Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/721 Thanks!
Here to tell us all about the
subject is Netanel
Rubin, you may know
him from his various sessions on
trashing Pearl
the Pearl community. Love them for that.
He also recently co-founded the
company Valtierra,
and with no further ado,
I'd like to help.
I'd like you to help me welcome
onto the stage to talk about smart
cities.
Hello, this is it, it's
been it's great to be here.
Let me start with a little apology.
I am feeling a bit sick today, so
if I start coughing or spontaneously
dying, just bear with me.
Forgive me.
Thank you.
And today we are going
to talk about something that
doesn't work for you.
We're going to talk about the smart
industry now, basically.
What we'll do today is talk how
they talk about how the smart revolution
is changing all of our lives without
us knowing.
As a disclaimer, we involved from my
company are developing security solutions
for the smart industry, not
just putting it out there.
So let's talk about smart
cities.
Smart cities are popping everywhere
in Amsterdam, Singapore,
Barcelona and in many other
different cities around the world.
But what exactly are
smart cities now?
Well, in Amsterdam, they decided
being a smart city means they'll have
birdhouses that offer free Wi-Fi.
And in Kansas City,
they decided to take the concept into a
more American approach and implemented
gunshot sensors,
among other things.
Now, it is very
clear to everyone
in the industry that smart cities
are nothing but a mere concept,
an idea of sorts.
That means absolutely nothing,
because each city is implementing
the ideas fit for their own culture,
their own atmosphere,
in order for us to understand
the industry and understand
who gains the most out of this
technological advancement,
we need to look at one specific
market, the smart
energy market.
Smart energy is basically a concept
allowing utilities, energy, utilities
to better connect with their end
consumers as
well as municipal authorities, the
cities themselves.
I know it sounds complicated, but it's
really not.
Now, energy utilities gained a lot
from this whole smart revolution.
Using smart energy,
they managed to implement devices
that allow them to define different
tariffs for different hours, allowing
them to earn more money on peak
hours. They could also connect
or disconnect consumers electricity
remotely if, for example,
they are overdue on their electricity
bill or ran out on their
electricity prepaid card.
They could also receive consumers
electricity usage instantly
without having the need to send someone
over physically.
All in all, utilities gained
the option to better manage
their electricity grids and
in some cases save over
15 percent of their
expenses in that area.
So basically, energy utilities
have a lot to gain
from this whole revolution.
Basically, when we were talking about
smart energy, we're actually talking
about the smart grid
containing all the utilities devices.
And the main appliance that
makes it so smart
is the smart meter.
Smart meters are ordinary
electricity meters with two extra
features.
The first is that this allows the utility
to monitor and communicate with a meter
remotely using p.l.c.
or 4G networks.
And the second, which truly makes
the smart meter smart, is that
it allows the utility to
communicate with consumers, home
appliances, with your
home appliances.
So you are now probably asking yourself
where these things
can control my home devices,
the utility can control my home.
Well, not only they can,
but communicate with their home devices
is just the first step in
the future. These things will create
a massive mesh network all
over the city, allowing them to
communicate with the city smart
appliances, as well as
the entirety of the electricity
grid. Your home, your city
and everything in between will
be in control by your energy
utility.
And that's a bit scary.
But how does the smart meter
communicate both with the city
and your home devices?
One word, Zygmunt.
Nice.
By now, most of you
already know Zogby is an
extremely insecure protocol, exploited
many times before.
But for now, I'll just say that if you
thought being is insecure in regular
smart houses, just wait and see
how it's implemented in the smart energy
industry.
Another important point is who developed
these smart meters?
Currently, there are about 60
different smart meter manufacturers, but
the top three covering about 30
to 40 percent of the market are
Itron lenses and Gear
and Alster.
Remember these names as they will
pop up a bit later.
For now, what you need to understand
is that smart meters are offering
a lot of benefits
for utilities and cities.
They have so much to gain by
installing these meters that utilities
are now forcing smart
meter installation in a wide range of
cases, even though it is costing
them billions upon billions
of dollars.
But utilities aren't the only ones
trying to implement these devices.
Governments all over the world
are pushing it even farther.
We can see a very sharp increase
in positive regulation all over the
world, in the Middle East, in Australia
and Japan, in all of East Asia in
general, in the U.S.
