6 ms·

38C3: Blinkencity, radio controlling street lamps and power plants [video]

216 points by aunderscored 2y ago

aunderscored 2y ago
Saw this in person, awesome look at street lamp control and then walking that all the way up to "oops we figured out a way to attack the European power grid"
pantalaimon 2y ago
I can imagine how this went: - We have this protocol to switch the streetlights remotely by modulating a signal on the main - but that's needing expensive hardware and it's cumbersome. Can't we just sent that over radio instead? - There is all this decentralized renewable energy generation, we need a way to switch that off remotely if there is an overload in the grid - hey, we already have that hardware for swtiching streetlamps, let's just use that! Of course encrption was never a concern and now anyone could remotely turn off / on power generation. But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor.
- unbelauscht 2y ago
  Like the one who's been messing with our deep sea cables?
- gorgoiler 2y ago
  I really enjoyed how the payloads are encrypted, but the implementation leaves time synchronization in plaintext. With the street lamps that work to a fixed schedule, all you have to do is reset the time between 12pm and 12am to turn them on and off (the “lamplighter” attack, in the talk.)
  - happosai 2y ago
    Listening to the talk, I don't think it was encrypted. They just said in early in the talk that it seemed encrypted due to high entropy. But later in the talk they decoded the payloads after they figured out the format. But yeah, insecure time is a underrated attack vector.
    - pantalaimon 2y ago
      As I understood it, that's likely weather data from a 3rd party (Meteocast) that they encrypt to protect their IP/subscription.
- mindcrime 2y ago
  But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor. Or thousands of individuals using relatively inexpensive HackRF One SDR's, or home-brew radio transmitters which can be built even more cheaply. Of course all those people would need a way to communicate with each other over large distances... perhaps some kind of packet switching network running over a series of tubes (or avian carriers). Hmmm.
- Muromec 2y ago
  >But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor. luckily there isn't a state actor actively sabotaging all kinds of infrastructure in Europe right now with explicit interest to sabotage renewables
  - ForOldHack 2y ago
    They could drag a boat anchor across it?
- H8crilA 2y ago
  Authentication, not necessarily encryption. It's a common misconception to think that you need the latter while you actually need the former. And no, encryption does not mean authentication, not at all, usually you can meaningfully modify the ciphertext if a given protocol has no authentication. Also, here's a fun thought experiment: consider two channels, one authentic but not encrypted, another non authentic but encrypted. Can you actually find a use for the second one? Can you find a use for securely talking to an unknown entity, other than running Omgele? :)
  - tialaramex 2y ago
    We should distinguish whether we want everybody to be able to authenticate the messages or only our intended recipient. This is separate from the question of whether the message should be encrypted. It may be reasonable for infrastructure to work only with messages everybody may authenticate since there is nothing to hide. For this purpose a Signature Scheme is ideal - simply sign your messages. Whereas for example in Signal two people could have made an Alice->Bob message. Both Alice and Bob have the keys to make such a message. Alice might have made it, and sent it to Bob, or, Bob might have just made it seem as though Alice sent him a message. Bob presumably knows if he's lying, but he can't prove it either way. The unauthenticated link is basically useless. You aren't "securely talking to an unknown entity" because if you were that would be an authenticated link. TLS 1.3 can do "securely talking to an unknown entity" - but it's an authenticated link, the unknown entity is the authenticated remote party. You don't know who they are, but you do know they're your remote party whoever that is.
    - H8crilA 2y ago
      Maybe I should have added what an encrypted, but not authenticated link looks like, because I meant it in both directions. An example would be doing unauthenticated Diffie-Hellman (without any signatures, or proving knowledge of a secret, or anything of this sort), then proceeding using the shared key with even the best of schemes. Another example would be a spy sending and receiving one-time-pad encrypted data via an untrusted, malleable channel - the only authenticity is in hoping that adversarial modifications will cause one of the endpoints to fail at "parsing" the message. It is indeed useless. Also, this property of Signal is called repudiation (or non-non-repudiation :) ), meaning that you as a party in the communication can repudiate the origin of the message, i.e. say that you didn't write it. It is a nice extra feature, on top of authenticity and secrecy.
- gunian 2y ago
  [dead]
Eduard 2y ago
TL;DR: by law, German power stations are required to "turn off" (taken off the energy grid) when they receive specific radio messages. This is intended for energy grid load balancing. Unfortunately, the message protocol is completely flawed security-wise, which allows malicious actors to control the power station. It would require only a handful of strategically placed senders to control an estimated 20 gigawatt of load Germany-wide, causing havoc on the European energy grid (brown-out, cascading effects, etc.). The security researchers followed a responsible disclosure towards the vendor, EFR, who reacted with sending letters from their lawyers. Today's SPIEGEL online news magazine pre-talk report ( https://archive.is/p66as https://archive.is/p66as ) on this topic cites EFR that the proposed attack vector is not possible. The security researchers therefore made the last minute decision to go full disclosure with today's talk to press on the urgency of the topic.
