Friday, September 5, 2014

Ontario Smart Meters and Security

Sometimes, I see something that doesn't seem right to me, and internally I begin questioning it or trying to work out if it's deliberately not right for some other reason.  In Ontario, our Smart Meters are one such item that perplexes me because for all the hay-making in the media about security, it's actually wide open.

In Ontario, places such as Ottawa and Toronto have this meter.

As meters go, it's pretty standard.  There's an ID plate, an LCD screen that gives you basic information, then there's an IR port on the right (it's the dot in the left hand part of that enclave on the right).  Internally, there's a transmitter that sends your home's data to a designated neighbouring smart meter that acts as a master and aggregates and sends on the data from it's neighbouring slave meters.

The government and other electricity bodies went to great pains to point out that this data is secure and the remote meter repository where the data goes is secure, and the transmission is secure, and ... well, you get the picture.  

But...

There's that little IR port on the front.  It's just spilling live data onto your driveway or beaming it your next door neighbours wall...

And that is a problem.

As with many attacks on your privacy, 9 out of 10 require little more than access to the hardware itself.  There's no reason someone can't slide an IR receiver (about $2) over the port, connect it to an Arduino Mini Pro ($13) and wire the input to output to a pen-laser ($5) and now for $20 they've extended your private data to across the street, where it's picked up by a solar cell and decoded.  Now, that neighbour knows when you come and go, your habits and other patterns, etc.

The simple solution is just stick some black electrical tape over the port.  A better solution is use a Blueline Powercost monitor on it - not only do you get informative information from it, but there's an added security angle in that you're blocking the port from prying eyes (and you get the added warning that it's being tampered with if you stop seeing data).

Now you understand this simple flaw in logic, go and have a chuckle as you look through this FAQ document from the IPC.