Smart Muttering; a story and toolset for smart meter platform by Ian de Villiers

1. [SensePost – 2015]
Smart Mutterings
–
A Tale of Hardware Haxory
ian@sensepost.com

2. [SensePost – 2015]
`whoami`
Ian de Villiers

3. [SensePost – 2015]
Why ?
• The South African perspective…

4. [SensePost – 2015]
Why ?

5. [SensePost – 2015]
Why ?

6. [SensePost – 2015]
Why ?

7. [SensePost – 2015]
Why ?
• Same hardware used in:
– Smart Metering (Duh…)
– Industrial / Process Control
– Transport Management
– Building Automation

8. [SensePost – 2015]
Why ?
• Same hardware used in:
– Smart Metering (Duh…)
– Industrial / Process Control
– Transport Management
– Building Automation
– Garden Irrigation Platform 

9. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface

10. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
Electricity
Data (Ex: Geyser Control)

11. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
Electricity
Data

12. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
• Privacy Concerns

13. [SensePost – 2015]
Why ?

14. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
• Privacy Concerns
• Mike Davis. IO Active. BlackHat 2009

15. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
• Privacy Concerns
• Mike Davis. IO Active. BlackHat 2009
– (I was there, but didn’t see this talk )

16. [SensePost – 2015]
Why ?

17. [SensePost – 2015]
Why ?

18. [SensePost – 2015]
Why ?

19. [SensePost – 2015]
Why ?

20. [SensePost – 2015]
Why ?

21. [SensePost – 2015]
Why ?
• Utility Networks && Increased Attack
Surface
• Privacy Concerns
• Mike Davis. IO Active. BlackHat 2009
– (I was there, but didn’t see this talk )
• Program Errors. strcpy Anyone ?

22. [SensePost – 2015]
Why ?

23. [SensePost – 2015]
Why ?

24. [SensePost – 2015]
What ?
• Wouldn’t it be cool to interface with the
stuff natively ?
– Look at attacks against other devices (ala IO
Active)
– Look at attacks against infrastructure

25. [SensePost – 2015]
Echelon ?
• Developed the Neuron Chip
– Often used in 3rd party solutions
• Sold Smart Meter business in 2014
• “Industrial Internet of Things”
(We really need some new clichés)

26. [SensePost – 2015]
Echelon ?
• Developed the Neuron Chip
– Often used in 3rd party solutions
• Sold Smart Meter business in 2014
• “Industrial Internet of Things”
(We really need some new clichés)
• Developed and Standardised the LonMark
protocol
– Now termed LonWorks or ANSI/CEA-709.1

27. [SensePost – 2015]
Echelon ?
• Approximately 90 million devices deployed
in 2010
• Train control systems
• Electro-Pneumatic Braking Systems
• Fuel Control
• Building Automation
• Appliance Control and Monitoring

28. [SensePost – 2015]
Echelon ?
• Approximately 90 million devices deployed
in 2010
• Train control systems
• Electro-Pneumatic Braking Systems
• Fuel Control
• Building Automation
• Appliance Control and Monitoring
• (and as I said – Garden Irrigation to come)
• …

29. [SensePost – 2015]
Echelon ?
• Also: “Saffers” are cheap 

30. [SensePost – 2015]
Echelon ?

31. [SensePost – 2015]
LonWorks Protocol ?
• LonWorks Protocol
– IEC 14908-1

32. [SensePost – 2015]
TP/FT-10 ?
• TP/FT-10
– IEC 14908-2

33. [SensePost – 2015]
TP/FT-10 ?
• Twisted Pair Medium
• Linear Bus or “Free Topology”
• Maximum length 2.7km + 500m
• 64 Devices per bus
• 78kbps
• Shared Medium :D/
• Need to be terminated
– #include <disclaimer.h>

34. [SensePost – 2015]
TP/FT-10 ?

35. [SensePost – 2015]
Communications ?
• Tragedy…. 

36. [SensePost – 2015]
Communications ?
• Tragedy…. 

37. [SensePost – 2015]
Communications ?
• Tragedy…. 
• Show must go on...

38. [SensePost – 2015]
Communications ?