But the key region for
that industry, the one with
the most progressive regulation
and goals, is actually
Europe.
The European Union has declared
it aims to replace at least 80
percent of all electricity meters
in the region with smart meters by
2020, four years from now, with
a total investment of approximately
forty five billion euros.
Seventy two percent of all European
consumers will have a smart meter for
electricity, 72 percent from all
of all the people in the crowd, for that
matter.
That extreme push both by
governments and by utilities, has
made it so that over 100
million smart meters are already
installed today all over the world.
And if you thought that the installation
of smart meters doesn't concern you,
you should think again, because these
are the countries that will replace
at least 80 percent of their meters in
the near future.
Austria, Denmark, Estonia,
Finland, France, Greece, Ireland,
Italy, Luxembourg, Malta, the
Netherlands, Poland, Romania, Spain,
Sweden and the United Kingdom.
Almost all of Europe
will take part in this massive
technological revolution.
But what's the problem with that?
Progress is always a good thing,
right?
The problem starts when governments
and government agencies are forcing
the installation of appliances that can
interfere and communicate
with civilians home appliances.
The problem starts when
there's a product to the market so huge
it is installed in hundreds of
millions of homes worldwide.
The problem starts when
that product is accessing the internal
network of both the utility and
the consumer. You see, the
problem starts when
this product, forced by governments
installed everywhere with critical access
points, is also dangerously
insecure.
But why are smart meters
so critical?
Let's have a look at what a hacker can
do.
If a hacker made their first of all,
he could see exactly when and how much
electricity you're using.
He could know when you're in the house,
if you have any expensive electronic
equipment that might be worth stealing
and obtain a lot of information about you
and your family in general.
The second thing it can do is basically
billing fraud.
He could set your bailing them out to
whatever amount he'd like, whether it's
one euro or ten thousand euros.
You're going to be in a world of pain
just by having to explain to the utility
why their meter is faulty, why you didn't
use ten thousand euros
worth of electricity
if you even catch it.
I think time, of course.
But these scenarios aren't that
frightening.
Sure. And attacker can make your life
miserable, but it's not really
dangerous. If you see when you turn on
your TV, the scary
stuff begins.
When you think about the power these
mothers have over your electricity
network. If an attacker will hack your
meter, he will have complete access
to all the smart devices connected to
this meter, whether it's your air
conditioner, your fridge or your
door lock. And attacker will be able
to control each and every device.
This will have very severe consequences
the more your house is connected to the
grid.
Just imagine waking up
in the morning just to find out you've
been robbed by a burglar.
Who didn't even had to break in
because he could control and open your
door through the meter.
But even if your house doesn't
contain any smart appliance,
you are very far from being safe.
Smart meters are positioned in a critical
point in the electricity grid
because of the high amounts of voltage
the meter is handling.
One faulty line of code
could cause serious damage,
and attacker who controls the meter
also control the meter software
allowing to literally blow
the meter up just cause it
to explode and start to fire where
it used to be.
And these aren't just imaginary
scenarios.
Puerto Rico has just suffer
from a massive amount of billing fraud
attacks, causing their utility to lose
four hundred million dollars.
And in Ontario, Smart
Meters has literally caught
fire and exploded without
a cause to be found.
Allow me to quote one of the
firefighters, the response to the event.
It's your hydrometer.
You have a smart meter.
If your house had been a wooden structure
and not a brick structure, you wouldn't
be alive today.
And just so you realize how extremely
dangerous these fires are.
This is an image of the damage an
exploding meteor caused in one case.
So let's get technical.
How do you hexameter?
First off, there's the physical way,
there's always the physical way in order
to tamper with the meat or physically,
you have to have physical access to it,
obviously, which isn't
very viable most of the time.
And these are very easy to detect anyway,
even if you did have access to the meter.
There are tons of physical and temporary
mechanisms inside the meter, hardware
ranging from actual locks to
flesh operating mechanisms.
So the physical approach isn't really
going to work.
Trust me, I tried.
Unfortunately, smart meters
also support a wide range of
wireless protocols.
Protocols like Zogby and GSM
are considered standard in the industry
and they're used practically everywhere.
