in and ran. He then removed his modifications and covered his trail. The next day an inspector came and rang his bell informing him they had to remove the meter for inspection and that they were sorry for any problems the previous crew caused. Well they took his old mechanical meter and installed an electronic meter that had a clock and a light sensor (from his description). It was a "4-jaw" meter (no neutral) and could not be disabled without physically unplugging it. He never heard back from the utility as he covered his tracks and they couldn't prove he tampered with the meter since he replaced the seal with one of the same serial number. He never tried to tamper with the meter again.

        Goes to show you how easy it was to cheat the electric bill with a little skill, resources and patience.

        • Re: (Score:3, Interesting)

          by LiMikeTnux ( 770345 )
          Most analog meters I have seen (I do residential) are 4 blades. You can actually pull them out and flip them upside down, and they will run backwards!
        • by Grizzley9 ( 1407005 ) on Monday April 09, 2012 @04:48PM (#39623751)

          Goes to show you how easy it was to cheat the electric bill with a little skill, resources and patience and lack of ethics.

          Fixed that for you.

        • Bullshit (Score:3, Informative)

          by Anonymous Coward

          On a 200 amp feed the common leg has to be at least 2/0 copper or 4/0 aluminum. That shit is about as thick as a human thumb, requires a radius of several inches to make any kind of turn, and you're suggesting that he "stealthily" diverted it from the meter (one thumb-sized wire) and then routed it back into the meter with a second thumb-sized wire. Not a chance that this happened unless this "master electrician" created a severe fire and electrical hazard by using severely undersized wire.

          Never mind the fa

      • Doesn't work on newer meters and is mostly likely to set off tamper alarms in the back office.

        The magnet trick actually works on the older analog meters quite well, and probably works better on them than newer meters.

    • Becasue it's a very nice [etymonline.com] word.

    • by Anonymous Coward on Monday April 09, 2012 @03:55PM (#39623031)

      Smart meters have other advantages you just don't hear often about. The reason you don't hear about them is because it invades your privacy.

      With smart meters, they can tell people when you're home, likely which holidays you observe, if you watch TV, if you work at night or day, so on and so. They sell your demographic information.

      Likewise, police and other officials are now working with utility companies to determine if you are growing pot, running a business out of your garage, so on and so.

      The fact they hope to reduce their billing costs associated with meters is their primary goal but the field is ripe for secondary profit avenues.

      If you are against smart meters you are against industry invading your privacy and are therefore evil.

      • by Thing 1 ( 178996 )

        With smart meters, they can tell people when you're home, likely which holidays you observe, if you watch TV, if you work at night or day, so on and so. They sell your demographic information.

        Yeah. Great. The police know when I'm not home. So they can tell their buddies in the capital extraction program. ("There's nothing else you can say to make me change my mind: goodbye." No, psychos, I'm not self-detonating; I'm listening to The Wall, and that just played, and is, again, topical: I plan to move outside of the jurisdiction of the drones.)

  • And where did these US corporations source all that hardware (and probably the software too)? The convient, one-stop shop of the Peoples Army, Military-Industrial Division.
    • Re: (Score:3, Informative)

      It's not just a lowest bidder problem. The meters are designed to be tampered with [slashdot.org]. The designs were known to be defective before they were rolled out and they were deployed anyway. What is happening now is just an inevitable result of bad engineering. It's too bad that our experiences with M$ products have, for the general public, made bad engineering acceptable.
  • No fraud checking? (Score:5, Interesting)

    by dj245 ( 732906 ) on Monday April 09, 2012 @01:05PM (#39620995)
    Besides the fact that you don't need to mess with dangerous line-voltages, this is no different than normal meter fraud. I can't imagine anything other than incompetence being the reason this was not found. A utility buys electricity, or makes it, and the amount they put on the grid is a known quantity and easily measured. If the amount that they are billing for is less than that, something is wrong. You can do the numbers on a per-line or a per-substation basis, possibly even more granular than that. All the major HV lines and substations have their own meters which report back to HQ. A single person stealing electricity is somewhat hard to catch, but if substantial amounts of people got away with this for an extended period of time, someone was not doing their job.
    • by Sarten-X ( 1102295 ) on Monday April 09, 2012 @01:20PM (#39621143) Homepage

      You can do the numbers on a per-line or a per-substation basis, possibly even more granular than that.

