Lights Off! The Darkness of the Smart Meters
summary
Smart power meter hardware exposes live attack paths: firmware gets dumped over SWD, PLC flash is pulled, and a logic analyzer on the I2C/EO link reveals the AES key shared across all meters. A €300–€400 optical debugger is avoidable by emulating the PLC with an Arduino and an STM dev board loaded with dumped firmware — the emulator works. Meters accept a remote power cut command, can enter sniffer mode enabled by one flag, and can be firmware-updated en masse, enabling spoofing, false bills, or wide blackouts.
AI-written summary · about
chapters (14)
- 0:00Introduction and overview
- 4:14Smart meter architecture
- 8:18Network and communication
- 10:29Security features and PCB
- 14:25Microcontroller debugging
- 17:56PLC and custom hardware
- 21:17Dumping firmware
- 25:36Hardware emulation
- 27:55Bypassing security
- 30:37Analyzing communications
- 35:47EEPROM manipulation
- 39:59Data extraction
- 43:31Exploitation and conclusions
- 53:39Final remarks
related talks
29mReverse Engineering Smart Meters
53mCybersecurity of SmartGrid
01h 02mWhen the Lights Go Out: Hacking Cisco EnergyWise
43mWe know when you are sleeping: The Rise of Energy Smart Meters
26mA Lightbulb Worm?
40mSmart IoT: IoT Botnet Attacks on Power Grids Exploiting Their Weak Points
45mThe Bulb That Knew Too Much: A Journey into IoT Security
26mBlackIoT: IoT Botnet of High Wattage Devices Can Disrupt the Power Grid