These wireless protocols have
been left in the dark with little to
no security and doesn't require
an attacker to be physically present near
the meter in order to exploit an
implementation vulnerability.
These protocols also allow an attacker
direct access to the smart meter
firmware, which allows them to exploit
many types of high level bugs like
memory corruptions, for example.
So naturally we focused
more on these wireless protocol in our
research.
So how does the smart meter communicate?
Well, in order to communicate with the
energy utility, the meter often
uses regular GSM, sometimes
especially in crowded cities and
skyscrapers.
The meter communicates with the closest
electric lock box using
p.l.c., which then transmits
the data back to the utility using
GSM.
So far, nothing too proprietary,
just ordinary GSM operating
on 3G or 4G networks.
But what about home appliances?
How does the meter communicate with them?
Well, this is where the notorious Ziggler
protocol comes into effect.
In order to communicate with home
appliances, the Smart Energy Standard
has declared Digby smart energy
should be used whenever possible.
So the utility is using GSM to
control the meter.
And this could be smart.
Energy is used to control your home.
So why won't we
use GSM to control the meter?
Well, let's talk about encryption.
What prevents attackers from
using a GSM broadcaster near the meter
in order to control it?
Well, nothing.
Some some utilities are not implementing
any kind of encryption by the
standard on their smart meters.
This has been discussed even at twenty
eight, fifty five years
ago by Dario
Carluccio and Stephan Brancowitz.
I hope I pronounce that correctly.
Yet many utilities didn't
quite get a message and left their
communication protocols completely
unencrypted.
But let's assume our utility
is very security oriented and
they are using encryption.
What kind of encryption are they using?
Well, most, if not all smart meters
around the world only supports
the A5 algorithm
in order to communicate using GSM.
I really heard that from the crowd.
And you're completely right because the
A5 algorithm has been known for
many years to be relatively broken,
but still kind of secure.
So it can just brute force the encryption
key and decrypt all communications.
But what about hijacking?
What happens if an attacker use some
kind of a GSM test station
and force the meter to use it
by broadcasting stronger than
the original base station?
Well, in that case, the meter
will not only connect to the station,
it will also try to authenticate itself
using its hard coded credentials,
allowing the attacker to hijack the GPS
traffic and completely take over the
meter. But, you know,
that's just one meter, right?
Why can't attackers do that to
all meters, one at a time?
Well, not only they can,
they won't have to, because all
meters of the same thing is using
the same. A finger then shows.
If an attacker will gain access to one
meter, it will have access to
all one key
to rule them all.
The sad thing is that this
whole security fiasco
could have been avoided if
utilities were using proper encryption
in their GSM traffic and attacker
wouldn't be able to hijack it if
utilities were segmenting
parts of the network instead of using one
gite, LAN and Ataka wouldn't
be able to access all the meters.
And if utilities were actually
monitoring the Smart Meter network,
they would stop an attacker way before
it could compromise their entire network.
All in all, in its current state,
the Smart Meter Network is
completely exposed to attackers.
But that's just how we attack
the meters.
What if an attacker doesn't want to use
GSM?
What if he wants to take over
your house?
Now's the time to talk about Ziggy.
Ziggy is a communication protocol
used in home area networks, as
in the local networks used by your smart
appliances.
Now this protocol has
been standardized in two thousand
and three a year, in which
the term information security
made as little sense as
collecting Donald Trump president for
that matter.
Now, keeping that in mind, Zogby
also supports a huge amount
of different devices, ranging from
a simple light bulb to the most complex
air conditioner.
In order to do that, hundreds
of hundreds of specifications has
been created and implemented in the
application layer of the protocol.
This created a situation
in which sometimes two different
devices serving the same purpose
say two toasters, had
the same features implemented
in a completely different way.
On top of that, because
of all the various use cases,
smart devices serve this report,
the secret protocol have 15
different flavors, including home
automation, health care and, of course,
smart energy, among others.
This unique situation
in which amendatory protocol
covers an enormous amount
of possible use cases
is so difficult to implement.
Vendors actually chose
what they want to implement, and
when vendors choose
what to support, they
more often than not completely
skip security.
So how do you use Igby in order to
hexameter this question
into three parts?
The first is design problems.