      That's brilliant! To get specific enough information for legal recourse, we'll need maximum granularity, which means tracking the usage for each customer! We can put their meter right on their house for convenience!

      • by mcavic ( 2007672 )
        Or, put a meter on the pole that feeds your house, as a backup for the meter that you tampered with.
        • by slimjim8094 ( 941042 ) on Monday April 09, 2012 @02:34PM (#39621963)

          They do tend to have meters per transformer ("pole pig"), which is pretty granular, as well as at other points in the distribution network. They use them to diagnose flaws in the system, but they're also used for finding fraud.

    • by arth1 ( 260657 ) on Monday April 09, 2012 @01:30PM (#39621247) Homepage Journal

      A utility buys electricity, or makes it, and the amount they put on the grid is a known quantity and easily measured. If the amount that they are billing for is less than that, something is wrong.

      Yes, like Ohm's law and Joule's law. Any electrical cable and transformer converts electricity into heat, so what the users pull out can never equal what is put on the grid.

      Electricity is also not a resource like water, where if you don't pump it out one second, you can pump it out the next second. Use it or lose it. Converted to DC, it can be stored in capacitors or batteries, but at a very high cost.

      • But the amount of losses due to heat is easily calculated and factored in.

        • by Whuffo ( 1043790 )
          There's an unknown amount of leakage across dirty and cracked insulators, i2r losses at resistive connections, etc. They can't really tell in great detail how much they sell vs. how much they generate and determine anything from it.

          What does catch their attention is a sudden significant change; if you're going to steal power, start very small and only ramp it up over a period of many months.
    • by icebike ( 68054 ) * on Monday April 09, 2012 @01:30PM (#39621257)

      Besides the fact that you don't need to mess with dangerous line-voltages, this is no different than normal meter fraud. I can't imagine anything other than incompetence being the reason this was not found. A utility buys electricity, or makes it, and the amount they put on the grid is a known quantity and easily measured. If the amount that they are billing for is less than that, something is wrong. You can do the numbers on a per-line or a per-substation basis, possibly even more granular than that. All the major HV lines and substations have their own meters which report back to HQ. A single person stealing electricity is somewhat hard to catch, but if substantial amounts of people got away with this for an extended period of time, someone was not doing their job.

      But take your average mid size city, and the substations cover huge areas. HV feeders typically feed entire neighborhoods and step down to lower voltage on the neighborhood feed without any such meter. Line loss is variable, not a constant you can be assured of over time. Your mom's current frugality binge can make a significant difference in usage month to month.

      So how do you find the 6 houses out of 100 that reduce their consumption by some amount less than the average variance? Especially if they ratchet it down slowly in the high use season?

      And even if you statistically isolate a few suspects, how do you prove it? About the only way to do so is to put another meter upstream of each suspect house. Expensive, and not at all stealthy, so the suspect can drop the hack.

      A power company in an area I lived in, where power was still distributed with overhead wires, would put the meter at the top of the off-property pole as a way of advertising people they had caught tampering with meters. The entire neighborhood knew what that meant. They could still read them remotely, so it didn't involve any additional work load on their staff once installed.

      • Oh ya, another issue. It is often too expensive or too much of a bother for utilities to send someone out to check for fraud on just a suspicion. And they may want police with them in case of altercations. I think a lot of this stuff gets overlooked intentionally at times.

        • Oh ya, another issue. It is often too expensive or too much of a bother for utilities to send someone out to check for fraud on just a suspicion. And they may want police with them in case of altercations. I think a lot of this stuff gets overlooked intentionally at times.

          Too much of a bother? Recently, 10 minutes from where I lived, the police discovered huge pot farms in houses dedicated to growing weed. The home owners bypassed the meter so that they wouldn't notice the huge power usage, but I guess they noticed the "lack of usage".

          • If you're a meter reader, do you want to knock on the door and ask if they're doing anything illegal there? No, they'll call the police instead. That's if they detect things that look like grow houses. But for intermittent tampers there's a hesitance to go onto private property and inspect the meter closely and no sufficient evidence to call the police.