- jdiez17 2y ago
  Just read the SPIEGEL article and I think it’s a pretty balanced report on the positions of both sides. Basically, it comes down to the assertion that you can’t reach a large number of electricity generation plants with “simple radio equipment”. That is the position of EFR, and sadly, the Bundesnetzagentur (the radio communications regulator in Germany). I haven’t watched the talk yet but I think it’s pretty clear to all of us on this website, that sending a specific short radio transmission to a large area is not an insurmountable challenge for our favorite terrorist state. What I don’t understand is why there is such a reluctance to admit that these problems exist and work towards fixing them. Instead we pull the Ostrich maneuver every time. One day it’s going to really bite us in the ass. EDIT: after watching the talk, the funny thing is that all of the “business secrets” that EFR is accusing our fellow hackers of leaking, are actually mostly DIN standards. In other words, they are just upset that someone is talking about the fact that no efforts have been made to proactively secure these receivers. Peinlich.
  - Etheryte 2y ago
    Ass covering, so much ass covering everywhere. I've done a fair bit of consulting for the public sector and figuring out their office politics is often the only real way to get anything done, the actual technical discussion is often secondary.
matchamatcha 2y ago
Talk starts around ~16:20 minutes in..
- Torkel 2y ago
  And the talk itself is in English.
_ink_ 2y ago
Why do we still build new remotely controlled things and then skip security? Like when was this ever a good idea?
- avidiax 2y ago
  I think it's a failure to solve 1 + x = 2. x is the percentage of the power grid controlled by this system, which has risen over time. So at design time, the threat is just that people can turn off street lamps, which you can do with a BB gun. Then you expand to home solar. Also not so interesting. But then you expand to be a significant fraction of the grid supply and load. Now there is a substantial target that actually needs security, but which requires a full redesign.
__jonas 2y ago
That was an interesting talk! I'm not very familiar with security stuff, but I didn't really get the responsible disclosure thing – is it really unreasonable for this company to ask them not to go public just three months after their initial disclosure? I understand the 'it was known since 2013' thing, but they did also say the company was actively making improvements after the initial disclosure so they were not exactly just shoving it under the rug were they?
- Hikikomori 2y ago
  They got letter from their lawyers no?
  - __jonas 2y ago
    Yeah? I’m saying I don’t get why the letter from the lawyer is unreasonable. Sure, ideally it would have not been done via a lawyer but rather just asking them to delay going public directly since they were communicating before, but still it’s just three months after initial disclosure and they were actively making improvements and informing customers that they need to switch out hardware which I assume takes time, I think not wanting the researchers to go public just yet is pretty reasonable no? Am I missing something? As I said I’m not very familiar with security research stuff, maybe anything goes three months after disclosure, it just surprises me. Also just to be clear: the work by the researchers here is super impressive, and it’s fantastic that they are doing it, I was just wondering about this disclosure process.
    - aunderscored 2y ago
      If you always allow a company to say "wait no don't" with issues, it gives them a tool to quiet problems without solving them. Responsible disclosure is a tool , and part of that tool is the understanding that this will be public
BonoboIO 2y ago
What a great way for a state to cause havoc in all of Europe. Russia definitely has the capabilities to send such signals in a coordinated attack and deny an wrong doing. And this is just one example we know of, there must be hundreds.
- ElectRabbit 2y ago
  They have low-kHz transmitters for reaching submarines. So, for many decades already.
Towaway69 2y ago
Are there any pointers to the software they built for the flipper? It seems that they did create an app but it’s nowhere to be found on the flipper “app store”.
- ugjka 2y ago
  this seems their website https://positive.security/ https://positive.security/ not sure where they host their code
  - Towaway69 2y ago
    Thanks but from there I got nowhere, unfortunately no links to git*.com.
    - pabs3 2y ago
      https://github.com/positive-security/ https://github.com/positive-security/ Nothing there for Blinkencity yet.
oger 2y ago
The researchers did a great job in pointing out the failures in what basically is an old DIN standard that should not be used in this century. I congratulated them after the talk as I did similar research and didn’t get it finished for 38C8. Their presentation is spot on. The attack vector is definitely feasible and publicly known for a while. I honestly don’t understand why nobody in the industry wanted to switch to a safer alternative. The reaction by EFR will create an unnecessary Streisand effect and after all they will be able to upsell their customers to a (soon to be legacy) 450 MHz LTE system.