What misguided design decisions can
we try to exploit?
The second are implementation bugs.
How was the protocol implemented
inside them through firmware?
And lastly, management.
What mistakes does utilities do
regarding their meters?
So let's start straight with design
problems.
When a smart Hobb not a meter
acting, basically a Sprouter detects
a new device that wants to join the home
area network.
It prompts the user to approve it
before starting any form of communication
with it. That way, only approved
devices will be able to access the
private network.
Seems very logical.
That is important because the entire
home area network is basically using
the same network encryption key.
This means that if an attacker is able
to obtain that key, he could
access and mask itself as any
device. For example, he might
mask himself as the hub itself
and send different commands to devices
around the house.
Thus, this network is a
very important thing.
That's why Zuby Smart Energy
Networks are using a one hundred
twenty eight bits in order to encrypt
its communication, which is my
emails are encrypted with two thousand
bits.
But sure, now
in a regular smart jobs, the only
way an attacker might be able to steal
the keys by sniffing the network
traffic the exact moment the device is
added, which is kind of difficult.
This is because whenever the device is
approved to the network, the hub
sends it the networking,
abstracting the whole process a bit.
But that's the bottom line.
Smart meters or on
the other hand, are very different
from smart hubs because
that's a bit amazing.
But whenever a device want to join the
network, the meter does not try
to make sure it actually should
and just replies with short.
There's the key
that this means
that if we disguise ourselves as a
new smart device, we will be added
automatically to the home area
network, granting us the secret network.
Using that networking, we could
impersonate ourselves as
the actual. Meter, we could communicate
and control any device around the house
from way across the street, for example,
we can open up locks, try to shorten
the electricity system and basically
whatever we want.
Now, another
thing we can do is start communicating
with the meter itself by communicating
with the meter. We are actually granting
ourselves a fast attack surface,
the entire Zogby handling
mechanism.
This is not dangerous by itself,
but leads us directly to implementation.
Now, today, smart meters are based
either on our Linux or
plain proprietary are embedded systems.
Keep that. Keep in mind the smart
meters are supposed to be cheap.
Thus they are often lacking both CPU
power and memory
because these processors are
so modest, so to speak,
the embedded code handling
Ziba communication is often shortened
and optimized.
This sounds nice, but in reality
this leads to code that often lacks
security checks like buffer
size checks, for example.
But successfully exploiting a buffer
overflow attack in a meter might
prove to be a very tough
thing to do.
That's why you don't actually have to do
that in order to break the meter.
A simple segmentation fault
will completely crash the meter,
causing an electricity shutdown at
the premise.
On top of that, some
crashes will actually cause death,
if you remember.
So all you have to do in order
to burn someone's house
is send a very long header string,
putting the memory corruptions and
exploding meters inside
the other very severe weakness
often found in meters.
And basically a lot
of other devices are hard coded
credentials.
Most meeta have at least one
debug board available for technicians.
These debug boards are often using
the same credentials over
and over again.
In one case, we saw the credentials
for a very popular vendor.
Let's call it Latron
Smart Meter War route
as the user name and Lutron
as the password.
Not surprising, though, as they
don't think anyone will
actually trying to communicate with it.
They're not making any effort to make it
secure.
The other very important point about
implementation problems is encryption.
As we saw earlier, each utility
is using only one Perski
in order to control its entire network of
smart meters.
But what about the zombie network?
If it was impossible to inject a new
device and hijack the key,
like I showed earlier, will still
be possible to bring the encryption.
Yes, because and
you won't believe it.
The one hundred twenty eight beat a
yes guy was talking about.
It's not really made out of one hundred
twenty eight random bits.
Instead, the key is derived out
of Mehta's installation code.
S in the code.
The manufacturer assigns each meter,
which can be as high as the sixteen
by random string, but the saw as
short as six,
meaning the maximum amount of random
beats is indeed one hundred twenty eight.
But because the standard allows
it, most keys are only
made out of six random bytes, meaning
forty eight bits.
This is exactly what
happens when you
let vendors decide for themselves
which parts of the standard to implement
security is often
neglected.
Which leads us directly
to bed management.
Smart meters are already
implemented in a very wide
scale.
These security problems
are not going to just go away.
