Slashdot Mirror
Some Smart Meters Broadcast Readings in the Clear
alphadogg writes "University of South Carolina have discovered that some types of electricity meter are broadcasting unencrypted information that, with the right software, would enable eavesdroppers to determine whether you're at home. The meters, called AMR (automatic meter reading) in the utility industry, are a first-generation smart meter technology and they are installed in one third of American homes and businesses. They are intended to make it easy for utilities to collect meter readings. Instead of requiring access to your home, workers need simply drive or walk by a house with a handheld terminal and the current meter reading can be received."
Perhaps more distressing, given trends in 4th amendment interpretation, I bet the transmissions are open game for law enforcement.
Or just asleep.. Or they have a low power foot print most of the time.
Cars in the driveway and no one answering the door is a more accuarate and low-tech way to do this.
---- Booth was a patriot ----
So let me get this straight... if somebody wants to know when you're home, they're going to run out and buy a radio and learn to use it, then sniff your meter's transmissions, then analyse them for periodic components, then correlate that with known patterns... rather than just waiting to watch you leave?
You do not have a moral or legal right to do absolutely anything you want.
While it does seem a little paranoid to think burglars and the like are going to sit in your bushes monitoring your power usage, it wouldn't be hard to simply encrypt the transmissions. In today's society this seems like a no-brainer.
You can also tell if someone is home through unencrypted lightbulb signals through windows.
The range of AMR meters is just long enough that you're going to have to figure which of a dozen homes or so you're getting reads from, and you'll need to be parked there while the occupants of the home aren't home. While you're sitting there trying to figure out which readings go with what house you could just as easily be looking at the lights in the various houses, waiting for one where they've been off for a while. These are dumb meters and this is a dumb article with no real threat.
So, next time, in addition to getting tin foil for the hats, you should get non reflective paint for the whole structure, shock isolating floating foundation for the entire home and special noise cancelling speakers attached to the plumbing. Else, gasp! thieves will know when you are in and when you are not in your own home.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I recognize the meters she used in her testing, and they are all several years old. She is correct, in a product that is pre-2007 it did not have any security. If she was to contact the company that makes those meters today and get more recent product, she would find a very different story.
Even then it is wholly a utility decision to encrypt their meters. If the utility doesn't think it's an issue, then they won't encrypt.
This is not a problem with the smart meter manufacturers, but a problem with the users of smart meters. Just like your home wireless, security is useless if you don't use it.
This information has never been secret. Most electricity meters are mounted on the outside of the structure in an easily accessible location with dials that are easy to read at a distance with a pair of binoculars. This is by design, allowing the utility companies to do meter readings as efficiently as possible.
Am I the only one wondering how easy it would be to spoof your or others readings for nefarious purposes?
There's the implicit statement that all smart meters are deployed the same way. Since this experiment shows that one smart meter vendor is producing sniffable traffic. It does not show that all vendors are in the same situation.
Some vendors are better than others in this regard.
ANSI requires that your electricity usage be displayed on the meter. There is no way to hide your electricity usage from someone who wants to know.
If I were to use I would look for trends of places where its consistently quiet during particular times of the day to help me plan potential places to do more recon.....
As a meter reader who actually reads some of these AMR meters, I'd say using the information for burglaries is a stretch. Even if you get the info it only includes meter number and reading. Since the address is not listed I can only see it being useful in rural areas where houses are far enough apart to be able to tell which house it is without physically checking the meter. For reference, I can pick up AMR meters in rural areas from about 1/2 to 3/4 a mile away while driving 50 mph. I see the greater nefarious use would be to send out a slightly stronger signal to send a different reading and hence lower your utility bill. Since this process would be wireless and most likely involve doing nothing to the physical meter itself it would be near impossible to catch it as tampering. Also since in my area AMR meters are almost never physically checked, even a physical modification would likely go unnoticed for years.
Inherited Will. The Destiny of the Age, and the Dreams of the People. These are things that will not be stopped. As l
would be law enforcement war driving for pot farms.
Yes, they are. You don't 'own' the meter. If you want to block the transmission, just jam the signal.
“He’s not deformed, he’s just drunk!”
I know something about these meters. First of all, they give you the current meter reading in KWH, not how much current is currently in use; you would have to take multiple samples to get that.
Second of all, they are very omnidirectional and have a reasonable range, so someone can read them from the street on most houses. Which means they get several houses with any reader. The unique identifier is easily determinable, in our case it's stamped on the back side of the meter, all you have to do is pull it off the base and check it. The meters are programmed with a route and subroute number, and respond to an unencrypted transmission asking for their info by broadcasting it.
As far as the 4th amendment is concerned, the police would need a warrant to get all the bits and pieces together to connect a particular meter with a particular house in the first place.
Finally, the readers cost us roughly $8k each. While I'm sure it's doable cheaper, I don't see people putting that kind of effort into this. Especially as the same info can be gotten by walking up and looking at the meter. While I certainly have my concerns of security for real 'smart meters' these are not what we should focus on.
The absolute worst thing about the installation of smart meters in these parts is the endless string of "news stories" by our local community "newspaper"* about the significant health risks posed by smart meters.
It finally reached the point where, lacking any scientific evidence, they're now resorting to trying to outlaw Smart Meters, WIFI, and cel towers because of "electromagnetic hypersensitivity (EHS). Patients with EHS suffer a variety of symptoms from heart palpitations to migraines they claim are caused by radio frequency radiation.
"You know that western medicine doctors don't know anything about EHS and my naturopath actually tested me. On the sole of the foot on the inside there is a point where he tests the sensitivity to electromagnetic fields. It was very painful and he found out that I am very sensitive," Nemetzade says.