216 points by aunderscored 2y ago

Saw this in person, awesome look at street lamp control and then walking that all the way up to "oops we figured out a way to attack the European power grid"

pantalaimon 2y ago

I can imagine how this went: - We have this protocol to switch the streetlights remotely by modulating a signal on the main - but that's needing expensive hardware and it's cumbersome. Can't we just sent that over radio instead? - There is all this decentralized renewable energy generation, we need a way to switch that off remotely if there is an overload in the grid - hey, we already have that hardware for swtiching streetlamps, let's just use that! Of course encrption was never a concern and now anyone could remotely turn off / on power generation. But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor.

unbelauscht 2y ago
Like the one who's been messing with our deep sea cables?
gorgoiler 2y ago
I really enjoyed how the payloads are encrypted, but the implementation leaves time synchronization in plaintext. With the street lamps that work to a fixed schedule, all you have to do is reset the time between 12pm and 12am to turn them on and off (the “lamplighter” attack, in the talk.)
- happosai 2y ago
  Listening to the talk, I don't think it was encrypted. They just said in early in the talk that it seemed encrypted due to high entropy. But later in the talk they decoded the payloads after they figured out the format. But yeah, insecure time is a underrated attack vector.
  - pantalaimon 2y ago
    As I understood it, that's likely weather data from a 3rd party (Meteocast) that they encrypt to protect their IP/subscription.
mindcrime 2y ago
But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor. Or thousands of individuals using relatively inexpensive HackRF One SDR's, or home-brew radio transmitters which can be built even more cheaply. Of course all those people would need a way to communicate with each other over large distances... perhaps some kind of packet switching network running over a series of tubes (or avian carriers). Hmmm.
Muromec 2y ago
>But for that to cause real trouble, you'd need coordinated action that would require something like a state level actor. luckily there isn't a state actor actively sabotaging all kinds of infrastructure in Europe right now with explicit interest to sabotage renewables
- ForOldHack 2y ago
  They could drag a boat anchor across it?
H8crilA 2y ago
Authentication, not necessarily encryption. It's a common misconception to think that you need the latter while you actually need the former. And no, encryption does not mean authentication, not at all, usually you can meaningfully modify the ciphertext if a given protocol has no authentication. Also, here's a fun thought experiment: consider two channels, one authentic but not encrypted, another non authentic but encrypted. Can you actually find a use for the second one? Can you find a use for securely talking to an unknown entity, other than running Omgele? :)
- tialaramex 2y ago
  We should distinguish whether we want everybody to be able to authenticate the messages or only our intended recipient. This is separate from the question of whether the message should be encrypted. It may be reasonable for infrastructure to work only with messages everybody may authenticate since there is nothing to hide. For this purpose a Signature Scheme is ideal - simply sign your messages. Whereas for example in Signal two people could have made an Alice->Bob message. Both Alice and Bob have the keys to make such a message. Alice might have made it, and sent it to Bob, or, Bob might have just made it seem as though Alice sent him a message. Bob presumably knows if he's lying, but he can't prove it either way. The unauthenticated link is basically useless. You aren't "securely talking to an unknown entity" because if you were that would be an authenticated link. TLS 1.3 can do "securely talking to an unknown entity" - but it's an authenticated link, the unknown entity is the authenticated remote party. You don't know who they are, but you do know they're your remote party whoever that is.
  - H8crilA 2y ago
    Maybe I should have added what an encrypted, but not authenticated link looks like, because I meant it in both directions. An example would be doing unauthenticated Diffie-Hellman (without any signatures, or proving knowledge of a secret, or anything of this sort), then proceeding using the shared key with even the best of schemes. Another example would be a spy sending and receiving one-time-pad encrypted data via an untrusted, malleable channel - the only authenticity is in hoping that adversarial modifications will cause one of the endpoints to fail at "parsing" the message. It is indeed useless. Also, this property of Signal is called repudiation (or non-non-repudiation :) ), meaning that you as a party in the communication can repudiate the origin of the message, i.e. say that you didn't write it. It is a nice extra feature, on top of authenticity and secrecy.
gunian 2y ago
[dead]

Eduard 2y ago

TL;DR: by law, German power stations are required to "turn off" (taken off the energy grid) when they receive specific radio messages. This is intended for energy grid load balancing. Unfortunately, the message protocol is completely flawed security-wise, which allows malicious actors to control the power station. It would require only a handful of strategically placed senders to control an estimated 20 gigawatt of load Germany-wide, causing havoc on the European energy grid (brown-out, cascading effects, etc.). The security researchers followed a responsible disclosure towards the vendor, EFR, who reacted with sending letters from their lawyers. Today's SPIEGEL online news magazine pre-talk report ( https://archive.is/p66as https://archive.is/p66as ) on this topic cites EFR that the proposed attack vector is not possible. The security researchers therefore made the last minute decision to go full disclosure with today's talk to press on the urgency of the topic.