On the contrary, we are going to see
a sharp increase in smart meters
hacking attempts because they they're
such an easy target.
Yet most utilities are
not even monitoring their network of
smart meters, let alone the smart
meters themselves.
Utilities have to understand
that with great power comes great
responsibility for
their infrastructure, for their
municipal.
They operate in for
their customers, for you,
just as they monitor their other
private networks, they have to step
up and protect this one, too.
And in order to do just that, we
as a community have to act
fast.
This is why we had Valtierra.
I really seen in the upcoming weeks
our own meter fuzzing tool.
So you will have the power to inspect
smart meters legally by yourself.
You need to be in charge
again, discover new
bugs and vulnerabilities and report them.
Mail your government officials,
arrange debates on a national level,
inform the public of the dangers
of neglecting security.
We are giving you the tools
to regain control,
reclaim your home
or someone else will.
Thank you very much.
I'm scared already,
so we have plenty of time for questions.
We have, I think, eight microphones
here, one there, one there, one there,
one there and two up there.
If you can make your way up to the
microphone. We will take your questions,
make sure they actually our questions.
No, preferably.
I'll start with one.
Yeah.
You raise a number of very good points.
I've been designing electricity meters
for five years and two years
ago I started designing the smart grid
myself in the Netherlands
as an I.T.
security personnel or a
security person in the digital grid.
Right.
I want to make one notice, and that is
debt exploding meters.
Using software is simply not possible.
They simply do not have hardware that can
explode that you can control with
software. So simple as that.
So don't
be scared about your meter exploding
because of a hacker. It's not going to
happen,
if I'm not mistaken.
If I'm not mistaken,
the Ontario government officials
will probably disagree because their
meters did explode.
Now, in the official report
developed right after these explosions,
they couldn't figure out how
exactly they exploded.
They said the same thing, that the
meter isn't capable of exploding
because it lacks the hardware.
But later they found out that if
one of the chips
had the, uh,
electricity a short, I
think
it could cause the meter to
mishandle the entire
voltage, you know, passing through it and
just overheat and then explode
like the chips just overheat and explode.
And, you know, in that case, they didn't
just explode because that amount of
voltage was so great.
So, you know, it's possible that the
Netherlands doesn't have an exploding in
meters.
But, you know, I've seen plenty of
exploding meters, but never because of
anything related to sulfur.
It's usually because the installer
forgot to tighten the screws and they
overheat.
Yeah, that's what I'm talking about.
I like to take the microphone next.
That is somebody standing up there, isn't
it?
Yeah.
My question is, is it possible
to attack the vendor
of the power
plants of vuoso smart meters?
If you attack the which is very XXVI
defenders probably want to be a target
because they are not using smart meters.
The utilities will be a target
because of that. That's why vendors
doesn't really care about security,
because they're not the ones affected.
So you can hack the utility
for the smart meter.
It has been proven both by us and
other researchers, but the vendors
are probably out of the picture for now,
thanks
to police.
Yeah, I used to work on an Iot company
and it seemed like the problem with a lot
of this is that there's not motivation
for people installing these devices
to make us secure.
And even when some of us,
as developers said, this is broken, it
was usually schippert it because we have
to. So how would you recommend
us as engineers addressing the cultural
problem of shipping shitty Iot
devices?
That's a great question.
I think I think every software
engineer has come to a point
where you ask themselves that very
question about, you know,
bottom line management decisions.
You ask software engineers can't really
spend that much time on security
unless you're told so.
So the problem should be solved,
you know, from the top, not from
the bottom. In that case, no.
In my opinion.
All right.
Internet there was a question from the
Internet just before, are these
searchable if you on or other methods?
Well, if they're connected to the
Internet, then the answer is yes.
But most often they're not there.
They have their own LAN network
and they are not really connected to the
Internet.
If you do happen to find some, please
let me know.
That will be interesting to please.
Hi, thanks for the great talk.
We'd like to ask you to watch
to present and all the talks presented
here regarding mass surveillance,
everything about it.
What do you think if all
this bad design decisions are made,
then purpose.
So we would be easily
correct.
We're looking at it with bad
design decisions because we're, you know,
security people.
We do security.
And for us it's bad.
