Cyber-researcher and self-described hacker Netanel Rubin has warned of serious security vulnerabilities in smart meters which are being rolled out around the world, claiming that in certain circumstances they can be made to explode.
Rubin was speaking at the 33rd Chaos Communications Congress in Hamburg in December 2016.
Describing the devices as “dangerously insecure”, the researcher claims they use weak encryption and protocols, and can be programmed to explode. "An attacker who controls the meter also controls its software, allowing them to literally blow the meter up," said Rubin.
Rubin claims blowing a smart meter up is trivially easy. Where most would argue that a normal fuse could prevent the fire, the researcher is convinced the hardware can be tricked into overheating and as a result exploding.
However, members of the audience accused Rubin of scaremongering once his presentation was over. A Dutch security engineer, who didn't identify himself, said he had been working in security on the Dutch digital grid and asserted that smart meters simply “don't have the components inside them” which could cause such an explosion.
Rubin replied that he is making these dire warnings in order to grab the attention of the public of explosions which he alleges have already happened in Ontario, Canada.
We were not able to verify such claims, but there are stories online which claim that smart meters do explode, one coming from a local version of US news outlet CBS, which reported that thousands of electricity customers were left without power, sometimes for several days, when a power surge caused their meters to explode.
Rubin also claims that compromised smart meters can be used as a beachhead to attack and take control of other networked devices within the home such as air conditioning units and refrigerators through Home Area Network protocols.
The communications protocols in question are Zigbee and GSM which Rubin says are easily exploitable. These protocols are often left open, or at best secured with a GPRS A5 algorithm, which has been reported as broken for over five years.
Rubin said: "If an attacker could hack your meter, he could have access to all the devices connected to the meter. The smart meter network in its current state is completely exposed to attackers."
According to Rubin, it is also possible to force all units near a compromised unit to connect to malicious base stations as smart meters use hardcoded login credentials, known as ‘Access Point Names'.
This access gives criminals direct access to the smart meter firmware for exploitation, as he alleges that the network makes no effort to ensure that the device should be connected to it in the first place. To applause from the audience, Rubin declared, "One key to rule them all."
He says these security shortcomings would have been eliminated if proper encryption was used, and the network was segmented instead of being treated as one "giant LAN".