Skip to main content

Does Smart Grid Open up Covert Communications? - Smart Grid Steganography

The latest Smart Grid technology promises to reduce energy wastage and save money by enabling your household equipment to 'talk' to central servers and neighbouring equipment about their usage and energy requirements. This allows you to highlight how much equipment is costing you to run and how much you could save by turning it off, getting more efficient equipment, running it off-peak, etc. It also enables micro-generation of power and the ability to sell it to the grid or neighbouring properties. There are many privacy issues surrounding this technology, many of which are highlighted by Susan Lyon in her article 'Privacy challenges could stall smart grid'. Obviously, there are much bigger issues than the consumer part of the solution, e.g. the self-healing nature of the power grid due to failure or attack, but the fact remains that people's equipment and homes will be connected to this.

With this in mind, there is another potential issue (or advantage) in my opinion, which people are missing when they talk about security. What about if we aren't attacking the grid or trying to steal energy? Most of the security discussions are centred around being resistant to attack. What if we use the Smart Grid as another network that isn't monitored as well as other channels? We can use it as a communications channel by exploiting valid signals and spurious equipment or usage. This could be a great Steganographic channel (Steganography being the art of hiding a message in a plaintext carrier).

The privacy debate is looking at the control of the release of your information and tracking. However, I can always see what my energy usage/generation is and obtain signals from my smart equipment. I can choose to allow someone else to see this as well (even if it is by telling them what my password is). I can now increase/decrease my energy usage or generation to send coded information to another party. This can get more sophisticated by having a device that can pretend to be a number of household appliances with different energy demands and patterns. If this will transmit it's usage onto the grid, then we can also read this off the grid. Similarly, I can get two devices to communicate usage and pricing levels over the network, that's what it's for. What about if I agree to sell you energy from my micro power plant at a particular price - it could be an absurd price, it doesn't matter so long as it is a valid communication according to the protocols used. The price will be a number presumably, so what if my number is an encrypted message and not a price at all? (Could micro power generation be used for money laundering?)

The protocols to be used for a large-scale Smart Grid are still in development, but they are likely to have similar traits to current networks (indeed Cisco is pushing an IP solution). This means that Steganographic IP traffic is just as possible on this network as on the Internet. It also means that we should be able to send virtually any message we like on the network. The smart grid operators will have to check for well-formed traffic, but we can still conform to the standards and send spurious data as long as we don't attack the network. Can we use this for covert communications?


Popular Posts

You say it's 'Security Best Practice' - prove it!

Over the last few weeks I have had many conversations and even attended presentations where people talk about 'Security Best Practices' and how we should all follow them. However, 'Best Practice' is just another way of saying 'What everyone else does!' OK, so if everyone else does it and it's the right thing to do, you should be able to prove it. The trouble is that nobody ever measures best practice - why would you? If everyone's doing it, it must be right. Well, I don't agree with this sentiment. Don't get me wrong, many of the so-called best practices are good for most organisations, but blindly following them without thought for your specific business could cause as many problems as you solve. I see best practice like buying an off-the-peg suit - it will fit most people acceptably well if they are a fairly 'normal' size and shape. However, it will never fit as well as a tailored suit and isn't an option for those of us who are o

Trusteer or no trust 'ere...

...that is the question. Well, I've had more of a look into Trusteer's Rapport, and it seems that my fears were justified. There are many security professionals out there who are claiming that this is 'snake oil' - marketing hype for something that isn't possible. Trusteer's Rapport gives security 'guaranteed' even if your machine is infected with malware according to their marketing department. Now any security professional worth his salt will tell you that this is rubbish and you should run a mile from claims like this. Anyway, I will try to address a few questions I raised in my last post about this. Firstly, I was correct in my assumption that Rapport requires a list of the servers that you wish to communicate with; it contacts a secure DNS server, which has a list already in it. This is how it switches from a phishing site to the legitimate site silently in the background. I have yet to fully investigate the security of this DNS, however, as most

Web Hosting Security Policy & Guidelines

I have seen so many websites hosted and developed insecurely that I have often thought I should write a guide of sorts for those wanting to commission a new website. Now I have have actually been asked to develop a web hosting security policy and a set of guidelines to give to project managers for dissemination to developers and hosting providers. So, I thought I would share some of my advice here. Before I do, though, I have to answer why we need this policy in the first place? There are many types of attack on websites, but these can be broadly categorised as follows: Denial of Service (DoS), Defacement and Data Breaches/Information Stealing. Data breaches and defacements hurt businesses' reputations and customer confidence as well as having direct financial impacts. But surely any hosting provider or solution developer will have these standards in place, yes? Well, in my experience the answer is no. It is true that they are mostly common sense and most providers will conform