            This isn't the post office where gloom of night can not dissuade them from their rounds. In bad weather they will just estimate your usage for the month

    • two problems with your accounting scheme:

      a) fluctuating line losses that cannot be quantified (local temperature / weather can impact this)
      b) homes that generate power and put it back on the grid

    • It's probably easy to find cheaters because people get greedy. Since power companies have a pretty good idea of the historic energy use for a certain location all they need to do is watch for big shifts in electricity consumption.

      • by icebike ( 68054 ) *

        People smart enough to know about the hacks are usually smart enough not to run their bill down to zero.
        People see their historical usage on every Electric bill, its not like they are unaware records are being kept.

        Thieves just run down their usage over time by 25% of their prior usage, which is consistent with what you can accomplish by being frugal
        (or going on vacation). Public awareness of shortages can drive electrical usage for an entire city down by 25% [ucdavis.edu].

        Dumb people might go for "the big hack", but th

        • by Rich0 ( 548339 )

          If the meters still internally capture the true readings, then sooner or later there will be an issue when the property changes hands. Often utilities will do a manual reading when the account changes name, and there will be a reckoning.

          Now, if the meter itself is tampered with, or doesn't see all the current, then obviously there will be little to detect.

        • by Thing 1 ( 178996 )

          Without meter-by-meter inspection, you can't tell if loss of household income (layoff) caused increased frugality or if they tampered with the meter, as long as they keep from pushing usage down by less than 25% or so.

          So obviously, the power companies need access to IRS records. And credit reports. </sarcasm>

      • by fnj ( 64210 )

        Because lord knows, nobody could be doing any of these:
        1) Replacing all their incandescents with fluorescents or LEDs
        2) Getting a new, more efficient refrigerator
        3) Replacing an electric oven with a gas oven
        4) ...
        Yep, they all should be presumed guilty. Terrorists!

  • ...it will likely cost consumers more, i.e, the cost will be passed on to the consumer. I am completely unsurprised to hear of this.

  • I pay a fixed amount every month, and then at the end of the year, I either have to pay more or get a rebate. Do you think that the public utility's billing software is smart enough to notice that my rebate is bigger than what I paid?

    Probably not.

    • by nprz ( 1210658 )

      Well, if you have solar or another renewable energy source it wouldn't be impossible to think of.
      But many public utility companies have a policy to not pay out even if you produce more than you consume.

  • Business model (Score:5, Insightful)

    by Dunbal ( 464142 ) * on Monday April 09, 2012 @01:13PM (#39621091)
    So the power company says "I know, let's make a bunch of money by using smart meters. That way we can fire all the people we used to send out to go read meters, and we can maximize our profits by having variable billing throughout the day."

    "Oh, and let's make sure to contract these meters out to the lowest bidder because after all, people are morons and if they don't realize that we're shafting them by getting them to pay more for their electricity, certainly they will never be smart enough to figure out our meters"

    "Oh shit, our meters can be hacked! These guys are CRIMINALS help help government HELP come save us!". That way we don't have to invest in more secure meters, or go back to the old meters. No, we can continue with minimal staff, continue with crappy hackable meters, and stick the cost of our broken business model to the government, the court system, and of course the prison system. Why should we have to share any of these unforseen costs from a business model we forgot to think through properly? Maximum profit is our GOD GIVEN RIGHT.

    • My power company is run by the government.

      BC Hydro. They just started rolling out these smart meters. They're pointless. If they'd gone with something like a Schneider Ion then they could figure out how to reduce energy consumption in the home. As it is, they can't even get billing and metering to talk to each other.

      And there's been a recall already.

    • In your rant about the government, you neglected to remember (or maybe just didn't know) that meter fraud [wikipedia.org] has ALWAYS happened, and ALWAYS been illegal. The government already prosecutes people for theft of service [wikipedia.org].

      In fact, smarter meters are harder to trick, so it's likely that these smart meters have LESS fraud.

      Given your rant about the "maximizing profits" by variable rate billing, I can safely assume you don't know the first thing about the electrical system in this country. It may feel very truthy that

    • If someone is tampering with their meter, they are a criminal and should be prosecuted. Everyone who tampers with their meter raises the rates for honest customers, like me. Most utilities are natural monopolies and their pricing is tightly regulated. Yes, whoever built meters that are so easily tampered with should be sued out of existance as well.