jdiez17 2y ago
Just read the SPIEGEL article and I think it’s a pretty balanced report on the positions of both sides. Basically, it comes down to the assertion that you can’t reach a large number of electricity generation plants with “simple radio equipment”. That is the position of EFR, and sadly, the Bundesnetzagentur (the radio communications regulator in Germany). I haven’t watched the talk yet but I think it’s pretty clear to all of us on this website, that sending a specific short radio transmission to a large area is not an insurmountable challenge for our favorite terrorist state. What I don’t understand is why there is such a reluctance to admit that these problems exist and work towards fixing them. Instead we pull the Ostrich maneuver every time. One day it’s going to really bite us in the ass. EDIT: after watching the talk, the funny thing is that all of the “business secrets” that EFR is accusing our fellow hackers of leaking, are actually mostly DIN standards. In other words, they are just upset that someone is talking about the fact that no efforts have been made to proactively secure these receivers. Peinlich.
- Etheryte 2y ago
  Ass covering, so much ass covering everywhere. I've done a fair bit of consulting for the public sector and figuring out their office politics is often the only real way to get anything done, the actual technical discussion is often secondary.

matchamatcha 2y ago

Talk starts around ~16:20 minutes in..

Torkel 2y ago
And the talk itself is in English.

_ink_ 2y ago

Why do we still build new remotely controlled things and then skip security? Like when was this ever a good idea?

avidiax 2y ago
I think it's a failure to solve 1 + x = 2. x is the percentage of the power grid controlled by this system, which has risen over time. So at design time, the threat is just that people can turn off street lamps, which you can do with a BB gun. Then you expand to home solar. Also not so interesting. But then you expand to be a significant fraction of the grid supply and load. Now there is a substantial target that actually needs security, but which requires a full redesign.

__jonas 2y ago

That was an interesting talk! I'm not very familiar with security stuff, but I didn't really get the responsible disclosure thing – is it really unreasonable for this company to ask them not to go public just three months after their initial disclosure? I understand the 'it was known since 2013' thing, but they did also say the company was actively making improvements after the initial disclosure so they were not exactly just shoving it under the rug were they?

Hikikomori 2y ago
They got letter from their lawyers no?
- __jonas 2y ago
  Yeah? I’m saying I don’t get why the letter from the lawyer is unreasonable. Sure, ideally it would have not been done via a lawyer but rather just asking them to delay going public directly since they were communicating before, but still it’s just three months after initial disclosure and they were actively making improvements and informing customers that they need to switch out hardware which I assume takes time, I think not wanting the researchers to go public just yet is pretty reasonable no? Am I missing something? As I said I’m not very familiar with security research stuff, maybe anything goes three months after disclosure, it just surprises me. Also just to be clear: the work by the researchers here is super impressive, and it’s fantastic that they are doing it, I was just wondering about this disclosure process.
  - aunderscored 2y ago
    If you always allow a company to say "wait no don't" with issues, it gives them a tool to quiet problems without solving them. Responsible disclosure is a tool , and part of that tool is the understanding that this will be public

BonoboIO 2y ago

What a great way for a state to cause havoc in all of Europe. Russia definitely has the capabilities to send such signals in a coordinated attack and deny an wrong doing. And this is just one example we know of, there must be hundreds.

ElectRabbit 2y ago
They have low-kHz transmitters for reaching submarines. So, for many decades already.

Towaway69 2y ago

Are there any pointers to the software they built for the flipper? It seems that they did create an app but it’s nowhere to be found on the flipper “app store”.

ugjka 2y ago
this seems their website https://positive.security/ https://positive.security/ not sure where they host their code
- Towaway69 2y ago
  Thanks but from there I got nowhere, unfortunately no links to git*.com.
  - pabs3 2y ago
    https://github.com/positive-security/ https://github.com/positive-security/ Nothing there for Blinkencity yet.

oger 2y ago

The researchers did a great job in pointing out the failures in what basically is an old DIN standard that should not be used in this century. I congratulated them after the talk as I did similar research and didn’t get it finished for 38C8. Their presentation is spot on. The attack vector is definitely feasible and publicly known for a while. I honestly don’t understand why nobody in the industry wanted to switch to a safer alternative. The reaction by EFR will create an unnecessary Streisand effect and after all they will be able to upsell their customers to a (soon to be legacy) 450 MHz LTE system.