But for the government is actually very
good. They want to know what you're
using. They want to know when you're
using it. They want to predict what
you will be using.
There's a very obvious reason
as to why this whole industry industry
is booming right now, and that is
definitely control.
I don't know if surveillance is the
correct word, but
better understanding civilians
is definitely on the topic here.
I'm number one.
I'm just asking, is there actually a
central patch management or stuff
for that? Because we saw, you
know, some weeks ago that
because of shitty implementation of a
home router, like a big part of Germany
was offline because of an attack.
And if I think about, you
know, you just shut off whole
smart meters and nobody has a way to
patch them, it would be quite bad
for a country.
That's a good question, because, first
of all, they do have a sort of patching
system. They do have a few more upgrades.
All right. But the hardware
itself is not going to change
the meters.
You know, life cycle is approximately
twenty five years.
So, you know, even with
the best firmware upgrading
the world and the best encryption keys
in the world, the meter.
Can support, you know, up to a certain
level, so we'll
see what happens in about 20 years and
if the patching system really worked,
like to take a question from the Internet
again.
Why roll out smart meters on home level
anyway, would technically not be enough
to roll them out on street level to
adjust the power in the grid.
It will be enough if the cities
themselves would would be
the only ones wanting smart
meters. But utilities are wanting smart
meters. Utilities want to control
each and every consumer's home.
So, you know, setting up, setting
them up on the street can be effective
to a certain point for cities.
But the utilities, they have to have
a meter for every consumer, for
every house, for every apartment.
Microphone three.
In Germany, we have the situation that
the smart meters are becoming
mandatory over a couple of
years, which is a bad thing
in my opinion. And but they are also
going through a very rigid certification
process, which is a good thing, although
it does not open source and verifiable by
the U.S. to see, for example, not
so good. However, what is the status
in your community and your
sphere?
Are they becoming mandatory?
And is there are
other plans
to certify them before
they can be put online and
put into operation?
Well, um, part of the
German specifications is online.
You can read it.
I did so myself.
Um, anyway, did the whole
you know, German standardization
is often taken security
as a recommended thing to have
both the Germany in the US and
all Europe in its entirety
are just recommending utilities
to implement security.
But once you recommend
something to these large organizations,
they are you know, they often won't
really implement it.
So my hope is
that this stock will bring
some change.
This is why I'm standing here.
I want these standards and
situation to be changed.
Uh, but that's going to happen only
if we as a community will,
you know, act together to make
that happen.
So microphone seven.
Hi, as I'm destined,
Europe wants to
install it right out everywhere,
so they will probably go on
by being a good example and rolling
out in every public administration
and so on.
So there might be a bit of leverage here
if, you know, you go to your
administration and, oh, well, the
computers don't work anymore because
there is no current, no energy.
Well, I do not support any illegal
activities for or for
the protocol.
And
something needs to be changed and
something needs to be done in order for
these large organization to actually
change something.
How it's going to be done, that's up to
you, because your your German
is. I'm unfortunately not, but,
uh.
I don't know if threatening will
will be the key
in this in this debate,
but.
Definitely something like I don't know,
I don't want to recommend anything
specific, so microphone
to talk.
Did you look at any data that show
the balance between big consumers
like factories and shopping malls and
offices and households with
smart meters and smart devices?
The question is, can the
controlling of smart devices
have a benefit for the managing
of the change to renewable energies?
Well, of course, smart meters also
allow consumers to generate
electricity himself and sell it back
to the utility through solar panels or
whatnot. So there are
a lot of reasons for why
smart meters are becoming so popular, for
why they are being regulated so heavily.
A lot of reasons, trust me.
Microphone for I
have a question about your
2038 problem
because you say, well, smart
meters are installed for 25
years now.
Well, at least if you can sum
up this year
plus twenty five and you come
in the area of two thousand thirty
eight, is the problem handled
and is it a security issue
at all?
Are you asking about two thousand thirty
eight right now? Yes.
I have no idea what's going to be two
thousand for. I have no idea.
Well because the time will overflow
so.
Well will it then just stop
or will it just
put a wrong date on the data
or what will happen or is
it handled at all?
I have no idea this
going to be at the center for the I
understand the question.