      Lastly, having pricing that more accurately reflects the cost of the power supplied potentially creates more efficient usage. While some power plants can be

      • If someone is tampering with their meter, they are a criminal and should be prosecuted.

        Well, duh. Has anyone here denied that stealing electricity is unethical and against the law? I suspect that outside of third world countries electricity theft is exceedingly rare. So you get to cut your electricity bill by 25% if you are smart or 50% or more if you are stupid and you're going to risk going to prison and getting a criminal record for that? Unless you use absolutely immense amounts of electricity, in which case you can probably afford it anyway, the risk totally isn't justified by the reward

    • so much win.

    • Nah, they're just installing the smart meters so they can jack up everyone's electric bill, and then just claim "Well these are more accurate, it just means you were being undercharged before!" [nytimes.com].
    • by Fjandr ( 66656 )

      The actual business model is: "The Federal government is providing massive subsidies if we upgrade to smart grid."

      End of story. Yes, I personally know people who work in the utility industry deploying smart grid infrastructure for exactly that reason. The Federal government is already involved, being the primary reason for the deployment already.

  • Obviously. (Score:5, Insightful)

    by Reverand Dave ( 1959652 ) on Monday April 09, 2012 @01:20PM (#39621161)
    The problems started when we deregulated this industry. The smart meter debacle is just another symptom of a system that is rotten to the core. Where I live, power rates were heavily affected by the Enron fueled energy crisis and the rates have scarcely dropped since they were artificially driven up. Year after year the power company has been asking for $0.20 rate hikes because they know they can talk the PUC into giving them at least half of what they want. All the while claiming to be losing money while the parent company of the utility is making record profits.

    If the Utilities were regulated then they might have to spend a little more on the secure tech instead of the cheapest crap available. They would have a more vested interest in it since their single motivating factor is to provide service instead of to make as much money as possible.
    • by morari ( 1080535 )

      The main problem is that utility companies are for-profit. Your electricity should not be run by a for-profit organization, period. My water isn't for-profit, nor are my recycling services. For some reason though, the power companies are allowed to deny access to alternate generation and distribution centers, provide the most piss-poor service possible, and still raise rates year after year. It's easily one of the most crooked industries in the country.

    • by Fjandr ( 66656 )

      The utilities were never deregulated. They were differently regulated. Electrical utilities are still among the most heavily regulated businesses in the United States.

      That's not to say the system isn't rotten, but deregulation is not something that ever actually happened.

  • The "other" hacking? (Score:5, Interesting)

    by Anonymous Coward on Monday April 09, 2012 @01:22PM (#39621183)

    What about thieves who regularly intercept wireless signals from the meters to determine occupancy patterns, then come back and break in when no one's home?

    Do these meters have end-to-end encryption? Inquiring minds want to know.

    captcha: quality

    • Re: (Score:3, Informative)

      by jessehager ( 713802 )

      Saw this gizmo earlier today: http://www.gridinsight.com/ [gridinsight.com]

      Since anyone can buy a receiver to read their own meters, I'm going to say "probably not."

    • Re: (Score:2, Funny)

      by ColdWetDog ( 752185 )

      What about thieves who regularly intercept wireless signals from the meters to determine occupancy patterns, then come back and break in when no one's home?

      Do these meters have end-to-end encryption?

      Just take one of your spare tin foil hats and wrap it around the meter. That way the black helicopters can't sneak up on you.

    • Holy cow! I am aghast with shock and alarm! I will panic soonest!

      Around here thieves will look to see if any cars are in the driveway, and then ring the doorbell to see if anybody is home.
      • That is SOOO ancient. Around here they have these heat detecting scanners that the thieves use to detect any body heat inside before they then use the nifty "Super Steel Toed boots 2000" to break in.

    • by DamonHD ( 794830 )

      The smart meter infrastructure in the UK is likely to be over GPRS/3G/whatever, so for a start is encrypted over the air reasonably well whatever the end-to-end encoding is.