39. [SensePost – 2015]
Communications ?
• Demonstrate partially working bus sniffing
(Via a very creative approach… )

40. [SensePost – 2015]
Communications ?
• Demonstrate partially working bus sniffing
(Via a very creative approach… )
• Demonstrate partially working bus
“injection”
• Lots of bad packets:
– Exceptions in UsbLta.dll
– Smart Meter Crashes (int over-run)

41. [SensePost – 2015]
Communications ?
• Demonstrate partially working bus sniffing
(Via a very creative approach… )
• Demonstrate partially working bus
“injection”
• Lots of bad packets:
– Exceptions in UsbLta.dll
– Smart Meter Crashes
• Demonstrate toolset by intercepting other
digital comms

42. [SensePost – 2015]
Communications ?
• 78kbps (I’ve mentioned that)
• Manchester Encoded bit-stream (I’ve not
mentioned that yet)
• Not serial (although you can DoS the bus
with it)
– Observed strange things with LTAUSB.dll
• Media agnostic
• Determines reversed polarity
– Makes it very easy to just “plug and play”

43. [SensePost – 2015]
Communications ?
• Differential Manchester Encoding
• Allows retrieval of the clock cycle
• Encodes bits alongside this clock
– Full clock-cycle L or H == 1
– Half clock-cycle L or H == 0

44. [SensePost – 2015]
Communications ?

45. [SensePost – 2015]
Communications ?
• No communication == Line state is
undriven
• Followed by “Byte Sync”. Series of
“Manchester ones” opposite to un-driven
line state
• Followed by “Bit Sync”. One “Manchester
zero”

46. [SensePost – 2015]
Communications ?

47. [SensePost – 2015]
Communications ?
• No communication == Line state is
undriven
• Followed by “Byte Sync”. Series of
“Manchester ones” opposite to un-driven
line state
• Followed by “Bit Sync”. One “Manchester
zero”
• Followed by packet data
• Followed by CRC

48. [SensePost – 2015]
Communications ?
• Addressing
– Domain (48 bits)
– Subnet (4 bits)
– Node (48 bits)

49. [SensePost – 2015]
Communications ?
• Authentication
– Key-based
• Key distributed via LonWorks Protocol message
• (Did I mention the TP-FT-10 media is shared?)
– Challenge response-based
– Not published

50. [SensePost – 2015]
Communications ?
• Application-Level “Messages”
struct message {
int destin_type;
int data[];
}

51. [SensePost – 2015]
Communications ?
• 00...... – Application Message
• 10...... – Incoming Network Variable
• 1d...... – Outgoing Network Variable
• 011..... – Network Management
• 0101.... – Diagnostics

52. [SensePost – 2015]
Shunting Data
• Injecting Data into <insert name here >
communication streams
– Input Arduino
– PC
– Java
– Output Arduino

53. [SensePost – 2015]
Shunting Data

54. [SensePost – 2015]
Shunting Data

55. [SensePost – 2015]
Shunting Data

56. [SensePost – 2015]
Shunting Data

57. [SensePost – 2015]
Demo Time
VIDEO

58. [SensePost – 2015]
Demo Time

59. [SensePost – 2015]
Demo Time
VIDEO

60. [SensePost – 2015]
Demo Time
VIDEO

61. [SensePost – 2015]
Demo Time
VIDEO

62. [SensePost – 2015]
Demo Time
VIDEO

63. [SensePost – 2015]
Demo Time

64. [SensePost – 2015]
Demo Time

65. [SensePost – 2015]
Demo Time

66. [SensePost – 2015]
Demo Time

67. [SensePost – 2015]
Demo Time

68. [SensePost – 2015]
Demo Time

69. [SensePost – 2015]
Tools ?
• Need to build the JNI components for JNI
and OS/X
• Will publish on GIT by next week
• Watch www.sensepost.com/blog for post

70. [SensePost – 2015]
Conclusion
• A lot to shoot at in this field
• A lot of stuff will probably break
• Never release the “Magic Smoke”

71. [SensePost – 2015]
Questions ?
ian@sensepost.com
www.sensepost.com/blog