I think I
think most of them, you know, date
wise, we'll probably
need a software update patch,
but they are acting on,
if I'm not mistaken, a 30 to bit
kind of professor. So we'll see.
Sounds like a great debate for Twitter.
Your microphone eight.
See you in twenty five years.
Yeah, hi.
I'm happy that you put
this topic to
this conference and I think it's very
important to talk about this topic.
But I'm kind of unhappy
that you did this by
fearing and
I'm not very happy about
how you presented it, because you're
simplified a lot and.
You simplified a lot, and I don't think
that this is the way we get a better
solution, and that's what we should
aim for.
That's a good point. That's a good point.
I did frighten a lot
of it was on purpose, of course, because
we are security experts.
We hear something can get hacked and we
want to do something about that.
We care about these things because we
understand the situation.
But, you know, common people
who aren't in the security industry
doesn't really know the effects of
someone hacking their meters.
So it is
mainly, you know, all the
frightening points, so
to speak, is targeted to them.
So they will understand what's going
on. But that that is a valid
point, you know.
The Internet has another question.
Why use wireless protocols and not
use a power line,
they do use power line.
I mentioned they use power lines on
skyscrapers and so
on.
There is a very hard
limit to the extent p.l.c.
will work.
So they are using it for
short distances.
But when they are trying to communicate
with the command and control server, they
have to use some kind of wireless
protocol.
Microphone two, I
did you look into any other protocols in
Hollywood formation, not only sick,
because I think many American
big thing there and other countries,
continents, there are other protocols.
If you look into that, there are there
are protocols. The main protocol in the
smart energy industry is igby.
And, you know, its power is about 99
something percent of all smart meters in
the world. So we try to focus on that.
We didn't really look at other more
proprietary protocols.
Micron three I have
a question about the possibility of
controlling local Iot devices
because I'm not aware of many smart
meters designs, but ultimately
these are connected totally passively
to the power grid.
So what are the chances of
controlling local Iot devices
separately, not only by turning
on or off the whole power
grid, if it's even possible?
Um.
Well, let me answer on a journal,
General note here.
If the device
is using certain wireless protocols,
then it won't be only possible
to hack it. It will be probably pretty
easy. But if
it won't use any wireless protocol, you
know, it is going to use only p.l.c.
or, you know,
uh, I don't know, Ethernet or something.
It will be more difficult to to hack
it just for, you know, because
of the simple reason that utilities can
detect it more easily than wireless
attacks.
Mm hmm. OK, thanks.
Microphone eight.
Hi.
I'd like to know if you had a look at it
from way of deploying smart metering,
especially the, uh, the
whole hierarchy of smart meters,
smart meter database and then up to the
gateway administrator you're talking
about. I'm sorry.
You're talking about Itron.
I don't know the
let's call it Chumby of smart
metering because we have quite a
different approach to it, if less
secure Nosik be and
more like a
more centralized infrastructure.
In what way is it more centralized?
Just so I get the whole picture,
you have your Amita's not only smart
meters, but also analog meters may
connect to a smart meter gateway
and those cables connect to a
gateway administrator.
Deliver all the data.
Mm hmm. So we have
Nosik B MASH
devices in your home and.
Well, I don't have a definitive
answer for that because we focused on
smart meters that do use Digby.
And, um,
you know, that's a good question.
Maybe come later and we'll discuss it
a bit further because I don't want to,
you know, steal time from
anyone else right now.
So I think there was one question from
the Internet.
There are still a couple of questions,
but I'll start with one here.
Since the smart meters are being
legislated into being installed, could we
also work on improving legislation
regarding security?
Of course. Of course.
That's what we should do.
We should improve legislation about
security.
And, uh, that's the
whole point, basically, because if we
force vendors and utilities to implement
better security, they just won't do it.
But if the government will force them,
it's a whole different story.
So we've none no more from the floor,
do I take another one?
On to the book, Portus
talked about protected by SEALs
in some areas, they are in some meters
they aren't.
It really depends on the vendor, but
the technicians that
do come physically to the meter
will have access to it.
So even if it is sealed, we
can still communicate with it and not
worry about the ceiling later.
And I think that's the end of the
questions I would like to thank
Marty for his great presentation.
Thank you very much.