* scare quotes used because, well, the rag is actually pretty scary.
Three Squirrels
It'll require a smartphone and a little attachment. I give it five years.
In crooks were always so stupid, why would we require so many, in many places well educated, police officers?
With even cheaper equipment, cops can detect your grow lights from IR emissions.
If it's possible to distinguish when someone is home from when they are not home based on their electricity usage, a countermeasure would be to install a device inside the home that draws electricity according to a pattern that is indistinguishable from the "at home" usage pattern. Then when you'll be away from home for an extended period, turn on this device. With the noise generated by this device, it will always appear that someone is at home based on real-time electricity meter readings. The device would not need to use much electricity to make the difference between "at home" and "not at home" indistinguishable. If the device serves the purpose of charging a large battery in your basement, you could recover most of the device's small electrical draw.
Using cryptography will be nightmare here: who gets the keys to decrypt? Too many people. Keys will be compromised and will have to be updated. How? Should the smart meter be remotely controlled by the utility? That is smelling bad.
Yes, they are. You don't 'own' the meter. If you want to block the transmission, just jam the signal.
Yeah, that will show those cops! It's not like the reading can be read with the naked eye from outside my house, after all.
The summary is about concern over broadcasting the signal and the police tapping into it. So was my comment, which seemed to offend a moderator. If they actually have to come and read the meter, it kinda blows their cover. More likely they would simply ask the electric company to cough up a copy of the bill, and the electric company has no interest in your 4th amendments rights, which aren't being violated in this instance anyway. Hope that clears things up a bit, in case you weren't just being silly.
“He’s not deformed, he’s just drunk!”
This article or study is "not so clever." If someone wants to identify whether or not someone is home it'd be much easier to monitor activity at the house than it would be to try and track equipment cycling on or off via a smart meter. Sure we could install all kinds of encryption on a meter, but for what purpose? -- drive up costs of a utility meter! This is one of the dumbest articles I've ever seen.
Other ways to tell if someone is home
1. Sniff internet packets
2. check facebook
2. knock on the door
3. look for cars in the driveway
4. look if lights are on in the house
5. looking for movement in the house
6. check for strong cell phone signal coming out of the house
7. listen for voices
8. use infrared technology
9. call the neighbors and ask them
10. check the actual electric or water meter (this is probably the least reliable of all methods above)
Typically people looking to get into other peoples houses aren't trying to phreak weak data from a wireless electric meter. Please stop writing crap like this so I don't have to pay an extra $1,000 dollars a year to have a triple encrypted electric meter with firewalled dedicated internet connection.
People act like hackers aren't hacking though encryption and other security measures. Nothing in the digital age is 100% safe or secure. Get over it. It's still the best solution with the least risk. Electric meters are the least of our worries.
You let a goat suck your dick? Goatfucker.
Power usage is 0 when not at home and > 0 when at home.
Boy, this story is so familiar... just can't quite recall where I saw it before.
Which means the BOM cost is probably around $400. The massive markup is passed along to the suck^H^H^H^H customers, so MomCorp doesn't give a crap about being soaked.
In Finland we transmit this sort of data through the mobile network, which allows (for example) the power company to provide up-to-date (few minute lag) info about power consumption in their website.
I bet the instrument itself has an IP address and my only concern is if Anonymous hacks the meter!!
AMR (automatic meter reading) just send metering data via mobile phone or other means.
That is not a smart meter.
However I agree traffic should be encrypted.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
This is interesting but has existed for years - DON'T just mod me down - finish reading, please.
What's new is the Duke Energy "New Awesome Smart Meter That Makes Your Home More Power-Friendly" meter (that's literally how they present it and it's suggested to be just that on the meter itself).
This meter is a replacement that all customers (at least in the Greater Cincinnati Tri-State area) are required to let Duke come out and swap. Oh, they charge you for the swap, too.
If you'll look at the poles with transformers installed on them, there's a new little grey box that's installed with an attachment to the 240v low side as well as the high voltage side (bypassing the transformer).
This new setup allows Duke to remotely signal (by wire) your meter to read it, AND (this is what they're not telling people), shut it of remotely if your bills aren't current (no pun intended). No more dogs protecting your power meter from a pull, less Humans needed hired for this manual labor, faster disconnect and reconnect, etc.
This is something other power companies will follow suit with soon, so I'm sure people needn't worry too much about this wireless power meter issue that's existed for years and hasn't been knowingly exploited before now.
So we have meters that can remotely command thermostat set-back, and others that can romotely disconnect power entirely. If any of these have security problems on the command side, they've essentially opened the door to crooks (or cops) cutting off your power, likely with no evidence trail created. If they shut it off and nobody opens a curtain it's a pretty safe bet that there's nobody home.
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
You guys(and the researcher) are looking at the wrong end of this. The "privacy" issues are ludicrous. But, the benefit to the consumer, who can use the unencrypted signal to FINALLY have access to their usage data is a huge benefit. What's more is that this should be doable with a $20 SDR dongle and any PC.
I've always wanted a cheap way to have a granular look at my home's consumption levels and patterns. I don't want to install clamps in the breaker box and spend a couple of hundred dollars on the equipment to do it. Having the ability to also compare and contrast my usage with that of my neighbors makes it all the better.
I've been trying to accomplish just this for some months now. I've known all along that it was possible. But, I lack RF knowledge, programming skills or this researchers capability to decode and reverse engineer the signal. I'd love it if she would publish the source to her receiver driver/interpreter.