      Rgds

      Damon

  • Why is this so hard? Set the whole thing up with ROM that the unit cannot change on it's own. If a hacker manually hacks their unit that is one thing but it's a really bad idea if people can "update" the firmware of the meters remotely with foreign code. Assuming they really like that idea, every unit needs a unique authentication code. By all means, have that code be centrally stored or and summoned automatically by the utility database. But compromising one unit shouldn't lead to them all being compromise

    • The hackers are getting in through an optical admin/maintenance port on the meter. I doubt that the property owner was ever meant to use it. I too am shocked that it does not (appear to) have any authentication for a connection. I don't know how these meters phone home, but it must be fast enough to authenticate a user.
  • by khendron ( 225184 ) on Monday April 09, 2012 @01:34PM (#39621291) Homepage

    "...paradigm shifting without a clutch"

    I always liked that quote. Too bad the FA article felt the need to [edit] it.

    • by Fjandr ( 66656 )

      You can certainly paradigm shift without a clutch. You just need to know the paradigms well enough to know at what point they're synchronized. :)

  • Obviously, this is not a good development. I also don't see this being that difficult for the utilities to detect through other means.

    But the bigger question is control and oversight of these devices by the homeowners themselves. Homeowners should be allowed to directly access the data on their smart meter. It can be very advantageous to the homeowner to know when there power usage peaks among other items.

    Smart meters will eventually have more control of turning off devices in the home. Homeowners need

    • But the bigger question is control and oversight of these devices by the homeowners themselves. Homeowners should be allowed to directly access the data on their smart meter. It can be very advantageous to the homeowner to know when there power usage peaks among other items.

      I get an email from my power company once a week. It charts out the total usage for the week, extrapolates what my expected bill will be, and it also indicates how much I've used from hour to hour throughout the week. It's been pretty helpful. My company just has a flat rate, so I haven't had to worry about peak usage rates, but I've been able to use the information in the email to figure out how to conserve some energy. It'd be kinda cool to be able to access the meter directly, but the email message i

  • by linebackn ( 131821 ) on Monday April 09, 2012 @02:59PM (#39622207)

    Where I live, these smart meters are already viewed as unreliable by the general public. The local news has reported numerous stories about how people's water bills suddenly went up after these new "smart" meters were installed.

    The thing is, there is no way for the general public to verify how accurate or reliable these meters are.

    Ideally these should be extremely simple, easily auditable, devices. But I can imagine the specs for something like this growing until it can send e-mail... using a database... and object orientation... and XML... on the web... in Microsoft .NET... now with HTML 5... and so on.

    • by DamonHD ( 794830 )

      Well yes there is, to a reasonable degree, if the meter has a display that can be eyeballed in the old-fashioned way.

      For example, turn *everything* off in the house and make sure that the meter stops, then turn on some devices/appliances via the equivalent of a Kill-a-Watt and compare what they claim is being used over an hour or so vs the utility meter (allowing a little for self-consumption of the Kill-a-Watt).

      If there is a huge discrepancy it should be obvious.

      I can account for the ~4kWh we use per day i

      • There are Zigbee enabled devices that will do most of this. Even turn stuff off automatically for you or just report what your current usage and price is.

        • by DamonHD ( 794830 )

          Indeed, and I have stuff like that, but I'm talking about things that Jo User could do without massive tech expenditure to see if their utility meter is obviously crazy. We can borrow a Kill-a-Watt equivalent from our local library for free, for example.

          And regularly reading your meters is a good low-tech way of getting a good feel for consumption which is much of what the 'smart' bit is meant to help with anyway.

          Rgds

          Damon

    • That's the biggest problem. Politics from smart meters trumps actual facts. California PUC determined the reasons for the increase in bills, but people ignore that as long as they've heard a story from a friend who heard it from a friend who heard it from a friend.

  • between this and old school wiring of a meter to run backwards?
  • so will homeowners start installing their own meter on the premises, to verify what the hackable powerco meter is recording? powercos are exactly the kind of non-competitive relics that believe in security-by-obscurity - that is, fiddle with the design until the level of fraud->outcry is low enough to ignore. it's not as if we don't have cheap, secure tech for exactly this kind of application.

If it wasn't for Newton, we wouldn't have to eat bruised apples.

Working...